A company uses AWS Organizations. The CISO requires that no EC2 instances can be launched outside of the us-east-1 and eu-west-1 regions across all 50 member accounts. How can this be enforced centrally?

Answer options:

Create an IAM policy in each account denying access to other regions.

Create a Service Control Policy (SCP) with a Deny rule for ec2:RunInstances using a StringNotEquals condition for the allowed regions, and attach it to the root.

Use AWS Config rules to terminate instances launched in unauthorized regions.

Configure AWS CloudTrail to alert when instances are launched in wrong regions.

How to approach this question

Look for centralized, preventive governance mechanisms.

Full Answer

B.Create a Service Control Policy (SCP) with a Deny rule for ec2:RunInstances using a StringNotEquals condition for the allowed regions, and attach it to the root.✓ Correct

SCPs are the standard method for enforcing region restrictions centrally in AWS Organizations.

Common mistakes

Confusing IAM policies with SCPs for multi-account governance.

Question 01 All questions Question 03

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 3

75 questions · hints · full answers · grading

More questions from this exam

Q01An enterprise has 100 VPCs across 5 AWS Regions. They need to establish a highly available, trans...Hard Q03An application uses Amazon Aurora PostgreSQL. To meet disaster recovery requirements, the databas...Hard Q04A company is setting up a new multi-account AWS environment. They want to automate the creation o...Medium Q05An organization wants to allocate AWS costs to specific departments. They use multiple AWS accoun...Medium Q06A company is designing a CI/CD pipeline for a microservices architecture deployed on Amazon EKS. ...Medium

View all 75 questions →