SOA-C02 Deployment, Provisioning, and Automation Practice Question
A SysOps administrator is updating an AWS CloudFormation stack that contains an Amazon RDS DB instance. The administrator wants to prevent accidental replacement of the database during the update. Which CloudFormation feature should be used?
⚠ Common exam trap
A common mix-up: candidates confuse change sets (which only preview changes) with stack policies (which enforce guardrails), leading them to incorrectly select change sets as the mechanism to prevent accidental replacement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stack policies
Stack policies are the correct feature because they allow you to define explicit deny statements that prevent CloudFormation from updating or replacing specific resources, such as an RDS DB instance, during a stack update. By setting a stack policy that denies replacement actions on the database resource, the administrator ensures that even if the template changes would normally trigger a replacement, the update will fail rather than accidentally recreate the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change sets
Why it's wrong here
Change sets are read-only previews of how a stack update will alter resources, showing which resources will be modified, added, or replaced. While they enable you to review potential replacement before applying, they do not enforce any protection—if you apply the change set, CloudFormation will proceed with the replacement exactly as shown. Thus, change sets are a governance tool for review, not a mechanism to block destructive updates.
- ✓
Stack policies
Why this is correct
Stack policies are JSON-based IAM-style policies attached to a CloudFormation stack that act as an explicit guard against certain update actions. By configuring a stack policy that denies the Update:Replace action for the RDS DB instance resource (using "Effect": "Deny" and "Action": ["Update:Replace"]), CloudFormation will refuse to replace the database during any stack update. This is exactly the protection the administrator needs to ensure the database is not inadvertently replaced.
- ✗
Resource signals
Why it's wrong here
Resource signals are used with CreationPolicy or UpdatePolicy to make CloudFormation wait for a specified number of success signals from EC2 instances or other resources before marking a resource as created/updated. They are purely a synchronization mechanism to verify that resource configuration (like bootstrapping) completed successfully—they do not influence the replacement decision. Therefore, signals cannot prevent a resource from being replaced during an update.
- ✗
Nested stacks
Why it's wrong here
Nested stacks are CloudFormation templates that are invoked from within another template, allowing you to reuse common infrastructure components and keep templates modular. They affect how the template is organized and executed, but they do not introduce any intrinsic protection against resource replacement. The update behavior of the underlying resources is still governed by the normal CloudFormation update rules and any applied stack policies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.