SAP-C03 practice question: Centralized security logging (organization trails, Security Lake, GuardDuty) (2 of 2)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A logistics firm runs about 80 AWS accounts. Its security operations center uses a third-party SIEM and needs three years of CloudTrail management events, VPC Flow Logs and Security Hub findings from every account.
The analysts need the records in one consistent schema that they can query with Amazon Athena, and the data team does not want to build or run extract, transform and load pipelines for each log type.
Which solution meets these requirements?
Choose one answer.
AA. Export the raw CloudTrail logs, VPC Flow Logs and Security Hub findings to one central bucket, and build AWS Glue jobs that convert each log type into a custom schema that the SIEM and Athena can read.
BB. Send every account's logs to its own CloudWatch Logs log groups, and have the analysts run Logs Insights queries across the accounts when they need data.
CC. Enable Amazon Security Lake for all accounts from a delegated administrator, add the CloudTrail, VPC Flow Logs and Security Hub sources with three-year retention, and create a SIEM subscriber.
DD. Run a self-managed Elasticsearch cluster on EC2 instances, have a script copy the findings into it every night, and point the SIEM at the cluster.
Show the answer and explanation
Answer: C
A. Wrong: The Glue jobs are the extract, transform and load pipelines the data team wants to avoid. Each log type would also use a custom schema rather than one shared format.
B. Wrong: Logs Insights queries the raw logs in each log group, so the schemas differ across sources and the SIEM cannot read the data as one dataset. Keeping three years of raw logs in log groups is also costly.
C. Right: Correct. Security Lake collects these sources, normalizes them to the Open Cybersecurity Schema Framework, and stores them in Amazon S3. The SIEM subscribes to the data, and no ETL pipelines are needed.
D. Wrong: The team would patch, scale and back up the cluster itself, and the nightly copy would leave a gap in the data. The design does not give one normalized schema.
Explanation
Security Lake collects CloudTrail, Flow Logs and Security Hub findings into one normalized, queryable store across accounts with no pipelines to build. Glue ETL, per-account log groups and a self-managed cluster each miss the single-schema or operations requirement.
Want more on Centralized security logging (organization trails, Security Lake, GuardDuty)? The 5 full-length practice sets have 7 more Centralized security logging (organization trails, Security Lake, GuardDuty) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →