SAP-C02 Question 270
Single answerA company stores critical business data in an Amazon S3 bucket in the us-east-1 region. To ensure high availability and disaster recovery, the company wants to set up an architecture that replicates data to another AWS region while maintaining a read-only replica. Compliance requirements also mandate encryption at rest using customer-managed AWS KMS keys. Which solution should the company implement?
- A
Enable S3 Cross-Region Replication (CRR) and configure the destination bucket with a read-only bucket policy.
- B
Use AWS DataSync to copy data periodically to an S3 bucket in another region and set the destination bucket to read-only.
- C
Enable S3 Cross-Region Replication (CRR) with encryption using customer-managed keys (SSE-KMS) and set the destination bucket as read-only.
- D
Configure Amazon S3 Lifecycle policies to transition data to another region and set the destination bucket to read-only.
Show answer and explanation
Correct answer: C
Explanation
S3 Cross-Region Replication (CRR) is the best solution for replicating data to another AWS region for disaster recovery purposes. It supports encryption at rest using customer-managed AWS KMS keys (SSE-KMS), which meets compliance requirements. Additionally, the destination bucket can be configured as read-only to align with the company's requirements. Other options, such as AWS DataSync or S3 Lifecycle policies, either lack continuous replication capabilities or are not designed for this use case.
- A. Incorrect.
This option partially meets the requirements but does not address encryption at rest using customer-managed AWS KMS keys.
- B. Incorrect.
AWS DataSync is not designed for continuous data replication and does not natively enforce read-only access on the destination bucket.
- C. Correct.
This is the correct solution as S3 Cross-Region Replication (CRR) supports customer-managed AWS KMS keys (SSE-KMS) for encryption and allows you to configure read-only access on the destination bucket.
- D. Incorrect.
Amazon S3 Lifecycle policies are used for transitioning or expiring objects, not for active replication across regions.