DOP-C02 SDLC Automation Practice Question
A DevOps engineer is creating an AWS CloudFormation template to deploy a stack that includes an Amazon EC2 instance. The instance needs to be launched in a specific subnet. How should the engineer reference the subnet ID in the template?
⚠ Common exam trap
It's easy for candidates to confuse Fn::GetAtt with the ability to retrieve any resource attribute from any stack, but Fn::GetAtt only works for resources defined in the same template and cannot fetch a subnet ID from an existing VPC resource unless that VPC resource itself outputs the subnet ID.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define a parameter (Parameters) of type AWS::EC2::Subnet::Id and reference it.
Defining a parameter of type `AWS::EC2::Subnet::Id` allows the CloudFormation template to accept a subnet ID as input at stack creation or update time, making the template reusable across different environments without modification. This approach follows infrastructure-as-code best practices by avoiding hardcoded values and enabling parameterized deployments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the subnet ID in the template.
Why it's wrong here
Hardcoding the subnet ID makes the template immutable to environment changes; every environment or VPC would require a separate template copy, and any subnet rotation forces a template edit. CloudFormation best practice treats resource identifiers like subnet IDs as environment-specific inputs, so hardcoding violates parameterization and complicates code review and CI/CD.
- ✗
Use a mapping (Mappings) to define the subnet ID based on the stack name.
Why it's wrong here
Mappings are intended for static data such as AMI IDs per region or instance type configurations; they are embedded in the template at authoring time. A subnet ID is account- and VPC-specific and cannot be inferred from the stack name, so you would still need to manually populate the mapping, and the stack name is not a reliable lookup key. Also, stack name can change per deployment, so Mappings do not adapt automatically.
- ✓
Define a parameter (Parameters) of type AWS::EC2::Subnet::Id and reference it.
Why this is correct
Defining a parameter of type AWS::EC2::Subnet::Id lets the caller supply the actual subnet at stack creation or update, and CloudFormation validates that the value is a real subnet ID. Referencing it via Ref keeps the template portable across environments, and the parameter appears in the console or CLI for clear input.
- ✗
Use the Fn::GetAtt function to retrieve the subnet ID from a VPC resource.
Why it's wrong here
Fn::GetAtt can only access attributes of resources that are declared in the same CloudFormation template. Even if a VPC resource exists in the stack, a VPC's attributes do not include its subnets, and you would need to create an AWS::EC2::Subnet resource and use its Ref/GetAtt. Here the subnet is an existing external resource, so GetAtt cannot reference it.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.