CLF-C02 Security and Compliance Practice Question
A multi-national company needs to ensure their AWS resources in Europe comply with GDPR by keeping all data within EU regions. Which approach ensures data remains in Europe?
⚠ Common exam trap
Many candidates confuse detective controls (like CloudTrail or Config) with preventive controls (like SCPs or IAM policies), or mistakenly believe AWS automatically enforces data residency without customer configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy resources only in EU AWS Regions and use SCPs to prevent deployment outside EU
Deploying resources only in EU AWS Regions (such as eu-west-1, eu-central-1) combined with Service Control Policies (SCPs) that explicitly deny actions outside those regions ensures data residency. SCPs are organization-level policies in AWS Organizations that can restrict member accounts from launching resources in non-EU regions, providing a preventive control to enforce GDPR data localization requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS automatically keeps EU customer data in EU regions without any configuration
Why it's wrong here
AWS does not infer geographic residency from a customer's address, nationality, or legal entity; it only keeps data in the Region where the customer explicitly deploys resources. If a customer creates a resource without specifying a Region, the default can be us-east-1 or another non-EU region, so data residency is never automatic. To satisfy GDPR, the customer must intentionally choose EU Regions and, ideally, lock that choice down with organizational policies.
- ✓
Deploy resources only in EU AWS Regions and use SCPs to prevent deployment outside EU
Why this is correct
Deploying workloads exclusively in EU Regions keeps data at rest and in transit within the EU, because AWS services do not automatically replicate data across Regions unless a feature like cross-Region replication is explicitly enabled. To enforce this at scale, you can attach service control policies (SCPs) to all accounts in an AWS Organization that use the aws:RequestedRegion condition key to deny any Create, Update, or Run action where the Region is outside an approved EU list. This combination of placement and preventive guardrails directly addresses GDPR data-residency requirements.
- ✗
Enable CloudTrail in all regions to monitor data movement
Why it's wrong here
CloudTrail is a detective control that records API activity, including data-plane and management-plane calls, across all regions. Enabling it widely gives you an audit log of actions like CreateBucket or CopyObject, but it does not block anyone from provisioning resources in non-EU regions. Monitoring data movement after the fact cannot prevent a GDPR data-residency violation; prevention requires an enforced policy, not just visibility.
- ✗
GDPR compliance requires using only AWS GovCloud Regions
Why it's wrong here
AWS GovCloud is architecturally isolated and built specifically for U.S. government and regulated workloads subject to requirements like FedRAMP, ITAR, and DoD SRG. GDPR compliance for EU customer data is served by standard commercial AWS Regions in Europe, such as eu-west-1 or eu-central-1, which provide EU data residency commitments, GDPR-compliant DPA, and EU-specific certifications. Using GovCloud would actually move data outside the EU and is not a valid path to GDPR residency.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.