SCS-C02 Management and Security Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Apply a service control policy (SCP) that denies operations in unauthorized regions.

  Why this is correct

  A service control policy (SCP) attached at the organization root or an organizational unit acts as an upper boundary on all IAM principals in every member account, including the account root user. Because member account administrators cannot modify or remove an SCP, adding a Deny statement with a condition such as aws:RequestedRegion not in an allowed list prevents any operation in unauthorized Regions before the API call executes. This is the recommended preventive, centralized control for enforcing regional boundaries across AWS Organizations.

• ✗

  Use VPC endpoints to restrict API calls to specific regions.

  Why it's wrong here

  VPC endpoints are Regional network constructs that let a VPC privately connect to a specific AWS service in one Region, but they do not block a caller from targeting a different Regional endpoint using normal AWS SDK, CLI, or console traffic. An endpoint policy only affects requests that traverse that endpoint and cannot stop requests that use the public endpoint or that are made from outside the VPC. Thus VPC endpoints are insufficient as a standalone Amazon-wide restriction because they address the network path, not the authorization scope of the API call.

• ✗

  Configure AWS Config rules to detect and delete resources in unauthorized regions.

  Why it's wrong here

  AWS Config rules are detective, not preventive: they evaluate the configuration of resources after the resource exists or after an API call has been recorded. Even with automatic remediation, such as SSM automation to delete noncompliant resources, there is a delay during which the unauthorized resource can exist, and Config never blocks the original Create or RunInstances call. Therefore, Config rules cannot enforce a hard prohibition on operating in unauthorized Regions.

• ✗

  Attach an IAM policy to each user that denies operations in unauthorized regions.

  Why it's wrong here

  Attaching a deny policy to each IAM user provides no organization-wide guarantee because it does not apply to service roles, cross-account roles, or the member account root user, and it can be modified or removed by an administrator who has IAM permissions in that account. In AWS Organizations, only an SCP is protected from being overridden by the member account's own administrators; IAM policies are ultimately under the control of the account administrator. This makes the IAM-only approach an incomplete and unenforceable preventive control.

Go deeper

Related to this question