Global datastore really fits for this, so B is the one. You get cross-region replication with encryption handled by AWS, and failover is mostly just a promotion step. Compared to D, you don't have to mess with snapshots or worry about security gaps. Pretty sure this matches what's asked but open to other takes.
Tricky part here is the encryption for cross-Region transfers, which rules out D since snapshot copies aren't encrypted in-transit by default. So B is the only one that actually meets all requirements without manual setup or extra tooling. If encryption wasn't called out, maybe D could work, but not for this specific scenario I think. Disagree?