Determine appropriate data security controls

The correct answer is B. S3 Cross-Region Replication supports replication of SSE-KMS-encrypted objects when the replication configuration specifies the destination customer managed KMS key and the required KMS permissions are configured. To satisfy the requirement that all data at rest use customer managed keys, both the source and destination buckets must use SSE-KMS with customer managed KMS keys. A lifecycle rule in us-east-1 deletes the primary objects after one year without deleting the corresponding replicated versions in the destination bucket. S3 Glacier Flexible Retrieval supports Expedited retrievals typically within 1–5 minutes. Provisioned retrieval capacity is appropriate when predictable availability of Expedited retrieval capacity is required. Option A is incorrect because S3 Glacier Deep Archive cannot provide a five-minute retrieval path. Option C is incorrect because DataSync adds operational overhead and Glacier Instant Retrieval has higher storage cost than Glacier Flexible Retrieval; it also does not implement the required one-year source expiration. Option D is incorrect because Lambda is unnecessary for the one-year deletion when S3 Lifecycle can perform it natively, and the option does not specify the required customer managed KMS encryption or appropriate archive retrieval mechanism.