SAP-C02 Q270 · Multi-Account

Question

A company is expanding. The company plans to separate its resources into hundreds of different AWS accounts in multiple AWS Regions. A solutions architect must recommend a solution that denies access to any operations outside of specifically designated Regions. Which solution will meet these requirements?

Accepted Answer

**Requirement 1: Hundreds of accounts across multiple Regions** → AWS Control Tower provides a pre-configured landing zone that automates multi-account setup at scale using AWS Organizations underneath. It handles account provisioning via Account Factory, making it ideal for hundreds of accounts.

**Requirement 2: Deny access to operations outside designated Regions** → Service Control Policies (SCPs) are the correct mechanism for this. SCPs act as **guardrails** that set permission boundaries across an entire Organization or Organizational Unit (OU). An SCP with a `Deny` effect using the `aws:RequestedRegion` condition key can block ALL API calls to non-approved Regions, regardless of what IAM policies individual users or roles have.

**Requirement 3: Scalable and centralized management**

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips