DOP-C02 SDLC Automation Practice Question
A company uses AWS CloudFormation to manage infrastructure. They want to update a stack but need to ensure that critical database resources are not accidentally replaced during the update. What is the BEST way to protect these resources?
⚠ Common exam trap
Watch out — candidates often confuse DeletionPolicy (which only applies on stack deletion) with stack policies (which control update behavior), leading them to incorrectly select Option B as a safeguard during updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define a stack policy that denies updates to the database resources.
A stack policy explicitly defines which resources can be updated or replaced during a stack update. By applying a stack policy that denies update actions on the critical database resources, you prevent accidental replacement or modification without having to remove the resources from the stack. This is the most direct and robust method to protect specific resources during a CloudFormation update operation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a CreationPolicy on the database resources.
Why it's wrong here
A CreationPolicy is a CloudFormation resource attribute that instructs CloudFormation to wait for a specified number of success signals (e.g., from cfn-signal) before marking resource creation as complete. It operates exclusively during the CREATE phase; it has no bearing on update operations, so a database resource being replaced during an update would not be blocked or delayed by this policy.
- ✗
Use a DeletionPolicy of Retain on the database resources.
Why it's wrong here
DeletionPolicy is a resource attribute that specifies what happens when a stack is deleted or when the resource is removed from the template. Setting Retain preserves the physical database if the stack is deleted, but it does not prevent CloudFormation from replacing the resource during an update that requires a new physical ID, such as changing a DB engine or storage configuration. It offers no protection against update-triggered replacement.
- ✓
Define a stack policy that denies updates to the database resources.
Why this is correct
A stack policy is a JSON document applied to the entire stack that explicitly controls which update actions are permitted on which logical resources. By adding a Deny statement that targets the database resources (e.g., Deny on Update:Replace), CloudFormation will refuse to replace those resources during any stack update, preserving both data and availability. This is the precise, preemptive protection mechanism.
- ✗
Set an UpdatePolicy with AutoScalingReplacingUpdate.
Why it's wrong here
UpdatePolicy is a resource attribute that controls how CloudFormation performs updates for specific resource types, primarily AWS::AutoScaling::AutoScalingGroup. The AutoScalingReplacingUpdate sub-option dictates whether the Auto Scaling group itself should be replaced versus updated in place; it is not applicable to database resources like RDS, which do not honor this policy. As a result, it provides no protection for the database.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.