How to Use AWS CloudFormation Change Sets for Stack Update Approvals
A company uses AWS CloudFormation to define and manage its production infrastructure as code. The operations team wants to ensure that any proposed changes to the stack are reviewed and explicitly approved before being applied. Which AWS CloudFormation feature should the company use?
Quick Answer
The answer is AWS CloudFormation Change Sets. This feature is correct because it provides a detailed preview of how proposed stack updates will affect your existing resources before any changes are executed, allowing the operations team to review and explicitly approve modifications rather than applying them automatically. On the AWS Certified Cloud Practitioner CLF-C02 exam, this question tests your understanding of CloudFormation’s safe deployment mechanisms, often appearing alongside distractors like stack policies or drift detection. A common trap is confusing change sets with direct stack updates—remember that change sets are a dry run, not an execution. For the exam, think of change sets as a “preview and approve” gate: you see the diff, get approval, then apply. A helpful memory tip is “Change Sets = Check, then Set,” reinforcing that review must come before the actual stack update.
⚠ Common exam trap
It's easy for candidates to confuse Change Sets with Stack Policies, thinking that policies can enforce approval workflows, but Stack Policies only restrict updates to specific resources, not provide a review-and-approve mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudFormation Change Sets
AWS CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact your running resources before you apply them. This enables the operations team to review and explicitly approve changes, ensuring that modifications are not applied automatically without oversight.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudFormation StackSets
Why it's wrong here
Incorrect. StackSets enable you to deploy the same stack across multiple accounts and Regions, not to preview or approve changes before they are applied to a single stack.
- ✓
AWS CloudFormation Change Sets
Why this is correct
Correct. Change Sets allow you to examine how proposed changes to a stack will impact your running resources before you decide to apply them, providing a mechanism for review and approval.
- ✗
AWS CloudFormation Drift Detection
Why it's wrong here
Incorrect. Drift Detection identifies whether the actual state of resources has deviated from the expected stack template, but it does not provide a way to review or approve changes before they are applied.
When this WOULD be correct
A company wants to detect if manual changes were made to resources outside of CloudFormation, to ensure compliance with infrastructure-as-code. The correct feature would be AWS CloudFormation Drift Detection.
- ✗
AWS CloudFormation Stack Policies
Why it's wrong here
Incorrect. Stack Policies define update-protected resources within a stack to prevent accidental modifications, but they are not used to review or approve proposed changes.
When this WOULD be correct
A company wants to prevent accidental updates to critical resources in a production stack, such as a database, by setting explicit update permissions. Stack policies would be used to define which resources can be updated and which actions are allowed, ensuring only authorized changes occur.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS CloudFormation Change SetsCorrect answer▾
Why this is correct
Correct. Change Sets allow you to examine how proposed changes to a stack will impact your running resources before you decide to apply them, providing a mechanism for review and approval.
✗AWS CloudFormation Drift DetectionWrong answer — click to see why▾
Why this is wrong here
Drift detection identifies whether a stack's actual resources have deviated from the expected template configuration, but it does not provide a mechanism to review and approve changes before they are applied.
★ When this WOULD be the correct answer
A company wants to detect if manual changes were made to resources outside of CloudFormation, to ensure compliance with infrastructure-as-code. The correct feature would be AWS CloudFormation Drift Detection.
Why candidates choose this
Candidates may confuse 'detecting changes' with 'reviewing changes,' or think drift detection can prevent unauthorized changes by alerting, but it only detects after the fact.
✗AWS CloudFormation Stack PoliciesWrong answer — click to see why▾
Why this is wrong here
Stack policies protect stack resources from updates, but they do not provide a review and approval workflow for proposed changes. They prevent updates to specified resources, not enable explicit approval of changes.
★ When this WOULD be the correct answer
A company wants to prevent accidental updates to critical resources in a production stack, such as a database, by setting explicit update permissions. Stack policies would be used to define which resources can be updated and which actions are allowed, ensuring only authorized changes occur.
Why candidates choose this
Candidates may confuse stack policies with change sets because both involve controlling updates. They might think a policy that requires approval is similar to a change set, but stack policies are declarative rules, not a review workflow.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which AWS service helps you manage and deploy infrastructure as code using templates?
easy- A.AWS Elastic Beanstalk
- ✓ B.AWS CloudFormation
- C.AWS OpsWorks
- D.AWS CodeDeploy
Why B: AWS CloudFormation is the correct service because it allows you to model and provision AWS resources using declarative templates (JSON or YAML). This enables Infrastructure as Code (IaC) by treating infrastructure as version-controlled, repeatable code, which can be used to create, update, and delete entire stacks of resources in a predictable manner.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.