A travel company sends CloudFront, WAF, and third-party firewall logs to its data lake, needs normalized OCSF security telemetry for SIEM queries, and must keep edge dashboards current. Which edge-to-lake integration should the engineer configure to normalize OCSF telemetry?

The correct design is right because Amazon Security Lake provides managed collection with automatic OCSF normalization for natively supported sources such as WAF and Route 53, delivering normalized Parquet to S3 for SIEM subscribers, while its custom source framework ingests third-party firewall events as OCSF so all security telemetry shares one queryable schema, leaving real-time edge dashboards on the direct CloudFront path. The WAF-and-Route-53-only design with automatic normalization fails completeness by concept because it omits the third-party firewall from the OCSF corpus, so SIEM correlation remains blind to that signal despite correct native handling. The Kinesis-with-Lambda-conversion design fails managed-service fit by concept because it hand-builds normalization, partitioning and subscriber access that Security Lake automates, adding operational burden and SIEM compatibility risk even though streaming helps freshness. The unified lake-for-both-SIEM-and-current-dashboards design fails latency fit by concept because Security Lake delivery is optimized for analytics on a minutes-to-hours cadence, not live edge operations, so dashboards would go stale despite full OCSF coverage. For exams, remember native Security Lake source coverage is selective and not every edge log is natively normalized, so check custom-source requirements carefully. In practice, verify the subscriber role, validate OCSF mappings and Parquet output in S3, and retain direct CloudFront logging for operational dashboards while SIEM consumes the lake.