SOA-C02 Deployment, Provisioning, and Automation Practice Question
A SysOps administrator manages a CloudFormation stack that deploys a web application. The stack includes an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to update the stack to change the EC2 instance type. The administrator wants to ensure that the update does not accidentally replace the RDS database. Which CloudFormation feature should the administrator use to protect the RDS resource from being replaced during the stack update?
⚠ Common exam trap
Test-takers frequently confuse DeletionPolicy (which only applies on stack deletion) with stack policies (which control updates), leading them to incorrectly choose Option A as a safety measure during updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a stack policy that denies updates to the RDS resource.
A stack policy is an AWS CloudFormation feature that explicitly denies update or replacement actions on specified resources. By applying a stack policy that denies updates to the RDS resource, the administrator prevents any stack update operation (including changing the EC2 instance type) from modifying or replacing the database, even if the template changes would otherwise affect it. This is the correct approach because it provides a guardrail specifically against accidental replacement during updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a DeletionPolicy of Retain on the RDS resource.
Why it's wrong here
A DeletionPolicy only controls what happens when a resource is deleted from the stack, not when it is replaced during an update. Replacement involves both creation and deletion, but this policy does not prevent the update.
- ✓
Use a stack policy that denies updates to the RDS resource.
Why this is correct
A stack policy can explicitly deny update, replace, or delete actions on specific resources. By applying a policy that denies update to the RDS resource, the CloudFormation update will fail if it attempts to modify the RDS instance, thus protecting it from accidental replacement.
- ✗
Use the Resource Signal and CreationPolicy attributes.
Why it's wrong here
CreationPolicy and Resource Signal govern the creation lifecycle of a resource: they instruct CloudFormation to wait for a specified number of success signals or a timeout before considering the resource fully created. They have no effect during stack updates, because they only apply at initial creation or when a resource is recreated after replacement. Consequently, they cannot block or prevent the RDS instance from being replaced during an update; they only help verify that a newly created resource is operational before the stack proceeds.
- ✗
Use a Change Set to review changes before executing.
Why it's wrong here
A Change Set allows you to preview the changes that will be made, but it does not block the update execution. If the administrator executes the change set, the RDS resource could still be replaced.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.