A company requires all infrastructure to be deployed only within US Regions. The DevOps engineer must restrict which Regions can be used, immediately alert on any activity outside the policy, and have the controls automatically apply for any new non-US Region. Which combination of actions will satisfy these requirements? (Choose two.)

The SCP solution is correct because attaching a Service Control Policy (SCP) to the organization root with a deny statement for non-US regions effectively prevents resource deployment outside the US and automatically applies to new regions. The CloudTrail and CloudWatch Logs solution is correct because CloudTrail records all API activity across all regions, and a CloudWatch Logs metric filter can then detect and alert on any activity occurring in non-US regions, providing immediate notification of policy violations. The Lambda function deployed in every region is inefficient and reactive, not proactive prevention. Amazon Inspector focuses on security vulnerabilities, not region restriction enforcement. An SCP applied to users, groups, and roles is less effective than one applied to the organization root, as it doesn't cover new accounts or root user actions, and the question specifies applying to the organization.