The correct choices are Amazon Rekognition and AWS Lambda. Both services are scoped to a single AWS Region and you select the Region for resources and call Region specific endpoints to support data residency and isolation requirements.

AWS Lambda functions are created and executed in the Region you choose and their resources such as function code and environment data remain in that Region unless you move them intentionally. Amazon Rekognition processes images and video through Region endpoints and stores any service data in that Region so it aligns with regional compliance needs.

AWS WAF is not confined to a single Region when it is associated with Amazon CloudFront. In that scenario the web ACL is managed at the CloudFront distribution level and applies globally across edge locations rather than being Region limited.

AWS Identity and Access Management (AWS IAM) is a global service and its users roles and policies operate across all Regions in an account so it does not by itself provide Region isolation.

Amazon CloudFront is a global content delivery network that uses edge locations around the world to serve content and it is not tied to a single Region.

Full AWS Practitioner Certification Question