The correct answer is to use the dynamic reference `{{resolve:secretsmanager:MySecret:SecretString:password}}` in the CloudFormation template. This works because CloudFormation’s dynamic reference syntax allows you to retrieve the actual secret value from AWS Secrets Manager as a plaintext string during stack creation, directly satisfying the `MasterUserPassword` property’s strict String type requirement. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this question tests your understanding that intrinsic functions like `Ref` or `Fn::GetAtt` only return the secret’s ARN or metadata, not the password value itself—a common trap where engineers mistakenly try to pass an ARN where a literal string is needed. Remember the key distinction: dynamic references resolve to the secret’s value at deploy time, while other functions return resource identifiers. A helpful memory tip is “resolve for the value, Ref for the reference”—if the property demands a plaintext string, you must use the `{{resolve:secretsmanager:...}}` syntax.
DOP-C02 Configuration Management and IaC Practice Question
This DOP-C02 practice question tests your understanding of configuration management and iac. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses AWS CloudFormation with a template that creates an Amazon RDS DB instance. The password for the master user is stored in AWS Secrets Manager. The CloudFormation stack creation fails with the error: 'Value of property MasterUserPassword must be of type String'. How should the DevOps engineer resolve this issue?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the dynamic reference '{{resolve:secretsmanager:MySecret:SecretString:password}}' in the CloudFormation template.
Option C is correct because CloudFormation supports dynamic references, which allow you to retrieve secret values from AWS Secrets Manager at stack creation time using the syntax `{{resolve:secretsmanager:secret-id:secret-string:json-key}}`. This resolves the password as a plaintext string directly in the template, satisfying the `MasterUserPassword` property's requirement for a String type. Other intrinsic functions like `Ref` or `Fn::GetAtt` return ARNs or metadata, not the secret value itself, and cannot be used directly for this purpose.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use the Fn::ImportValue intrinsic function to import the secret value.
Why it's wrong here
Fn::ImportValue is for cross-stack outputs.
✗
Use the Ref intrinsic function to reference the secret.
Why it's wrong here
Ref returns the secret ID, not the password.
✓
Use the dynamic reference '{{resolve:secretsmanager:MySecret:SecretString:password}}' in the CloudFormation template.
Why this is correct
Dynamic references allow CloudFormation to resolve secrets at stack creation.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use the Fn::GetAtt intrinsic function to retrieve the secret value from Secrets Manager.
Why it's wrong here
Fn::GetAtt returns the ARN, not the password.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse intrinsic functions like `Ref` or `Fn::GetAtt` with the ability to retrieve secret values, not realizing that only dynamic references (the `{{resolve:...}}` syntax) can directly inject a secret string into a resource property that expects a plaintext value.
Trap categories for this question
Command / output trap
Fn::ImportValue is for cross-stack outputs.
Detailed technical explanation
How to think about this question
Dynamic references in CloudFormation are resolved at stack creation time by the CloudFormation service itself, which calls the Secrets Manager API to retrieve the secret value and injects it as a literal string into the template. This avoids exposing the password in the template or requiring manual retrieval, and it supports both plaintext and JSON-structured secrets via the `SecretString` and optional `json-key` components. A subtle behavior is that if the secret is rotated, the dynamic reference always uses the current version, which can cause stack updates to fail if the old password is still in use by the DB instance.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Configuration Management and IaC — This question tests Configuration Management and IaC — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use the dynamic reference '{{resolve:secretsmanager:MySecret:SecretString:password}}' in the CloudFormation template. — Option C is correct because CloudFormation supports dynamic references, which allow you to retrieve secret values from AWS Secrets Manager at stack creation time using the syntax `{{resolve:secretsmanager:secret-id:secret-string:json-key}}`. This resolves the password as a plaintext string directly in the template, satisfying the `MasterUserPassword` property's requirement for a String type. Other intrinsic functions like `Ref` or `Fn::GetAtt` return ARNs or metadata, not the secret value itself, and cannot be used directly for this purpose.
What should I do if I get this DOP-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template needs to reference the secret value dynamically during stack creation. How should the template retrieve the secret?
medium
A.Use a CloudFormation mapping to store the secret ARN.
✓ B.Use a dynamic reference with '{{resolve:secretsmanager:secret-id:secret-string}}' in the template.
C.Hardcode the password in the template as a literal string.
D.Use a CloudFormation parameter with a default value referencing the secret ARN.
Why B: CloudFormation dynamic references using 'resolve:secretsmanager' allow the template to retrieve secret values at stack creation time. Option D is correct. Options A, B, and C do not retrieve the secret value dynamically.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.