Amazon Security Lake for Centralized Security Data

SAA-C03 By islever Editorial Last updated Oct 11, 2026

Short answer

C Configure a data lake in Amazon Security Lake to collect the security data.

Question

A company runs workloads in the AWS Cloud. The company wants to centrally collect security data to assess security across the entire company and to improve workload protection. Which solution will meet these requirements with the LEAST development effort?

Configure a data lake in AWS Lake Formation. Use AWS Glue crawlers to ingest the security data into the data lake.
Configure an AWS Lambda function to collect the security data in .csv format. Upload the data to an Amazon S3 bucket.
Configure a data lake in Amazon Security Lake to collect the security data. Upload the data to an Amazon S3 bucket. Correct Answer
Configure an AWS Database Migration Service (AWS DMS) replication instance to load the security data into an Amazon RDS cluster.

Key Takeaways

The question tests knowledge of AWS managed security services versus custom engineering solutions; the key trap is choosing complex data engineering tools (Glue, Lambda) when a dedicated, automated service exists.

Amazon Security Lake is the AWS service designed to automatically centralize security data from multiple sources into a purpose-built data lake in Amazon S3, requiring minimal development effort compared to custom ingestion pipelines.

Common mistake: Candidates often choose AWS Glue or Lambda because they are familiar with general data ingestion patterns, failing to recognize that Security Lake is specifically optimized for security telemetry with less configuration overhead.

Expert Analysis

Why the Answer Is Correct

Amazon Security Lake is a fully managed service that automatically collects, stores, and organizes security data from AWS environments, SaaS providers, and on-premises sources into a purpose-built data lake in your account. It requires significantly less development effort than building custom pipelines because it handles the ingestion, schema standardization (using OCSF), and storage management out-of-the-box. This directly meets the requirement for central collection and improved protection with the least effort.

Why the Other Options Are Wrong

Option A (AWS Lake Formation + Glue) involves significant manual configuration to set up crawlers, define schemas, and manage permissions, which contradicts the 'least development effort' constraint. Option B (Lambda + S3) requires writing code to parse, transform, and upload CSV data, which is high-effort and not scalable for diverse security logs. Option D (DMS + RDS) is designed for database migration, not for ingesting unstructured or semi-structured security log data, making it architecturally inappropriate.

Community Comment Notes

The community consensus strongly supports Option C, noting that Amazon Security Lake is purpose-built for this exact scenario. As one user noted, it "automatically centralizes security data from AWS environments" without the need for manual scripting. Another commenter highlighted that it provides a "streamlined solution with less manual configuration compared to using AWS Glue or Lambda," confirming that the managed nature of the service reduces development overhead.

Official Reference

https://aws.amazon.com/security-lake/

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked for the 'least development effort' or 'managed' solution for a specific workload type (like security logs), look for the dedicated AWS service rather than generic infrastructure components like EC2, Lambda, or Glue.

Frequently Asked Questions

Why is AWS Lake Formation not the best choice here?

Lake Formation is a governance tool. While it can host data, you still need to build the ingestion pipeline (e.g., with Glue), whereas Security Lake automates the collection of security-specific logs.

Does Security Lake replace CloudTrail?

No, it aggregates CloudTrail along with VPC Flow Logs, GuardDuty findings, and third-party data into a single location for easier analysis.

More SAA-C03 FAQ →

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

sandordini 👍 7 Answered C

A, B, D are senseless + Amazon Security Lake automatically centralizes security data from AWS environments, you can get a more complete understanding of your security data across your entire organization. You can also improve the protection.
Scheldon 👍 3 Answered C

Answer C https://aws.amazon.com/security-lake/ Amazon Security Lake automatically centralizes security data from AWS environments, SaaS providers, on premises, and cloud sources into a purpose-built data lake stored in your account.
LeonSauveterre 👍 1 Answered C

Let's just focus on Security Lake. 1. Purpose-built: Amazon Security Lake is specifically designed to collect and centralize security data with minimal configuration and development overhead. 2. It integrates easily with AWS security services, providing a streamlined solution with less manual configuration compared to using AWS Glue or Lambda. 3. This is also designed to scale automatically, making it the most efficient and effective solution for the needs mentioned in the question.
muhammadahmer36 👍 1 Answered C

C. Configure a data lake in Amazon Security Lake to collect the security data. Upload the data to an Amazon S3 bucket.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide