Courseiva
← CLF-C02
Full test
Question 451 of 1,024
Security and Compliance →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is to attach a Service Control Policy (SCP) in AWS Organizations that denies access to all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region. This is correct because an SCP acts as a preventive guardrail at the account level, not the user level, meaning it automatically blocks resource creation in non-approved regions for every account in the organization, including any new accounts added later. On the AWS Certified Cloud Practitioner CLF-C02 exam, this scenario tests your understanding of how SCPs provide centralized, minimal-administration governance across an entire AWS Organization, often contrasting with IAM policies that require per-user or per-role configuration. A common trap is confusing SCPs with IAM permission boundaries or resource-based policies, but remember that SCPs are the only tool that can enforce region restrictions organization-wide without touching individual accounts. Memory tip: think “SCP = Stop Creation in Prohibited regions” — it’s the organization’s bouncer, not the user’s ID card.

CLF-C02 Security and Compliance Practice Question

This CLF-C02 practice question tests your understanding of security and compliance. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: sCPs set maximum permissions for all IAM entities in member accounts.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to enforce a policy that prevents any employee from deploying resources in AWS Regions outside of the United States. The company’s legal department requires a preventive control that automatically blocks all resource creation in non-approved Regions for every account, including any new accounts added in the future. The team wants a solution that requires minimal ongoing administration. Which AWS feature should the security team use?

Question 1mediummultiple choice
Full question →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Attach a Service Control Policy (SCP) in AWS Organizations that denies access to all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region.

Option C is correct because a Service Control Policy (SCP) attached to the root or an OU in AWS Organizations can deny all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region (e.g., `us-east-1` or `us-west-2`). This provides a preventive, account-wide guard that automatically applies to all existing and future accounts in the organization, requiring no per-user or per-role configuration and minimal ongoing administration.

Key principle: SCPs set maximum permissions for all IAM entities in member accounts.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Create an IAM policy with a condition that denies `ec2:RunInstances` if the Region is not `us-east-1` or `us-west-2`, and attach it to all IAM users and roles.

    Why it's wrong here

    This option is incorrect because IAM policies must be attached to individual users, groups, or roles in each account, which is not centralized across all accounts. Additionally, it only blocks EC2 instance launches, not other resource types. Service Control Policies are more comprehensive and centralized.

  • ✗

    Configure an AWS Config rule that checks for resources in non-approved Regions and automatically terminates them using a custom Lambda function.

    Why it's wrong here

    This is a detective and reactive control, not a preventive control. It does not block creation of resources; it responds after the resource is already created. It also requires setting up custom remediation and may not cover all resource types immediately.

  • ✓

    Attach a Service Control Policy (SCP) in AWS Organizations that denies access to all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region.

    Why this is correct

    This is correct. An SCP is a centralized, preventive control that applies to all principals (users, roles) in member accounts. The condition `aws:RequestedRegion` is supported by most AWS services, allowing the policy to block resource creation in any non-approved Region. It automatically applies to new accounts added to the organization.

    Related concept

    SCPs set maximum permissions for all IAM entities in member accounts.

  • ✗

    Use VPC endpoint policies to restrict traffic to only the approved AWS Regions.

    Why it's wrong here

    This is incorrect. VPC endpoints allow private connectivity to AWS services within a Region, but they do not control which Regions users can deploy resources into. They are not designed for cross-Region access control.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates confuse detective controls (AWS Config) with preventive controls (SCPs) or mistakenly think IAM policies can enforce organization-wide restrictions, but SCPs are the only mechanism that applies to all accounts and principals in AWS Organizations without ongoing maintenance.

Detailed technical explanation

How to think about this question

SCPs use the `aws:RequestedRegion` condition key to evaluate the Region in the API request endpoint (e.g., `ec2.us-west-2.amazonaws.com`), not the resource's physical location; this means services like IAM or Route 53 that are global (endpoint in `us-east-1`) are unaffected. The SCP effect is `Deny` with a condition like `StringNotEquals` on the approved Regions list, ensuring that any API call to a non-approved Region is blocked at the AWS Organizations level before the request reaches the target service. This approach is preferred for multi-account governance because it cannot be overridden by account administrators and applies to all principals, including the root user.

KKey Concepts to Remember

  • SCPs set maximum permissions for all IAM entities in member accounts.
  • SCPs are preventive controls, blocking actions before they occur.
  • SCPs apply to new accounts automatically when attached to the root or an OU.
  • The `aws:RequestedRegion` condition key is used to restrict actions by AWS Region.

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

SCPs set maximum permissions for all IAM entities in member accounts.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Review sCPs set maximum permissions for all IAM entities in member accounts., then practise related CLF-C02 questions on the same topic to reinforce the concept.

Related practice questions

Related CLF-C02 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Cloud Concepts practice questions

Practise CLF-C02 questions linked to Cloud Concepts.

Security and Compliance practice questions

Practise CLF-C02 questions linked to Security and Compliance.

Cloud Technology and Services practice questions

Practise CLF-C02 questions linked to Cloud Technology and Services.

Billing, Pricing, and Support practice questions

Practise CLF-C02 questions linked to Billing, Pricing, and Support.

AWS shared responsibility model practice questions

Practise CLF-C02 questions linked to AWS shared responsibility model.

AWS IAM practice questions

Practise CLF-C02 questions linked to AWS IAM.

AWS pricing practice questions

Practise CLF-C02 questions linked to AWS pricing.

AWS support plans practice questions

Practise CLF-C02 questions linked to AWS support plans.

AWS S3 practice questions

Practise CLF-C02 questions linked to AWS S3.

AWS EC2 practice questions

Practise CLF-C02 questions linked to AWS EC2.

Practice this exam

Start a free CLF-C02 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions20 questions30 questions50 questionsTimed 30
CLF-C02 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this CLF-C02 question test?

Security and Compliance — This question tests Security and Compliance — SCPs set maximum permissions for all IAM entities in member accounts..

What is the correct answer to this question?

The correct answer is: Attach a Service Control Policy (SCP) in AWS Organizations that denies access to all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region. — Option C is correct because a Service Control Policy (SCP) attached to the root or an OU in AWS Organizations can deny all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region (e.g., `us-east-1` or `us-west-2`). This provides a preventive, account-wide guard that automatically applies to all existing and future accounts in the organization, requiring no per-user or per-role configuration and minimal ongoing administration.

What should I do if I get this CLF-C02 question wrong?

Review sCPs set maximum permissions for all IAM entities in member accounts., then practise related CLF-C02 questions on the same topic to reinforce the concept.

What is the key concept behind this question?

SCPs set maximum permissions for all IAM entities in member accounts.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

More CLF-C02 practice questions

Browse all CLF-C02 questions →

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Sign in to join the discussion.

This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.