AWS Certified Data Engineer Associate DEA-C01 Practice Question

An AWS Organizations service control policy (SCP) is evaluated before IAM policies in every member account, so an explicit Deny cannot be overridden. A Deny statement that fires when aws:RequestedRegion is not "us-east-2" blocks any API call aimed at another Region. Adding conditions such as s3:LocationConstraint and denying critical calls like s3:PutBucketReplication, s3:CreateBucket, and backup:StartCopyJob ensures engineers cannot create resources or start copy jobs that would place data outside the permitted Region. Because the SCP is attached to the organizational unit, it automatically applies to new accounts, buckets, and backup plans with no further action.

The Same-Region Replication answer relies on every bucket and backup plan being configured correctly and could be changed by developers. Restricting VPC interface endpoints only limits private network access; S3 replication and AWS Backup can use public endpoints that would still succeed. A Region-specific KMS key controls access to existing backups but does not stop a copy job from storing data in a vault in another Region, even if that data is encrypted.