A healthcare SaaS must keep German patient records in eu-central-1 only, while serving global users from nearby Regions without replicating PHI. Legal requires blocking cross-border transfers of stored data. Which data residency control using Region-specific deployments and transfer restrictions satisfies German storage isolation?
Select an answer to reveal the explanation.
Short Explanation
You're building a fence that keeps data home. Pinning storage to one Region plus deny guardrails stops silent copies, and isolation beats convenience when law demands residency.
Full Explanation
The correct design keeps all PHI at rest only in eu-central-1 while permitting application components in nearby Regions, using Organizations SCPs denying S3 and RDS creation elsewhere as preventive enforcement and explicitly blocking replication features that would create a cross-border transfer of stored data. A centralized-storage design relying only on IAM policies without SCPs fails on control effectiveness because account-level policies cannot prevent provisioning in other accounts or Regions and allow drift, missing the required transfer restriction. A design allowing encrypted cross-Region RDS read replicas for latency fails on residency because encryption preserves confidentiality but does not preserve location, and any replica still moves PHI outside eu-central-1 in violation of the no-replication mandate. A design pinning both application and PHI storage exclusively to eu-central-1 fails on scope because while isolation is achieved it ignores the requirement to serve global users from nearby Regions, imposing avoidable latency. Exam caveat is that durability and performance mechanisms inside eu-central-1 remain allowed, while any cross-border copy even encrypted or for backup counts as a prohibited transfer. Practical check is to inspect SCPs, S3 replication rules, RDS replica and snapshot destinations, plus CloudTrail for storage creation outside eu-central-1.