DOP-C02 Configuration Management and IaC Practice Question
A DevOps engineer is troubleshooting a CloudFormation stack that fails to create. The error message indicates a 'circular dependency' between two resources: a security group and an EC2 instance. The security group contains an ingress rule that references the instance's private IP address, which is not known until the instance is created. The instance's network interface uses the security group. What change should the engineer make to resolve the circular dependency?
⚠ Common exam trap
Test-takers frequently assume `Ref` on an EC2 instance returns its private IP address, but `Ref` actually returns the physical instance ID (e.g., i-1234567890abcdef0), not the IP, leading them to incorrectly choose Option D or attempt hardcoding in Option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an AWS::EC2::SecurityGroupIngress rule that references the instance's network interface using Fn::GetAtt on the network interface resource.
It resolves the circular dependency by creating an explicit dependency on the network interface resource rather than the EC2 instance. The `AWS::EC2::SecurityGroupIngress` rule can use `Fn::GetAtt` on the `AWS::EC2::NetworkInterface` resource to retrieve the private IP address of the instance's primary network interface, which is known after the network interface is created but before the instance is fully launched. This breaks the cycle because the security group ingress rule depends on the network interface, and the network interface depends on the security group (via association), but the instance itself is not directly referenced in the ingress rule, allowing CloudFormation to resolve the dependencies in the correct order.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create the EC2 instance first without a security group, then attach the security group after creation.
Why it's wrong here
Creating the instance without a security group leaves it vulnerable temporarily, and it does not resolve the circular dependency within the CloudFormation template itself. The dependency cycle remains as the template still requires the security group to be associated after creation.
- ✓
Add an AWS::EC2::SecurityGroupIngress rule that references the instance's network interface using Fn::GetAtt on the network interface resource.
Why this is correct
It breaks the circular dependency by using `Fn::GetAtt` on the `AWS::EC2::NetworkInterface` resource to reference the private IP address. This creates a dependency on the network interface, which is created before the instance, while the security group ingress rule depends on the network interface, breaking the cycle.
- ✗
Hardcode the instance's private IP address in the security group rule.
Why it's wrong here
Hardcoding the private IP address defeats the purpose of automation and dynamic infrastructure. It also does not resolve the template-based circular dependency; the security group rule would not automatically adapt if the instance is recreated.
- ✗
Use the Ref function on the EC2 instance to get its private IP address.
Why it's wrong here
Using Ref on the AWS::EC2::Instance resource returns the physical instance ID (e.g., i-1234567890abcdef0), not the private IP address. Even if it did return the IP, this Ref creates an explicit dependency from the security group ingress rule to the instance, while the instance itself depends on the security group for its network configuration, leaving the circular dependency unresolved. To break the cycle, you must reference the network interface resource via Fn::GetAtt to obtain the private IP without depending on the instance resource itself.
Visual reference
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.