A global retailer with 60 AWS accounts needs a single queryable inventory of CloudTrail, VPC flow, Route 53, and Security Hub findings for threat hunting, with automatic normalization and retention for analysts. Regional collectors currently create blind spots. Which solution should the security team deploy to aggregate security and monitoring events?
Select an answer to reveal the explanation.
Short Explanation
Scattered buckets make hunting feel like airport layovers. You’ll centralize faster with Security Lake since it normalizes everything to OCSF automatically.
Full Explanation
Amazon Security Lake uses Organizations to automatically collect CloudTrail, VPC flow, DNS, and Security Hub findings into a delegated administrator S3 data lake formatted in Open Cybersecurity Schema Framework for consistent Athena and SIEM queries with lifecycle retention, solving multi-account aggregation and normalization. CloudWatch Logs to Firehose to OpenSearch fails by concept because custom streaming requires manual parsing and scaling and lacks native OCSF normalization across log types. Systems Manager Explorer fails by concept because it aggregates operational health and patch data, not normalized security telemetry for hunting. Private CA hierarchies fail by concept because certificate issuance supports TLS authentication but does not collect or normalize logs. For the exam, choose Security Lake for organization-wide OCSF security lakes versus ad hoc pipelines, and in practice enable relevant Regions and set subscriber access before decommissioning legacy collectors.