A company needs a solution to give customers the ability to upload encrypted files to...

The correct answers are A, C, and E because the company needs a fully managed solution for SFTP uploads to Amazon S3 , followed by automatic decryption and movement of files to another directory with minimal operational overhead . AWS Transfer Family is the best fit because it provides a managed SFTP endpoint directly integrated with Amazon S3. Configuring the S3 bucket as the home directory enables customers to upload files without the company needing to manage its own file transfer servers.

The requirement to avoid separate authentication services and minimize operational work is well served by native AWS Transfer Family workflows . A workflow can automatically run post-upload steps on files as they arrive. The DECRYPT action is specifically designed to decrypt uploaded encrypted files as part of the managed workflow. After decryption, the COPY action can place the processed file into the second directory in the same S3 bucket for downstream processing.

Option B is less appropriate because using S3 events and Lambda adds custom orchestration where a native Transfer Family workflow already handles the need more simply. Option D is incorrect because polling with an external script introduces unnecessary infrastructure and operational overhead. Option F is also incorrect because AWS Batch polling and custom decryption logic is far more complex than a managed file-transfer workflow.

AWS best practices favor managed services and native workflow features to reduce custom code and infrastructure management. Therefore, the best solution is to use AWS Transfer Family for SFTP uploads , along with Transfer Family workflow DECRYPT and COPY actions to automate the full post-upload process.