DOP-C02 Configuration Management and IaC Practice Question
A company uses AWS CloudFormation to manage a production environment. The DevOps team wants to implement a change management process where any changes to the stack must be reviewed before execution. Which feature should the team use?
⚠ Common exam trap
Many exam-takers confuse Stack Policies (which control update permissions) with Change Sets (which provide a preview), or they assume Drift Detection can be used to review proposed changes when it only detects unmanaged changes after they occur.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CloudFormation Change Sets
CloudFormation Change Sets allow the DevOps team to preview how proposed changes to a stack will impact running resources before they are executed. This enables a review-and-approval workflow because the change set can be created, reviewed, and then executed only after approval, satisfying the requirement for a change management process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CloudFormation StackSets
Why it's wrong here
CloudFormation StackSets are designed for multi-account and multi-region stack deployments, allowing you to manage identical stacks across many accounts from a single template. They do not provide a review or approval mechanism for changes to a single production stack, as their primary purpose is orchestration and consistency across environments rather than change validation.
- ✗
CloudFormation Stack Policies
Why it's wrong here
CloudFormation Stack Policies are IAM-like JSON documents that protect specific resources from being updated or deleted during a stack update, acting as a safety guardrail. However, they do not offer a preview of the changes or a human review step; they simply deny certain update actions if attempted, so they cannot serve as a process to assess and approve changes before execution.
- ✓
CloudFormation Change Sets
Why this is correct
CloudFormation Change Sets allow you to preview the complete impact of proposed stack changes—including resource additions, modifications, and deletions—without applying them. This enables you to review the exact changes, identify potential replacements or unintended side effects, and then execute the change set to safely update your production stack with confidence.
- ✗
CloudFormation Drift Detection
Why it's wrong here
CloudFormation Drift Detection is a reactive tool that compares the actual state of stack resources to the expected template configuration to identify manual changes made outside of CloudFormation. It audits what has already happened rather than reviewing planned changes, so it cannot be used to evaluate and approve modifications before they are applied to a production environment.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.