PAS-C01 Technology Practice Question
A company is using AWS CloudFormation to manage infrastructure. The development team wants to deploy a new version of a stack that updates an existing RDS DB instance's DB engine version. The update requires a replacement of the database. Which CloudFormation stack policy setting allows the update to proceed while preventing other resources from being replaced or updated?
⚠ Common exam trap
Many candidates confuse a stack policy with an IAM policy or resource-level permissions, mistakenly thinking that allowing updates to a resource type (Option A) is sufficient, when in fact the policy must target the specific resource logical ID to avoid unintended updates to other resources of the same type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set a stack policy that allows updates to the specific RDS DB instance resource.
A stack policy in AWS CloudFormation can be set to explicitly allow updates to a specific resource (e.g., the RDS DB instance) while denying updates to all other resources by default. Since the update requires a replacement of the database, the policy must permit the update action on that exact resource logical ID, ensuring the DB engine version change proceeds without risking unintended modifications to other stack resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set a stack policy that allows updates to RDS resources only.
Why it's wrong here
Stack policies are applied per resource, not per service.
- ✓
Set a stack policy that allows updates to the specific RDS DB instance resource.
Why this is correct
Stack policies can be written to allow updates to specific resources.
- ✗
Set a stack policy that denies all updates.
Why it's wrong here
This would block the intended update.
- ✗
Set a stack policy that allows all updates.
Why it's wrong here
This would allow updates to any resource, not just the RDS instance.
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.