SAP-C02 Design for New Solutions Practice Question
A company wants to automate the deployment of a three-tier web application on AWS. The deployment should include the network, security groups, EC2 instances, and an Application Load Balancer. Which AWS service should they use?
⚠ Common exam trap
The trap is confusing deployment orchestration (CodeDeploy) or PaaS abstraction (Elastic Beanstalk) with infrastructure provisioning — only CloudFormation declaratively provisions the full stack including network and load balancer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudFormation
AWS CloudFormation is an Infrastructure as Code service that lets you define and provision AWS resources — including VPCs, subnets, security groups, EC2 instances, and Application Load Balancers — declaratively in templates. It is the correct choice for automating the deployment of an entire three-tier architecture with all supporting network and security components.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Elastic Beanstalk
Why it's wrong here
Elastic Beanstalk provisions application environments but abstracts the network layer, so it does not give explicit declarative control over VPC subnets, security groups and an Application Load Balancer as required. Tempting for quick web app hosting, and correct when a developer wants platform-managed capacity without authoring infrastructure templates.
- ✓
AWS CloudFormation
Why this is correct
AWS CloudFormation provisions the entire stack declaratively from a template, defining VPC subnets, security groups, EC2 instances and the Application Load Balancer as interdependent resources. This satisfies the stem's requirement to automate deployment of all three tiers together, rather than configuring each component manually or scripting only parts of the infrastructure.
- ✗
AWS CodeDeploy
Why it's wrong here
AWS CodeDeploy orchestrates application revisions onto existing compute such as EC2 or Lambda; it does not provision VPCs, subnets, security groups or an Application Load Balancer. It is tempting because it automates deployments, and would be correct when the infrastructure already exists and only code rollout with lifecycle hooks is required.
- ✗
AWS OpsWorks
Why it's wrong here
AWS OpsWorks manages configuration through Chef and Puppet stacks, targeting instance-level automation rather than declaring VPC subnets, security groups, load balancers and instances as one template. It is tempting as a legacy deployment tool, and would be correct for Chef-driven configuration management of existing EC2 fleets.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.