AWS Organizations is correct because Service Control Policies are attached at the organization level and can be applied to the organization root, to organizational units, or to individual member accounts to enforce permission guardrails that cap the maximum actions any account or principal can perform.

Within AWS Organizations SCPs are managed centrally and are used to limit the maximum permissions available to identities and resources in member accounts. SCPs do not grant permissions by themselves and they only restrict what other policies can allow. You must enable all features for an organization to use SCPs across the entire organization.

Availability Zones are data center groupings inside a region and they do not provide any mechanism to attach or enforce Service Control Policies.

AWS Regions represent geographic areas where services run and they are not a scope for attaching SCPs.

AWS Global Infrastructure is a high level description of AWS locations and services worldwide and it is not an attachable entity for SCPs.

Full AWS Practitioner Certification Question