Create an Amazon Kinesis Data Firehose delivery stream with a Lambda transformation, set the destination to the current S3 bucket, and update Network Firewall to publish logs to the stream is the correct choice because it enables inline enrichment and delivers transformed records to the existing S3 bucket before objects are written to the data lake.

Kinesis Data Firehose supports invoking a Lambda function to transform records inline and then buffers and reliably delivers the results to S3 while handling scaling and retries. This design meets the requirement for near real time delivery under 90 seconds and keeps operational overhead low by using managed buffering and delivery, and by using a native Network Firewall destination.

Configure Amazon S3 Event Notifications to launch an AWS Glue job that processes new log objects and writes the enriched output back to the same bucket is incorrect because it transforms data after logs are already stored in S3 and Glue is oriented toward batch ETL rather than sub minute streaming transforms.

Create an S3 object-created trigger that invokes an AWS Lambda function to reformat the logs and save transformed copies to the existing bucket while preventing recursive writes is incorrect because it also processes post ingest and creates risks of recursive writes and additional operational complexity that the team is trying to avoid.

Ingest records into Amazon Kinesis Data Streams and attach a Lambda consumer to enrich them before writing to the S3 bucket is incorrect because Network Firewall does not publish natively to Kinesis Data Streams so this approach would require extra components and more maintenance.

Full AWS Practitioner Certification Question