Exam AWS Certified Solutions Architect - Professional topic 1 question 127 discussion

Here is my understanding. The Zone here could be meant for an AZ or a VPC in that it is more about a concept. For instance, if the answer C replaces its condition with "Create four IAM users and four VPCs and each IAM user could only access its VPC" then it would be the right option accordingly.

So if "size" is a typo of "zone", then B is the answer.

D is right. "Launch instances into a specific subnet The following policy grants users permission to launch instances into a specific subnet, and to use a specific security group in the request. The policy does this by specifying the ARN for the subnet and the ARN for the security group. If users attempt to launch an instance into a different subnet or using a different security group, the request will fail (unless another policy or statement grants users permission to do so). The policy also grants permission to use the network interface resource. When launching into a subnet, the RunInstances request creates a primary network interface by default, so the user needs permission to create this resource when launching the instance." https://docs.aws.amazon.com/vpc/latest/userguide/vpc-policy-examples.html

I also think A is correct. In D, it can be a private or public subnet, and it does not make sense to control by subnet. At the account level, they have more power and control and the question says at an organization level. An organization can have multiple accounts and each person can manage/lead an account. I will go by A

its typo should be D with tags