SOA-C02 Deployment, Provisioning, and Automation Practice Question
A SysOps administrator uses AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and a security group. The administrator wants to ensure that when the stack is updated, the security group is not accidentally replaced if its properties change. The administrator wants to receive a failure if an update would require replacement of the security group. Which CloudFormation feature should the administrator use?
⚠ Common exam trap
Many exam-takers confuse 'DeletionPolicy' (which only applies on stack deletion) with preventing replacement during updates, or mistakenly think 'UpdatePolicy' or 'CreationPolicy' can control resource replacement behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define a stack policy that denies replacement of the security group resource.
A stack policy can explicitly deny update actions that would replace a resource, such as the security group. By defining a stack policy with a Deny statement for the 'Replace' effect on the security group's logical resource ID, CloudFormation will fail the update if any property change triggers a replacement, preventing accidental deletion and recreation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a 'DeletionPolicy' attribute set to 'Retain' on the security group resource.
Why it's wrong here
The DeletionPolicy attribute only controls what happens to a resource when it is removed from the CloudFormation stack or when the entire stack is deleted. During an update that requires replacement, CloudFormation creates the new resource first and then deletes the old one, so the security group would still be replaced even if the old one is retained as an orphaned resource. Setting DeletionPolicy to Retain does not modify CloudFormation's update-time replacement behavior; it only prevents the old resource from being physically deleted after the stack operation. Thus it offers no protection against accidental replacement during updates.
- ✗
Add a 'CreationPolicy' attribute to the security group resource.
Why it's wrong here
A CreationPolicy is a resource-level attribute that makes CloudFormation wait for a specified number of success signals (or a full EC2 instance status) before declaring resource creation complete. It is commonly used with EC2 instances or other resources that need application-level readiness validation, not with security groups, which are created declaratively without waiting for external signals. The attribute has no bearing on update operations: it neither prevents replacement nor alters how CloudFormation handles an update that would recreate the security group. Therefore, adding a CreationPolicy would have no effect on the accidental replacement problem.
- ✓
Define a stack policy that denies replacement of the security group resource.
Why this is correct
A stack policy can specify the allowed update actions per resource. By denying the 'Replace' action for the security group, CloudFormation will fail updates that would require recreating the security group, protecting it from accidental replacement.
- ✗
Use an 'UpdatePolicy' attribute with 'AutoScalingReplacingUpdate' on the security group.
Why it's wrong here
The UpdatePolicy attribute with an AutoScalingReplacingUpdate setting is only meaningful for Auto Scaling groups, where it instructs CloudFormation to replace instances when the launch configuration changes. Security groups do not support UpdatePolicy, and CloudFormation would ignore or reject the attribute for such a resource. Even if applied to a supported resource, AutoScalingReplacingUpdate controls the mechanism of how an update is performed—rolling vs. replacement—rather than denying or preventing a replacement action. It therefore cannot serve as a guard against the security group being replaced during a stack update.
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.