A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to enforce a policy that prevents any employee from deploying resources in AWS Regions outside of the United States. The company’s legal department requires a preventive control that automatically blocks all resource creation in non-approved Regions for every account, including any new accounts added in the future. The team wants a solution that requires minimal ongoing administration. Which AWS feature should the security team use?

Create an IAM policy with a condition that denies `ec2:RunInstances` if the Region is not `us-east-1` or `us-west-2`, and attach it to all IAM users and roles.

This option is incorrect because IAM policies must be attached to individual users, groups, or roles in each account, which is not centralized across all accounts. Additionally, it only blocks EC2 instance launches, not other resource types. Service Control Policies are more comprehensive and centralized.

Configure an AWS Config rule that checks for resources in non-approved Regions and automatically terminates them using a custom Lambda function.

This is a detective and reactive control, not a preventive control. It does not block creation of resources; it responds after the resource is already created. It also requires setting up custom remediation and may not cover all resource types immediately.

Use VPC endpoint policies to restrict traffic to only the approved AWS Regions.

This is incorrect. VPC endpoints allow private connectivity to AWS services within a Region, but they do not control which Regions users can deploy resources into. They are not designed for cross-Region access control.

What does this CLF-C02 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Attach a Service Control Policy (SCP) in AWS Organizations that denies access to all AWS API actions when the `aws:RequestedRegion` condition key does not match an approved Region. — Service Control Policies (SCPs) in AWS Organizations allow central administration of permissions for all accounts in the organization. They act as a preventive control that can deny access to AWS APIs based on conditions such as the requested Region. By attaching an SCP with a Deny effect for `aws:RequestedRegion` not in the allowed list, the security team can enforce Region restrictions across all current and future accounts with minimal maintenance. IAM policies would need to be applied per account and user, which is not centralized. AWS Config rules with auto-remediation are detective and reactive, not preventive. VPC endpoint policies control traffic to specific services but do not restrict the Regions where resources can be created.

What should I do if I get this CLF-C02 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.