Which S3 encryption, replication, and serverless SQL design has least overhead?
Determine appropriate data security controls.
Determine high-performing and/or scalable storage solutions.
Answer
Correct answer: C — Configure CRR on the existing S3 bucket with SSE-S3 and query replicated data with Athena, avoiding new-bucket migration and KMS key management.
A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing data and new data by using SQL. The company stores the data in an Amazon S3 bucket. The data must be encrypted at rest and replicated to a different AWS Region. Which solution will meet these requirements with the LEAST operational overhead?
Community Insight
The exam tests whether you can separate serverless SQL from Amazon RDS and recognize SSE-S3 plus CRR as lower overhead than building a new KMS multi-Region key bucket; the trap is assuming KMS multi-Region keys are mandatory for CRR.
This SAA-C03 question tests the least-overhead way to encrypt, cross-Region replicate, and SQL-query data in Amazon S3. It establishes that configuring CRR on the existing bucket with SSE-S3 and querying through Amazon Athena (C) avoids new-bucket migration and KMS key management.
Many learners pick A because they believe CRR requires KMS multi-Region keys, but SSE-S3-encrypted objects can be replicated with CRR and need no KMS key policy or multi-Region key administration.
Community Discussion (20 comments)
Sushmita42
👍 1
Selected: A
The question says "data must be encrypted at rest" and "replicated to a different Region". AWS recommends SSE-KMS with multi-Region keys for cross-region replication when you need strong, centralized key management. Option A uses SSE-KMS multi-Region keys, which is the more robust, secure, and future-proof choice. Option C uses SSE-S3, which is simpler but less secure and not ideal for cross-region replication at scale. Also, in the exam, "new S3 bucket" is often a hint that you should avoid messing with existing data and encryption settings — it’s cleaner and more operationally efficient.
2422182
👍 1
Selected: C
C due to: Athena = Serverless SQL Amazon Athena allows you to run SQL queries directly against data in S3 without managing servers or databases. SSE-S3 = Lowest operational overhead SSE-S3 automatically encrypts objects at rest and requires no key management. CRR = Cross-Region replication S3 Cross-Region Replication automatically replicates objects to another AWS Region.
46a8566
👍 1
Selected: A
S3 with SSE-KMS multi-Region keys + CRR + Athena meets all requirements with least overhead.
Catlyn
👍 1
Selected: C
corrfect
ln2718
👍 2
Selected: C
Chat AI - Answer C - Configure CRR on the existing S3 bucket with SSE-S3 and use Amazon Athena to query the data. Serverless SQL: Athena is fully serverless and queries data directly in S3. Encryption at rest: SSE-S3 (S3-managed keys) satisfies encryption with zero KMS key management. Cross-Region Replication: CRR works seamlessly with SSE-S3. Least overhead: No new bucket, no data reload/migration, no KMS key creation/policies, and no databases to manage (unlike RDS).
dce7e4b
👍 2
Selected: A
I would go on option A. Concidering this article: https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-config-for-kms-objects.html If we just activate the replication on the existing bucket, the unencrypted data will by replicate unencrypted. If there was an option for creating a new bucket with crr, sse-s3 AND Athena I would have chosen this one. But the nearest solution is Wright en with rds instead of Athena. So go for A
Ell89
👍 2
Selected: A
A is correct. everyone. voting for c i think isnt paying attention to the part where you need the data replicated to a different region. how are you meant to replicate it without a new bucket? everyone saying use the existing bucket.... urm what? how can you replicate into the same bucket thats in the same region and expect it to be in a different region? clearly A.
tch
👍 2
Selected: C
we don't need to create a policy specifically for Amazon S3-managed keys (SSE-S3) to encrypt objects in your S3 bucket... should be more easy and LEAST operational overhead
yangbo
👍 2
Selected: C
The default encryption for S3 is SSE-S3, and cross-region replication can be enabled normally.
FlyingHawk
👍 5
Selected: A
Amazon S3 managed keys is region specific, for CRR, we must use KMS mult-region keys. https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
FlyingHawk
👍 2
I checked AI, ChatGPT, Gemini , Claudi AI and DeepSeek think A is correct, but meta AI thinks C is correct. SSE-S3 is the default encryption, it will be least operational effort for sure. but with SSE-S3 (server-side encryption with S3-managed keys), AWS manages the encryption keys, and each region will use its own region-specific encryption key. There is no shared key between the source and destination buckets. AWS handles encryption and decryption seamlessly in each region. This approach is operationally simple but lacks control and consistency for encryption keys across regions.
LeonSauveterre
👍 9
Selected: C
A - A new bucket + KMS multi-Region keys = Too much operational oversight. B - RDS is not a serverless solution C - By using the existing S3 bucket, you eliminate the need to create a new bucket and load data into it. D - Athena supports querying using SQL, so that rules out RDS.
trinh_le
👍 2
Selected: C
It’s not require highly sensitive data or complexity gain permission. So it should use sse-s3 is suitable
Anyio
👍 2
Selected: C
The correct answer is C. Explanation: Option A: Incorrect. Although using AWS KMS multi-Region keys (SSE-KMS) and Amazon Athena to query the data meet the security and SQL querying requirements, creating a new S3 bucket and handling data migration increases operational overhead unnecessarily if the data already exists. Option C: Correct. Configuring Cross-Region Replication (CRR) on the existing S3 bucket makes efficient use of existing infrastructure and leverages server-side encryption with Amazon S3 managed keys (SSE-S3) to ensure data encryption at rest with lower operational complexity and costs compared to using KMS keys. Using Amazon Athena allows querying the data directly in S3, offering serverless and flexible SQL querying capabilities with minimal setup and operational overhead.
JA2018
👍 2
Selected: C
I will chose Option C for the following reasons: #1: Least operational overhead: Choosing "SSE-S3" over "SSE-KMS" minimizes operational overhead as it automatically manages encryption keys within S3, eliminating the need for additional KMS key management. #2: Existing S3 bucket: Reusing the existing bucket avoids the extra step of creating a new one and migrating data. #3: Athena for querying: Athena is a serverless solution ideal for querying large datasets stored in S3, aligning with the requirement for a serverless architecture.
JA2018
👍 2
For Option A: While using KMS multi-region keys provides more control, it adds extra management complexity compared to SSE-S3.
Abdullah2004
👍 3
Selected: A
A is correct
dhewa
👍 7
Selected: A
A wins because it gives us encryption with AWS KMS multi-Region keys
komorebi
👍 4
Selected: A
Answer is A
JunsK1e
👍 2
Selected: C
C is correct because it needs to replicate to different AWS region
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C keeps the existing S3 bucket, so there is no new bucket creation or data reload. SSE-S3 provides encryption at rest with S3-managed keys, and CRR supports SSE-S3-encrypted objects without KMS key policy or multi-Region key management, which keeps operational overhead lowest. Amazon Athena is serverless and runs SQL directly over S3, satisfying the requirement to analyze both existing and new data. This combination best matches the question's explicit least-operational-overhead constraint.Why the Other Options Are Wrong
A adds a new bucket and a data-loading step, and SSE-KMS multi-Region keys add key administration even though CRR does not require them when SSE-S3 is used. B and D use Amazon RDS, which is not serverless and requires database capacity, schema, and ongoing management; RDS also does not directly query S3 objects with SQL. D layers KMS multi-Region keys on top of RDS, increasing both key and database overhead. Although C does not spell out the destination bucket, a CRR configuration necessarily names one; its key differentiators are no migration and SSE-S3.Community Comment Notes
LeonSauveterre's reasoning is sound: using the existing bucket helps "eliminate the need to create a new bucket and load data into it," and RDS is not serverless. FlyingHawk and dce7e4b focus on KMS multi-Region keys, but AWS documentation treats those as one supported pattern for SSE-KMS replication, not a mandatory requirement for all CRR. tch and yangbo correctly note that SSE-S3 is the default, simpler encryption choice; the key exam point is that SSE-S3 does not block cross-Region replication.Official Reference
Exam Strategy
When "least operational overhead" appears, first eliminate options that require new buckets, data reloads, or RDS management. Then confirm the remaining option uses a serverless query engine and an encryption method that CRR supports without extra key-policy work.
Frequently Asked Questions
Why doesn't CRR require KMS multi-Region keys with SSE-S3?
S3 CRR supports SSE-S3 objects and encrypts replicas with S3-managed keys, so no KMS key policy or multi-Region key administration is needed.
Why is Amazon RDS wrong for querying S3 data here?
RDS is a managed relational database, not a serverless query engine over S3, and it adds instance, schema, and database operations that Athena avoids.
Related Analysis
Practice All SAA-C03 Questions
Access 120 questions with complete answers and detailed explanations.
View Full SAA-C03 Practice Test →