An enterprise is designing a multi-account architecture. They need to ensure that developers in the 'Sandbox' accounts can experiment freely, but are strictly prohibited from provisioning resources in any region other than us-east-1 and eu-west-1. Furthermore, they must not be able to disable AWS CloudTrail. Which combination of actions will enforce these rules? (Select TWO)

Answer options:

Create an IAM boundary policy restricting regions and attach it to all developer roles.

Create a Service Control Policy (SCP) that denies all actions where the aws:RequestedRegion condition is not us-east-1 or eu-west-1.

Create an SCP that explicitly denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Use AWS Config rules to automatically terminate resources launched outside the allowed regions.

Configure AWS Control Tower to delete the Sandbox accounts if a violation occurs.

Modify the VPC route tables to block traffic to unauthorized regions.

How to approach this question

Use SCPs for proactive, account-wide restrictions (region locking and service protection).

Full Answer

Create an SCP that denies all actions with a condition string not equal to us-east-1 and eu-west-1. Create an SCP that explicitly denies cloudtrail:StopLogging.

Service Control Policies (SCPs) provide central control over the maximum available permissions. Using the aws:RequestedRegion condition key allows you to restrict resource creation to specific regions. Explicitly denying CloudTrail modification actions protects the audit logs.

Common mistakes

Choosing reactive Config rules instead of proactive SCPs.

Question 31 All questions Question 33

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 4

75 questions · hints · full answers · grading

More questions from this exam

Q01A global enterprise is redesigning its network architecture across 50 AWS accounts. They require ...Hard Q02A financial services company uses AWS Organizations to manage 100+ accounts. The security team ma...Medium Q03An e-commerce company requires a multi-region active-active architecture for its critical order p...Medium Q04A company is setting up a new AWS environment using AWS Control Tower. They need to ensure that a...Hard Q05An enterprise has 50 AWS accounts under AWS Organizations. They want to implement a chargeback mo...Medium

View all 75 questions →