DOP-C02 SDLC Automation Practice Question
A company uses AWS CloudFormation to provision infrastructure. They have a stack that creates an Amazon RDS DB instance. They want to update the stack to change the DB instance class from db.t2.micro to db.t3.medium. Which THREE of the following must be true for the update to succeed? (Choose three.)
⚠ Common exam trap
Candidates often confuse deletion protection with modification protection, assuming it blocks all changes, when in fact it only blocks deletion operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The stack must not be in a state that prevents updates, such as ROLLBACK_COMPLETE.
CloudFormation stacks in a terminal failure state like ROLLBACK_COMPLETE cannot be updated; they must be deleted and recreated. This is a fundamental constraint of the CloudFormation service, as the stack is considered non-functional and unable to process further operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The stack must not be in a state that prevents updates, such as ROLLBACK_COMPLETE.
Why this is correct
CloudFormation refuses to update any stack in a failed terminal state such as ROLLBACK_COMPLETE, because the stack's resources are in an inconsistent or partially provisioned state. The stack must be deleted and recreated (or, if applicable, brought back to a workable state via ContinueUpdateRollback for other rollback states) before an update operation can run.
- ✗
Deletion protection must be disabled on the DB instance.
Why it's wrong here
RDS deletion protection is a lifecycle control that only blocks the DeleteDBInstance action, not the ModifyDBInstance action used when CloudFormation changes a DBInstanceClass. Reconfiguring an instance to a larger or smaller class is a modification, not a deletion, so the presence of deletion protection does not hinder the CloudFormation stack update.
- ✓
The new DB instance class must be available in the same VPC and subnet group as the existing DB instance.
Why this is correct
Changing the DBInstanceClass via CloudFormation requires the target class to be supported in the same AWS Region and in the Availability Zones that the existing DB instance's subnet group spans. If the selected class is not available in any of those AZs, RDS returns 'The DB instance class ... is not supported in the specified Availability Zone,' causing the stack update to fail.
- ✓
The IAM role used by CloudFormation must have permissions to modify the RDS instance.
Why this is correct
The IAM principal that invokes CloudFormation's UpdateStack operation must be granted permissions to call rds:ModifyDBInstance, along with cloudformation:UpdateStack, because CloudFormation ultimately makes an RDS API call on the caller's or the stack role's behalf. Without the necessary rds:ModifyDBInstance permission, CloudFormation receives an AccessDenied error and rolls the stack update back.
- ✗
A change set must be created and executed for the update.
Why it's wrong here
Change sets are a planning feature that lets you preview the changes CloudFormation will make; they are not a prerequisite for updating a stack. A stack update can be executed directly by calling UpdateStack with a modified template or parameter values, so omitting a change set will not prevent the RDS instance class modification from taking effect.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.