PAS-C01 Operations and Maintenance Practice Question
A financial services company runs a multi-tier application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances for the web tier, and an Amazon RDS for MySQL database for the backend. The operations team uses AWS CloudFormation to manage infrastructure. During a recent deployment, a change to the database security group caused an outage because the web tier lost connectivity to the database. The team wants to prevent similar incidents in the future. They need a solution that allows them to review and approve changes to critical resources before deployment, while still enabling rapid deployment for non-critical changes. The team uses AWS CodePipeline for CI/CD. Which approach should the team implement?
⚠ Common exam trap
Many exam-takers confuse reactive auditing tools (Config, CloudTrail) with proactive approval mechanisms, or they overestimate Service Catalog's ability to handle per-resource approval workflows within a single stack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use CloudFormation Change Sets in the pipeline and add a manual approval step for any change that modifies the database security group.
CloudFormation Change Sets allow you to preview how proposed changes will affect your resources before execution. By integrating a manual approval step in the CodePipeline that triggers specifically when the change set modifies the database security group, the team can review and approve critical changes while allowing non-critical changes to proceed automatically. This directly addresses the requirement to prevent outages from unapproved security group modifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config rules to automatically remediate non-compliant changes before they are applied.
Why it's wrong here
AWS Config is reactive, not proactive for deployment approvals.
- ✓
Use CloudFormation Change Sets in the pipeline and add a manual approval step for any change that modifies the database security group.
Why this is correct
Change Sets show the impact, and manual approval gates allow review before deployment.
- ✗
Use AWS Service Catalog to create a portfolio of approved stacks and require all deployments to use the portfolio.
Why it's wrong here
Service Catalog does not integrate with CodePipeline for change approval workflows.
- ✗
Use AWS CloudTrail to monitor changes to the security group and trigger a rollback if unauthorized changes are detected.
Why it's wrong here
CloudTrail is for auditing, not preventing changes.
Go deeper
Related to this question
About these practice questions
This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.