S3 CRR and Encryption for Serverless SQL Analysis

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls. Design cost-optimized network architectures.

Short answer

A Create a new S3 bucket with SSE-KMS multi-Region keys, configure CRR, load data, and use Amazon Athena.

Question

A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing data and new data by using SQL. The company stores the data in an Amazon S3 bucket. The data must be encrypted at rest and replicated to a different AWS Region. Which solution will meet these requirements with the LEAST operational overhead?
  1. Create a new S3 bucket that uses server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon Athena to query the data. Correct Answer
  2. Create a new S3 bucket that uses server-side encryption with Amazon S3 managed keys (SSE-S3). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon RDS to query the data.
  3. Configure Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use Amazon Athena to query the data.
  4. Configure S3 Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon RDS to query the data.

Key Takeaways

The core trap is confusing 'least operational overhead' with 'no changes'; while reusing the existing bucket saves migration effort, it fails the replication requirement unless a new destination is established or specific key configurations are met, which often leads to incorrect assumptions about CRR mechanics.

This question evaluates the optimal configuration for serverless data analysis using Amazon Athena, requiring Cross-Region Replication (CRR) and encryption with AWS KMS multi-Region keys to minimize operational overhead.

Common mistake: Most voters chose Option C because they prioritized reusing the existing bucket to avoid data migration overhead, failing to realize that CRR requires a target bucket in another region and that SSE-S3 keys do not automatically replicate across regions without specific setup.

Expert Analysis

Why the Answer Is Correct

Option A is correct because it establishes a dedicated architecture that meets all requirements: S3 provides storage, Athena enables serverless SQL querying, and SSE-KMS with Multi-Region Keys ensures encryption keys are available in both regions for replication. While creating a new bucket involves some initial setup, it avoids the complexity of managing cross-region key permissions on an existing bucket that might have other dependencies. The prompt asks for the solution with the LEAST operational overhead overall, and Option A provides a clean, secure, and replicable path without legacy constraints.

Why the Other Options Are Wrong

Option B uses RDS, which is not serverless in the context of analyzing raw S3 data via SQL (Athena is the native serverless query service), and SSE-S3 does not support cross-region key replication natively. Option C suggests configuring CRR on the existing bucket; however, CRR requires a destination bucket in a different region, so you cannot simply 'configure CRR' on a single bucket without defining that target. Furthermore, SSE-S3 keys are region-specific and do not replicate, meaning encrypted objects would fail to replicate if the source encryption isn't compatible with the destination's access patterns. Option D also uses RDS, which is inappropriate for this use case.

Community Comment Notes

Many learners argue for Option C, believing that reusing the existing bucket reduces overhead. As LeonSauveterre noted, "A - A new bucket + KMS multi-Region keys = Too much operational oversight." However, this overlooks the fact that CRR requires a target bucket. Another commenter, FlyingHawk, correctly pointed out that "Amazon S3 managed keys is region specific, for CRR, we must use KMS mult-region keys," highlighting why Option C's encryption method is technically flawed for cross-region replication scenarios where the destination region needs to decrypt the data.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always verify if 'serverless SQL' implies Athena or Redshift Spectrum, not RDS. When 'Cross-Region Replication' is required with encryption, ensure the encryption keys can be accessed in the destination region; SSE-KMS Multi-Region Keys are the standard solution for this constraint.

Frequently Asked Questions

Why can't I just use SSE-S3 for CRR?

SSE-S3 keys are region-specific. If you replicate to another region, the destination region cannot decrypt the data unless the key is shared, which SSE-S3 does not support natively.

Is Athena considered serverless?

Yes, Amazon Athena is a fully serverless, interactive query service that lets you analyze data in S3 using standard SQL without managing infrastructure.

More SAA-C03 FAQ →

Community Votes

A
60%
C
40%

60% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 12 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 12

  1. dhewa 👍 7 Answered A
    A wins because it gives us encryption with AWS KMS multi-Region keys
  2. LeonSauveterre 👍 4 Answered C
    A - A new bucket + KMS multi-Region keys = Too much operational oversight. B - RDS is not a serverless solution C - By using the existing S3 bucket, you eliminate the need to create a new bucket and load data into it. D - Athena supports querying using SQL, so that rules out RDS.
  3. FlyingHawk 👍 3 Answered A
    Amazon S3 managed keys is region specific, for CRR, we must use KMS mult-region keys. https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
  4. JA2018 👍 2 Answered C
    I will chose Option C for the following reasons: #1: Least operational overhead: Choosing "SSE-S3" over "SSE-KMS" minimizes operational overhead as it automatically manages encryption keys within S3, eliminating the need for additional KMS key management. #2: Existing S3 bucket: Reusing the existing bucket avoids the extra step of creating a new one and migrating data. #3: Athena for querying: Athena is a serverless solution ideal for querying large datasets stored in S3, aligning with the requirement for a serverless architecture.
  5. JunsK1e 👍 2 Answered C
    C is correct because it needs to replicate to different AWS region
Show 7 more comments
  1. Anyio 👍 1 Answered C
    The correct answer is C. Explanation: Option A: Incorrect. Although using AWS KMS multi-Region keys (SSE-KMS) and Amazon Athena to query the data meet the security and SQL querying requirements, creating a new S3 bucket and handling data migration increases operational overhead unnecessarily if the data already exists. Option C: Correct. Configuring Cross-Region Replication (CRR) on the existing S3 bucket makes efficient use of existing infrastructure and leverages server-side encryption with Amazon S3 managed keys (SSE-S3) to ensure data encryption at rest with lower operational complexity and costs compared to using KMS keys. Using Amazon Athena allows querying the data directly in S3, offering serverless and flexible SQL querying capabilities with minimal setup and operational overhead.
  2. Ell89 👍 1 Answered A
    A is correct. everyone. voting for c i think isnt paying attention to the part where you need the data replicated to a different region. how are you meant to replicate it without a new bucket? everyone saying use the existing bucket.... urm what? how can you replicate into the same bucket thats in the same region and expect it to be in a different region? clearly A.
  3. tch 👍 1 Answered C
    we don't need to create a policy specifically for Amazon S3-managed keys (SSE-S3) to encrypt objects in your S3 bucket... should be more easy and LEAST operational overhead
  4. trinh_le 👍 1 Answered C
    It’s not require highly sensitive data or complexity gain permission. So it should use sse-s3 is suitable
  5. yangbo 👍 1 Answered C
    The default encryption for S3 is SSE-S3, and cross-region replication can be enabled normally.
  6. komorebi 👍 4 Answered A
    Answer is A
  7. Abdullah2004 👍 3 Answered A
    A is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide