DEA-C01 Data Operations and Support Practice Question

A data engineer is tasked with designing a disaster recovery solution for a data lake stored in Amazon S3. The data lake contains sensitive customer data that must be replicated to a different AWS Region. The engineer needs to ensure that all objects, including those with encryption using SSE-KMS, are replicated. Which solution meets the requirements?

⚠ Common exam trap

DEA-C01 often tests the misconception that S3 Transfer Acceleration or Batch Operations can serve as replication solutions, when in fact CRR is the only automated, continuous replication feature.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable S3 Cross-Region Replication (CRR) with the appropriate KMS key and IAM role.

S3 Cross-Region Replication (CRR) with the appropriate KMS key and IAM role is the correct solution because it automatically replicates objects, including those encrypted with SSE-KMS, to a destination bucket in another region. To replicate SSE-KMS encrypted objects, you must specify a KMS key in the destination region and grant the necessary IAM permissions to the replication role. This meets the requirement for disaster recovery of sensitive data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use S3 Batch Operations to copy objects to the destination bucket.
Why it's wrong here
S3 Batch Operations performs one-off or scheduled batch copy jobs but does not provide continuous replication or handle SSE-KMS-encrypted objects with the required KMS key permissions across Regions. It suits remediating existing objects or applying tags at scale, not ongoing disaster recovery replication.
✓
Enable S3 Cross-Region Replication (CRR) with the appropriate KMS key and IAM role.
Why this is correct
CRR replicates objects across Regions, but SSE-KMS-encrypted objects require the destination bucket's KMS key permissions and an IAM role allowing decrypt and encrypt. Configuring both satisfies the requirement that all objects, including KMS-encrypted ones, replicate successfully.
✗
Use S3 Transfer Acceleration to copy objects across regions.
Why it's wrong here
Transfer Acceleration speeds up uploads and downloads over long distances using edge locations, but it does not replicate objects to another Region or manage SSE-KMS encryption. It suits accelerating transfers into a single bucket, not cross-Region disaster recovery of encrypted data.
✗
Use the AWS CLI s3 sync command scheduled in a cron job.
Why it's wrong here
The s3 sync command copies objects but does not preserve SSE-KMS encryption automatically, and it cannot replicate objects encrypted with a customer-managed KMS key across accounts without explicit key permissions. It suits ad-hoc or scheduled copies of unencrypted or SSE-S3 data, not compliant cross-Region disaster recovery.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Operations and Support Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question