A multinational with 200 accounts generates CloudTrail, VPC flow, and GuardDuty findings across regions and needs a normalized queryable data lake with 7-year retention that analysts can join with Splunk without building ETL pipelines. Storage costs and schema management are concerns. Which log storage and integration design should the team implement to centralize security telemetry?

The correct design succeeds because Amazon Security Lake automatically aggregates CloudTrail, VPC flow logs and GuardDuty findings across accounts and Regions into centralized S3 storage, normalizes them to OCSF to remove custom parsing and schema overhead, enables durable low-cost seven-year retention via S3 Lifecycle policies, and offers native Splunk subscriber ingestion for federated queries without ETL while Athena supports SQL analysis. Building a central S3 data lake with Athena and HTTP Event Collector forwarding fails on normalization because retaining raw heterogeneous JSON preserves schema management burden and parser maintenance despite achieving centralization and search. Using Security Lake with OCSF and Splunk ingestion but one-year S3 expiration fails on lifecycle governance because optimizing cost by expiring early directly violates the required seven-year retention. Centralizing with Security Hub and native Splunk subscription fails on telemetry completeness because Security Hub aggregates normalized findings for prioritization, not full CloudTrail events and VPC flow logs needed for joinable forensics. For the exam distinguish Security Lake for normalized multi-source lakes, CloudTrail Lake for CloudTrail-centric audit now closed to new customers, and Security Hub for findings management, focusing on OCSF, retention years and no-ETL cues. Practically verify rollup Regions, subscriber permissions, S3 replication with Glacier transitions for seven years, and test Splunk federated join of a GuardDuty finding to its VPC flow tuple.