DOP-C02 Configuration Management and IaC Practice Question
A DevOps team is using AWS CloudFormation to manage infrastructure. They need to ensure that stack updates are reviewed and approved by a senior engineer before being executed. Which feature should they implement?
⚠ Common exam trap
Many candidates confuse change sets with stack policies, assuming both control updates, but stack policies only protect specific resources from modification, not the update approval process itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change sets
Change sets allow you to preview the proposed changes to a CloudFormation stack before executing them. This enables a senior engineer to review and approve the changes, ensuring that only validated updates are applied. Without change sets, updates would be applied immediately without a review step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Stack policies
Why it's wrong here
Stack policies are JSON-based access control documents that specify which update actions are permitted or denied on a stack's resources, often used to protect critical components like databases from accidental deletion or replacement. They act as a guardrail during an actual update operation, but they do not produce a proposed change summary or require human approval before the update is applied. Because they only filter what can be modified, not introduce a review/approval step, they fail to meet the team's requirement.
- ✗
Drift detection
Why it's wrong here
Drift detection is a diagnostic feature that compares the current runtime configuration of a stack's resources against the expected state declared in the CloudFormation template and records any differences as drift. It is an asynchronous audit that reports existing modifications that have already occurred, whether through manual console changes or external automation, and it does not intercept or preview pending updates. Since it operates after the fact rather than before an update, it cannot serve as a review/approval gate for planned changes.
- ✓
Change sets
Why this is correct
Change sets provide an itemized, read-only prediction of the exact modifications CloudFormation will apply to a stack when an updated template or parameter set is executed, listing each resource as being added, removed, or replaced without actually altering the stack. They are generated by calling CreateChangeSet, allowing the team to inspect the impact in a CI/CD pipeline and then explicitly execute the change set only after human approval. This makes change sets the correct mechanism for implementing a controlled pre-update review and approval workflow.
- ✗
Stack sets
Why it's wrong here
Stack sets are a CloudFormation feature designed to provision and manage identical stacks across multiple AWS accounts and Regions from a single template, simplifying organization-wide compliance and configuration consistency. They operate at the level of entire stacks rather than individual resource changes, and they lack any built-in workflow for reviewing or approving the specific diffs that would result from updating a template. Therefore, using stack sets would not address the need for a pre-update review step on a single stack.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.