A company must migrate its on-premises data center to AWS but, due to compliance, can use only the ap-northeast-3 Region. Company administrators are not allowed to connect VPCs to the internet. Which solutions satisfy these requirements? (Choose two.)

AWS Control Tower and AWS Organizations with Service Control Policies (SCPs) are effective solutions. Control Tower provides a prescriptive way to set up a secure, multi-account AWS environment, including data residency guardrails that can restrict internet access and enforce specific regions. SCPs, managed through AWS Organizations, allow you to centrally manage permissions for all accounts in your organization, explicitly denying actions that would grant internet access or create resources outside the specified region. The other options are less comprehensive or effective. AWS WAF is for web application protection, not general VPC internet access control. Denying regions in account settings is not a standard AWS feature. Network ACLs are VPC-specific and don't prevent internet access across all VPCs or enforce region restrictions at an organizational level. IAM policies are user-specific and can be bypassed by other users or roles, and AWS Config detects and alerts but doesn't prevent non-compliant actions.