DOP-C02 Configuration Management and IaC Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a stack policy that denies all updates unless approved.

  Why it's wrong here

  A stack policy is a resource-level IAM policy that can explicitly deny update, replace, or delete actions on specified logical resources during a CloudFormation update. However, it only enforces whether an operation is permitted—it does not surface the details of what the template change would do, nor provide an approval workflow to evaluate impact. Requiring an approve step outside CloudFormation without using change sets still leaves you blind to the exact resource modifications before the update is attempted.

• ✗

  Use AWS CloudFormation drift detection to identify changes before updating.

  Why it's wrong here

  Drift detection compares the current live configuration of a stack's resources against the template and parameters CloudFormation last deployed, revealing manual modifications made outside of stack operations. It is backward-looking: it reports whether the existing infrastructure has diverged from the intended state, not what changes a proposed new template would introduce. Therefore, running drift detection before an update gives no preview of additions, replacements, or deletions that the new version would cause, so it cannot serve as a review mechanism for the update itself.

• ✗

  Enable termination protection on the stack to prevent accidental updates.

  Why it's wrong here

  Termination protection is an attribute on the stack that prevents the DeleteStack API call from succeeding, thereby guarding against accidental removal of the entire stack and all of its managed resources. It has no bearing on update operations—you can still execute Updates or change sets that disrupt or replace running resources while termination protection is enabled. Since the risk being mitigated is deletion, not modification, this setting does nothing to help review or approve the content of proposed infrastructure changes.

• ✓

  Use AWS CloudFormation change sets to review the proposed changes before executing the update.

  Why this is correct

  A change set is a read-only summary of the exact modifications CloudFormation will make to the stack when you execute it, including resource type add/remove/replace and whether the change is dynamically applied or requires no interruption. You can create and inspect multiple change sets from different template versions without touching live infrastructure, then deliberately execute the approved one—only execution applies the update. This gives you the review-before-apply gate that the requirement asks for, as the change set is the proposed changes themselves rather than a policy or detection signal.

Go deeper

Related to this question