ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A service control policy (SCP) applied to the organization or account can use the global condition key aws:RequestedRegion to deny every EC2 and S3 API action when the request targets any Region other than eu-central-1. Because SCPs are evaluated before IAM permissions, they provide a mandatory guardrail that prevents resources from being created or data from being stored in disallowed Regions, fully enforcing German data-sovereignty rules.

Enabling S3 Cross-Region Replication deliberately copies data to another Region, violating the requirement. An AWS WAF geographic match rule only restricts where traffic originates; it does not stop administrators or services from provisioning resources or storing data in other Regions. Encrypting S3 objects with a customer-managed KMS key in eu-central-1 controls access to the data but does not prevent the physical storage of encrypted objects in other Regions, so it cannot on its own guarantee jurisdictional confinement.