Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 160 discussion

agree with Security Lake being ideal for purpose.

Amazon Security Lake is designed to automatically collect, normalize, and store security-related data across AWS accounts and on-premises systems. Security Lake can be set up in a delegated administrator account within AWS Organizations, allowing centralized management and configuration across all accounts in the organization. Amazon Athena can be used to query and analyze the log data stored in Security Lake, providing a powerful and flexible way to gain insights from the aggregated logs. Using Amazon Security Lake provides a streamlined and integrated approach to centralized log management across your entire AWS organization and on-premises systems, making it the most effective and efficient solution for your needs.

C should be the answer

answer: C

Considering the requirements to aggregate and normalize logs from the entire AWS organization, AWS Marketplace offerings, and on-premises systems into a centralized solution for analysis, Amazon Security Lake appears to provide a more comprehensive and automated approach compared to Options A/B

C Amazon Security Lake automatically centralizes security data from AWS environments, SaaS providers, on premises, and cloud sources into a purpose-built data lake stored in your account. With OCSF support, the service normalizes and combines security data from AWS and a broad range of enterprise security data sources. https://aws.amazon.com/security-lake/

Answer A: While S3 can store logs centrally, it lacks the log management and analysis features of CloudWatch Logs and OpenSearch Service. Additionally, using Glue crawlers and Athena would be a more complex approach for real-time analysis. Answer C: Security Lake is primarily focused on security data analysis, and it might be overkill for general log analysis from various sources. Answer D: SCP can enforce centralized log storage in S3, but it wouldn't offer the collection, filtering, and advanced analytics capabilities needed. Additionally, querying logs directly from S3 with OpenSearch Service would be inefficient. Therefore, Answer B offers a centralized, flexible, and scalable solution for collecting, filtering, and analyzing logs from the organization, on-premises systems, and AWS Marketplace offerings.