DOP-C02 Configuration Management and IaC Practice Question
A company uses AWS CloudFormation to manage its infrastructure. The stack creation recently failed because an IAM role resource was created before the AWS Lambda function that depends on it. The template has no DependsOn clauses. What is the most likely reason for this failure and how can it be fixed?
⚠ Common exam trap
Test-takers frequently assume CloudFormation automatically detects all dependencies via Ref or Fn::GetAtt, but it does not infer dependencies from resource attributes like IAM role ARNs used in Lambda function configurations unless explicitly referenced in the template.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a DependsOn clause to the Lambda function resource referencing the IAM role
The most likely reason for the failure is that CloudFormation, by default, parallelizes the creation of resources that do not have explicit dependencies. Since the IAM role and Lambda function have no DependsOn clause, CloudFormation may attempt to create the Lambda function before the IAM role is fully created and its permissions are propagated. Adding a DependsOn clause to the Lambda function resource referencing the IAM role ensures that CloudFormation creates the IAM role first, resolving the dependency and preventing the failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a DependsOn clause to the Lambda function resource referencing the IAM role
Why this is correct
Adding a DependsOn clause directly tells CloudFormation that the Lambda function's creation must wait until the IAM role has finished provisioning. This is the native, declarative fix because CloudFormation's parallel resource creation does not automatically infer the role dependency if the Lambda function's properties only copy the role name or ARN as a string. Explicitly ordering the resources resolves the race condition cleanly without any additional services or architectural refactoring.
- ✗
Use AWS Systems Manager Automation to create the resources sequentially
Why it's wrong here
AWS Systems Manager Automation is an orchestration service for executing operational runbooks against AWS resources, not a mechanism for controlling CloudFormation's internal dependency graph. Wrapping CloudFormation resource creation in an automation runbook would require you to deploy the IAM role first, then separately deploy the Lambda function, effectively abandoning a single stack template and losing CloudFormation's ability to manage them as one unit. This overcomplicated workaround does not fix the template itself, whereas simply adding a DependsOn attribute would solve the root cause with a one-line change.
- ✗
Use a ChangeSet to roll back the stack and modify the template
Why it's wrong here
A ChangeSet is used to preview and apply an updated template to an existing stack; it does not have the capability to roll back a stack to a previous state by itself. Even if you modified the template to add a DependsOn clause, you would still need to execute a change set or a direct update to apply it, so this approach adds an unnecessary intermediate step. The underlying problem is the missing dependency declaration in the current template, and rolling back or using a change set will not alter that resource ordering logic.
- ✗
Split the template into two separate stacks and use nested stacks
Why it's wrong here
Splitting the template into two separate nested stacks does not on its own create the required dependency between the Lambda function and the IAM role unless you add an explicit DependsOn or pass the role ARN as a parameter that triggers a dependency. This approach increases template complexity and makes the infrastructure harder to manage, while still leaving the same ordering issue to be addressed. The simplest and most direct fix remains adding a DependsOn clause in the original template rather than restructuring the entire stack nesting hierarchy.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS CloudFormation to manage its infrastructure. The DevOps team needs to deploy a stack that includes a Lambda function and an S3 bucket. The Lambda function's code is stored in the S3 bucket. How can the team ensure that the Lambda function is created after the S3 bucket and the code is uploaded?
easy- A.Upload the code to the S3 bucket before creating the stack.
- B.Use the Fn::GetAtt intrinsic function to retrieve the bucket name.
- C.Define the S3 bucket resource before the Lambda function resource in the template.
- ✓ D.Use the DependsOn attribute on the Lambda function to depend on the S3 bucket.
Why D: The DependsOn attribute explicitly instructs CloudFormation to create the S3 bucket before the Lambda function. Even though CloudFormation automatically determines resource dependencies for certain intrinsic functions, it does not infer dependencies based on code uploads. Using DependsOn ensures the bucket exists and the code is uploaded before the Lambda function is created, preventing a deployment failure when the Lambda references code that is not yet available.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.