SAP-C02 Q273 · Multi-Account

Question

A company is using AWS Organizations to manage multiple accounts. Due to regulatory requirements, the company wants to restrict specific member accounts to certain AWS Regions, where they are permitted to deploy resources. The resources in the accounts must be tagged, enforced based on a group standard, and centrally managed with minimal configuration. What should a solutions architect do to meet these requirements?

Accepted Answer

**Option D** meets every requirement through a well-structured Organizations approach:

1. **Restrict specific member accounts to certain Regions**: An **SCP (Service Control Policy)** with `aws:RequestedRegion` condition key can deny all API calls outside permitted Regions. By attaching this SCP to a dedicated **OU (Organizational Unit)**, only the specific member accounts placed in that OU are affected — not all accounts.

2. **Resources must be tagged based on a group standard**: A **tag policy** attached to the OU enforces standardized tag keys and allowed values across all accounts in that OU. Tag policies are an Organizations policy type designed exactly for this purpose.

3. **Centrally managed with minimal configuration**: Both SCPs and tag policies are managed from the **managemen

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips