SCS-C02 Infrastructure Security Practice Question
A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no resources can be created in a specific AWS Region except for the us-east-1 Region. Which policy type should the security team use?
⚠ Common exam trap
It's easy for candidates to confuse SCPs with IAM policies, thinking that a simple IAM policy denying region access can achieve the same result, but SCPs are the only mechanism that can enforce restrictions across all users and roles in multiple accounts within an organization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service control policy (SCP)
Service control policies (SCPs) are the correct choice because they allow you to centrally control the maximum available permissions for all accounts in an AWS Organization. By applying an SCP that denies all actions in a specific region (except us-east-1), the security team can enforce a region restriction across all member accounts, regardless of any IAM policies attached to users or roles. SCPs do not grant permissions themselves but act as a guardrail that limits what IAM policies can allow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM permissions boundary
Why it's wrong here
IAM permissions boundaries are managed policies attached to an IAM user or role to cap the maximum permissions that entity can receive, but they operate only on the identity's allowed API actions. They do not affect account-level settings such as which Regions are enabled, whether a Region can be used, or how other principals in the account behave. Because a permissions boundary applies to a single IAM entity and not to the AWS account as a whole, it cannot restrict Region availability across all accounts in an organization.
- ✗
IAM policy applied to the root user
Why it's wrong here
An IAM policy attached to a principal like the root user governs which actions that principal may invoke; it does not control feature flags or Region enablement at the account level. The root user is also inherently unrestricted by IAM policies in the standard model, and Region restrictions are not a permission boundary that IAM policies can enforce. Thus, even a very strict IAM policy on the root user cannot deny the creation of resources in a specific Region for all users or services in the account.
- ✗
Resource-based policy
Why it's wrong here
Resource-based policies are attached directly to individual resources such as S3 buckets, SQS queues, or KMS keys, and define who can access that resource and what actions they can perform. They are evaluated on a per-resource basis and do not govern the account-wide ability to create new resources or the availability of AWS Regions. Attaching a resource-based policy could only control access to one specific resource, so it cannot serve as an organization-wide Region restriction mechanism.
- ✓
Service control policy (SCP)
Why this is correct
Service control policies are the correct account-level control because they establish permission guardrails that apply to every IAM principal and the root user in all linked accounts within an AWS Organization. An SCP can deny actions using a condition such as aws:RequestedRegion, effectively preventing users from making API calls in designated Regions across the entire organization. SCPs do not grant permissions themselves; they just set the maximum allowed access, and they do not affect the management account, which is an important nuance when designing Region restrictions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.