An organization uses AWS Organizations with two OUs under the root: Research and DataOps. Regulatory rules require that all resources in the organization be created only in the ap-northeast-1 Region. Additionally, EC2 instances launched in accounts under the DataOps OU must be limited to a predefined set of instance types. The solution must be efficient to operate and require minimal ongoing maintenance. Which combination of actions will enforce these constraints? (Choose two.)

The first correct answer enforces the region restriction efficiently. Attaching an SCP to the root OU ensures that all accounts within the organization are subject to the aws:RequestedRegion condition, blocking actions outside ap-northeast-1. This is a central and low-maintenance approach. The second correct answer uses an SCP attached to the DataOps OU to restrict EC2 instance types. SCPs are ideal for enforcing preventive controls across multiple accounts with minimal operational overhead. Incorrect options: Using IAM roles or users with inline policies in individual accounts is not efficient or scalable for an organization-wide or OU-wide restriction, requiring management in every account. The ec2:Region condition key is less comprehensive than aws:RequestedRegion for general region restrictions as it only applies to EC2 actions. Attaching the region SCP to all OUs individually is redundant when it can be applied once at the root.