CLF-C02 Security and Compliance Practice Question
A company uses AWS Organizations with multiple accounts. The security team wants to prevent accounts in the 'Development' OU from launching any resources in regions outside of us-east-1 and eu-west-1. Which AWS Organizations feature allows this restriction?
⚠ Common exam trap
Test-takers frequently confuse SCPs with IAM policies, thinking that IAM permission boundaries or resource-based policies can enforce cross-account region restrictions, but SCPs are the only mechanism that operates at the organization level to centrally limit permissions for all accounts in an OU.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service Control Policies (SCPs)
Service Control Policies (SCPs) are the correct AWS Organizations feature because they allow you to centrally control the maximum available permissions for all accounts within an OU. By attaching an SCP that denies all actions in regions other than us-east-1 and eu-west-1, the security team can enforce this restriction across all 'Development' accounts, even if IAM policies within those accounts allow broader access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM permission boundaries
Why it's wrong here
IAM permission boundaries are attached to individual IAM users or roles and define the maximum permissions that entity can receive, but they operate only within the boundary of a single account. They do not apply to other accounts in an AWS Organization, nor do they affect the effective permissions of other principals such as the root user or service-linked roles. As a result, they cannot serve as an organization-wide region restriction across a Development OU.
- ✗
Resource-based policies attached to each S3 bucket
Why it's wrong here
Resource-based policies such as S3 bucket policies are attached to individual resources and only govern access to that specific resource within a single account. They have no authority over resource creation or API actions in other services like EC2 or RDS, and they cannot be applied at an organizational unit (OU) level. Because they lack the cross-account, cross-service scope needed to restrict regions, they are not the correct mechanism for enforcing regional guardrails across an entire OU.
- ✓
Service Control Policies (SCPs)
Why this is correct
SCPs are applied at the OU or account level in AWS Organizations and act as guardrails on all accounts within the OU. An SCP denying all regions except us-east-1 and eu-west-1 would apply to every account in the Development OU, regardless of their individual IAM policies.
- ✗
AWS Config rules across all accounts
Why it's wrong here
AWS Config rules are detective controls that evaluate resource configurations after they have already been created, flagging noncompliant resources and optionally triggering remediation actions via Systems Manager Automation. They cannot preventively deny the RunInstances or CreateDBInstance API calls that would launch resources in a restricted region, which is what an SCP does at the API level. Additionally, Config rules are scoped to individual accounts and regions, requiring aggregation to even see compliance across an OU, but they still lack the necessary enforcement to block creation.
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.