A property insurer runs workloads in four AWS Regions across 60 accounts. Its security analysts want to query VPC flow logs, CloudTrail management events, Amazon Route 53 Resolver query logs and Security Hub findings from one place, without building data pipelines.
The security tooling account must administer the service for the whole organization, and new accounts must be included automatically. The team also wants the data from the four Regions consolidated into one rollup Region, to keep queries simple.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Enable Amazon Security Lake in each member account separately, with each owner choosing its own sources and its own Regional S3 bucket. Analysts then query each bucket in turn.
BB. Create S3 buckets in each Region, deliver every log type to them with custom Lambda functions, and catalog the data with AWS Glue crawlers for Amazon Athena.
CC. Make the security tooling account the Security Lake delegated administrator. Set one rollup Region for the four Regions, and select the four log and finding sources.
DD. Turn on Security Lake only in the Region where most workloads run, and leave out the other three Regions because their traffic is smaller.
Show the answer and explanation
Answer: C
A. Wrong: Each account keeps its own data, so analysts must query many buckets and no single administrator sees the whole organization. New accounts also need manual setup, which breaks the automatic inclusion requirement.
B. Wrong: This can work, but writing and maintaining the delivery functions and crawlers is the overhead the team wants to avoid. It also does not give the normalized OCSF schema that Security Lake provides for these sources.
C. Right: Correct. The delegated administrator enrolls member accounts automatically, and the rollup Region keeps the data in one place for analysts. Security Lake normalizes the sources to the OCSF schema, so the managed setup needs no pipeline code. Learn more: What is Amazon Security Lake? (opens in a new tab)
D. Wrong: Leaving out three Regions means their logs are never collected, so the coverage requirement fails. Attacks in smaller Regions would also be invisible to the analysts.
Explanation
Security Lake works best with a delegated administrator, which enrolls accounts and Regions in one setup, and with a rollup Region for consolidated queries. The managed service normalizes the sources, so no custom pipeline is needed. Per-account setup, custom pipelines and partial Region coverage each fail a stated requirement.
Want more on Security data lakes and third-party tools (Security Lake, OCSF)? The 5 full-length practice sets have 8 more Security data lakes and third-party tools (Security Lake, OCSF) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →