DVA-C02 Deployment Practice Question
A company is using AWS CloudFormation to manage infrastructure. The developer wants to update a stack but needs to prevent specific resources from being replaced. What CloudFormation feature should the developer use?
⚠ Common exam trap
Many exam-takers confuse a deletion policy (which only protects against stack deletion) with a stack policy (which controls update-time replacement), leading candidates to incorrectly choose Option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a stack policy that denies updates to the specific resources.
A stack policy is a JSON-based policy that defines which resources in a CloudFormation stack can be updated, replaced, or deleted. By applying a stack policy that denies updates to specific resources, the developer can prevent those resources from being replaced during a stack update, even if the template change would normally trigger a replacement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a custom resource to manage the update logic.
Why it's wrong here
Custom resources allow you to write custom provisioning logic, often using AWS Lambda, to manage resources not natively supported by CloudFormation. While they can define how an update is handled within their custom logic (e.g., UpdateReplacePolicy), their primary function is to extend CloudFormation's capabilities, not to prevent CloudFormation from attempting an update on a resource altogether.
- ✓
Apply a stack policy that denies updates to the specific resources.
Why this is correct
A stack policy is a JSON document that defines permissions for update actions on resources within a CloudFormation stack. By applying a stack policy with an explicit "Deny" statement for the "Update" action on specific logical resource IDs or resource types, you can effectively prevent CloudFormation from performing any modifications to those protected resources, ensuring their immutability.
- ✗
Create a change set to review the changes before execution.
Why it's wrong here
A CloudFormation change set provides a crucial preview of the proposed modifications to a stack's resources before they are actually implemented. It allows administrators to review which resources will be added, modified, or deleted, helping to identify potential unintended consequences. However, a change set is merely a planning and review tool; it does not inherently block or prevent the execution of those changes once you choose to apply it.
- ✗
Use a deletion policy attribute on the resources to protect them.
Why it's wrong here
The "DeletionPolicy" attribute, applied to individual resources within a CloudFormation template, dictates how AWS handles that resource when its containing stack is deleted or the resource is removed from the template. Options like "Retain" or "Snapshot" are specifically designed to protect resources from accidental *deletion*. This policy attribute has no functionality or impact whatsoever on preventing *updates* to the resource while the stack remains active.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.