DOP-C02 Security Group Name Resolution Practice Question
A company uses AWS CloudFormation to deploy infrastructure. The stack creation fails with the error: 'Resource handler returned message: 'The security group does not exist in VPC'.' The template references a security group by name. What is the MOST likely cause?
⚠ Common exam trap
Candidates often overlook that security group name resolution is case-sensitive and exact. While region scoping can cause a similar error, the most frequent cause is a typo or case mismatch in the security group name referenced in the template.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group name is misspelled or uses incorrect case
The error 'Resource handler returned message: The security group does not exist in VPC' occurs when CloudFormation cannot find a security group with the specified name in the target VPC. The most likely cause is a misspelling or case sensitivity issue (Option A), as CloudFormation matches security group names exactly. While region scoping (Option C) can also cause a similar error, the combination of a name-based reference and the specific error wording points to a name mismatch as the most common issue. IAM permission errors (Option B) would typically return an authorization error, not a 'does not exist' error. Option D is incorrect because a default VPC security group exists and would not cause this error unless it is missing, which is unlikely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The security group name is misspelled or uses incorrect case
Why this is correct
Security group names in EC2 are case-sensitive, and CloudFormation's lookup by name uses an exact, literal string match against the security groups within the specified VPC. If you reference a group by name and the template contains a typo, wrong case, or an unintended trailing space, the API returns no matching group, which CloudFormation reports as a 'security group not found' error. This is the most frequent root cause in practice because names like 'web-SG' and 'web-sg' are considered distinct, and the error message often appears immediately after a small edit or a manual copy-paste from a different source.
- ✗
The IAM role used for CloudFormation does not have permissions to describe security groups
Why it's wrong here
An IAM permissions failure would surface as an AccessDenied or UnauthorizedOperation error when CloudFormation calls the EC2 DescribeSecurityGroups API, not as a resource resolution error. CloudFormation's reference validation performs the describe call and then compares the returned groups against the supplied name or ID; if the role lacks ec2:DescribeSecurityGroups, the call itself fails before any comparison can occur. The error message 'Security group does not exist' specifically indicates that the API call succeeded and returned zero matches, which points to a nonexistent or mismatched identifier, not a permissions problem.
- ✗
The stack is being created in a Region where the security group does not exist
Why it's wrong here
Incorrect as the most likely cause. While a security group may exist in another region, the error specifically indicates the group does not exist in the VPC. Region mismatch is possible but less common than a name typo. The question asks for the most likely cause, making name mismatch the better answer.
- ✗
The template uses a parameter that resolves to the default VPC security group
Why it's wrong here
The default VPC always contains a default security group, so a parameter resolving to that group's name or ID would satisfy CloudFormation's reference validation. CloudFormation checks that the resolved value matches a security group that exists within the target VPC; because the default security group is guaranteed to exist, the stack operation would succeed at the validation stage. Additionally, the default security group has a well-known name ('default') and an ID that is present in every default VPC, meaning this option cannot produce a 'does not exist' error under normal circumstances.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.