DOP-C02 Resilient Cloud Solutions Practice Question
A company uses AWS CloudFormation to deploy infrastructure. They want to ensure that if a stack update fails, the stack is automatically rolled back to the last known good state. However, they also want to preserve any resources that were created successfully before the failure. Which CloudFormation stack policy should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a stack policy that allows all actions except delete.
A stack policy that denies delete actions prevents CloudFormation from deleting resources that were created successfully before failure during a rollback. When a stack update fails, CloudFormation rolls back to the previous state, which typically involves deleting or modifying resources that were created or modified during the failed update. By denying delete actions on specific resources, those resources are preserved even if the overall stack rolls back. Option B (deny update) is incorrect because denying update only prevents modifications, but resources can still be deleted during rollback. Option A is incorrect because a creation policy with a resource signal is used to control when instances are considered created, not for rollback preservation. Option D is incorrect because RollbackConfiguration with a monitoring time is used for rollout monitoring, not for preserving resources during rollback.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Define a creation policy with a resource signal.
Why it's wrong here
A creation policy with a resource signal is used to control when instances are considered created, not for preserving resources during rollback.
- ✗
Use a stack policy that denies update actions on resources that should be preserved.
Why it's wrong here
Denying update actions only prevents modifications, but resources can still be deleted during rollback; to preserve resources, denying delete actions is required.
- ✓
Use a stack policy that allows all actions except delete.
Why this is correct
Denying delete actions prevents CloudFormation from deleting the resource during a rollback, thereby preserving it. This is the correct approach.
- ✗
Set the RollbackConfiguration property with a monitoring time.
Why it's wrong here
RollbackConfiguration with a monitoring time is used for monitoring the progress of rolling updates, not for preserving resources during rollback.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.