A company is creating a new multi-account environment in AWS Organizations.

Vendor: Amazon Web Services
Product: SOA-C02
Update on: Jul 30, 2025
Questions: 556

Amazon Web Services SOA-C02 Question Answer

A company is creating a new multi-account environment in AWS Organizations. The company will use AWS Control Tower to deploy the environment. Users must be able to create resources in approved AWS Regions only. The company must configure and govern all accounts by using a standard baseline configuration Which combination of steps will meet these requirements in the MOST operationally efficient way? (Select TWO.)

Create a permission set and a custom permissions policy in AWS IAM Identity Center (AWS Single Sign-On) for each user to prevent each user from creating resources in unapproved Regions.

Deploy AWS Config rules in each AWS account to govern the account's security compliance and to delete any resources that are created in unapproved Regions.

Deploy AWS Lambda functions to configure security settings across all accounts in the organization and to delete any resources that are created in unapproved Regions.

Implement a service control policy (SCP) to deny any access to AWS based on the requested Region.

Modify the AWS Control Tower landing zone settings to govern the approved Regions.