SOA-C02 Deployment, Provisioning, and Automation Practice Question
A company uses AWS CloudFormation to manage infrastructure. A developer accidentally deletes a resource from the stack template, and the next stack update attempts to delete the resource. The SysOps administrator wants to prevent accidental deletion of critical resources. Which CloudFormation feature should be used?
⚠ Common exam trap
SOA-C02 often tests the difference between stack-level protections (termination protection, IAM policies) and resource-level protections (DeletionPolicy), causing candidates to choose stack-level options when the question asks about preventing deletion of a specific resource.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set a DeletionPolicy attribute to 'Retain' on the resource.
The DeletionPolicy attribute set to 'Retain' on a resource ensures that CloudFormation will preserve the resource even if it is removed from the stack template or the stack itself is deleted. This directly prevents accidental deletion of critical resources during stack updates. It is a resource-level safeguard, not a stack-level one.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable termination protection on the stack.
Why it's wrong here
Termination protection is a stack-level safeguard that only blocks the entire stack from being deleted via the AWS Management Console or DeleteStack API. It has no effect on individual resources during a stack update; if a resource is removed from the template, CloudFormation will still delete it even when termination protection is enabled. This option fails because it does not influence resource-level lifecycle behavior.
- ✗
Stack policy to deny delete actions.
Why it's wrong here
A stack policy is a JSON document that controls which update actions (Modify, Replace, Delete) can be performed on specific resources during a stack update. While it can deny an update that would delete a resource, doing so causes the entire update to fail rather than decoupling and retaining the resource; it does not set a lifecycle policy. Additionally, stack policies are not evaluated during stack deletion, so they cannot ensure retention in that scenario.
- ✓
Set a DeletionPolicy attribute to 'Retain' on the resource.
Why this is correct
Setting the DeletionPolicy attribute to 'Retain' is the correct mechanism. It instructs CloudFormation to keep the resource and its contents when the resource is removed from the stack template, whether during an update or a stack deletion. The resource is simply orphaned from CloudFormation management, allowing you to preserve data such as an S3 bucket or RDS database for later use or manual cleanup.
- ✗
Attach an IAM policy that denies cloudformation:DeleteStack.
Why it's wrong here
IAM policies determine whether a specific user or role is authorized to call cloudformation:DeleteStack; they do not affect how CloudFormation processes resource deletions during an update. Denying DeleteStack would prevent the entire stack from being deleted, but CloudFormation can still delete resources that are removed from the template when the stack is updated. Moreover, IAM policies target the caller, not the CloudFormation service, so they are irrelevant to resource lifecycle decisions.
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.