DOP-C02 Configuration Management and IaC Practice Question
Exhibit
Refer to the exhibit.
{
"Resources": {
"MyInstance": {
"Type": "AWS::EC2::Instance",
"Properties": {
"ImageId": "ami-0abcdef1234567890",
"InstanceType": "t2.micro",
"Tags": [
{
"Key": "Name",
"Value": "MyServer"
}
]
},
"DependsOn": "MySecurityGroup"
},
"MySecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "Security group for MyServer",
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIp": "0.0.0.0/0"
}
]
}
}
}
}A DevOps engineer creates the CloudFormation template shown in the exhibit. When the stack is created, the EC2 instance is launched but the security group is not applied to the instance. What is the likely cause?
⚠ Common exam trap
Many exam-takers assume creating a security group resource in the template automatically applies it to the instance, but CloudFormation requires an explicit attachment via the instance's security group properties.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The instance does not have a SecurityGroup or SecurityGroupIds property referencing the security group.
The CloudFormation template does not include a `SecurityGroup` or `SecurityGroupIds` property in the EC2 instance's `AWS::EC2::Instance` resource. Without this explicit reference, the instance launches with the default VPC security group, not the custom security group defined in the template. The security group resource is created successfully, but it is not attached to the instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group resource is missing a VpcId property, so it is not created in the same VPC as the instance.
Why it's wrong here
Omitting VpcId from the security group does not cause a VPC mismatch. When VpcId is not specified, CloudFormation creates the security group in the default VPC; the EC2 instance, which also has no SubnetId specified, is likewise launched into the default VPC. Thus both resources end up in the same default VPC, so this statement is incorrect as the root cause.
- ✓
The instance does not have a SecurityGroup or SecurityGroupIds property referencing the security group.
Why this is correct
The actual flaw is that the instance resource lacks a SecurityGroupIds or SecurityGroups property to reference the security group. DependsOn only ensures the security group is created first; it does not attach the group to the instance. Without an explicit reference in the instance properties, CloudFormation has no way to associate the security group, even though it exists and is available.
- ✗
The security group is created after the instance, so the instance cannot reference it.
Why it's wrong here
The security group is not created after the instance because the DependsOn attribute explicitly instructs CloudFormation to create the security group before the instance. Therefore, the instance could reference it if the instance had a SecurityGroupIds property. The problem is not order of creation but the absence of a linking property.
- ✗
The DependsOn clause should be removed because it causes a circular dependency.
Why it's wrong here
The DependsOn clause does not cause a circular dependency. A circular dependency occurs when two resources reference each other in a way that prevents CloudFormation from determining creation order. Here, only the instance depends on the security group; the security group does not depend on the instance, so removing DependsOn would not resolve any issue and would only risk the instance being created before the security group.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.