The answer is a CloudFormation stack policy, which is the correct feature to block resource replacement during updates because it allows you to explicitly define update actions—such as deny replacement—on specific resources like an RDS DB instance. By applying a stack policy that denies replacement for the database, you can safely change parameters without risking accidental resource destruction, while still permitting other modifications to the stack. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this question tests your understanding of how stack policies differ from stack-level protections like termination protection, which only prevents deletion, not replacement. A common trap is confusing stack policies with IAM policies or resource-level permissions, but remember that stack policies are JSON statements attached directly to the stack to control update behavior. Memory tip: think of a stack policy as a “do not replace” sign for your critical resources—it blocks replacement updates while allowing everything else.
SOA-C02 Deployment, Provisioning, and Automation Practice Question
This SOA-C02 practice question tests your understanding of deployment, provisioning, and automation. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: stack policies prevent specific update actions on resources within a CloudFormation stack.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A SysOps administrator uses AWS CloudFormation to manage a stack that includes an Amazon RDS DB instance. The administrator needs to update the stack by changing a parameter that, if applied directly, would replace the database. The administrator wants to prevent accidental replacement during the update. Which CloudFormation feature should the administrator use?
Why wrong: Change sets allow you to preview changes before applying them, but they do not prevent the stack update from being executed. The update would still be allowed if the user has permission.
B
Stack policy
A stack policy can be used to explicitly deny updates that would replace the RDS instance, providing a safety guard.
C
Resource-level permissions
Why wrong: Resource-level permissions control which users can perform actions on specific resources, but they do not prevent replacement within an update if the user has permission to update the stack.
D
Stack sets
Why wrong: Stack sets are used to deploy CloudFormation stacks across multiple accounts and regions, not to protect individual resources within a stack.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stack policy
A stack policy is a CloudFormation feature that defines which stack resources can be updated or replaced during a stack update. By setting a stack policy that explicitly denies replacement updates on the RDS DB instance, the administrator can prevent accidental replacement while still allowing other updates. This is the correct approach because it directly controls the update behavior at the resource level without requiring manual intervention.
Key principle: Stack policies prevent specific update actions on resources within a CloudFormation stack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Change sets
Why it's wrong here
Change sets allow you to preview changes before applying them, but they do not prevent the stack update from being executed. The update would still be allowed if the user has permission.
✓
Stack policy
Why this is correct
A stack policy can be used to explicitly deny updates that would replace the RDS instance, providing a safety guard.
Related concept
Stack policies prevent specific update actions on resources within a CloudFormation stack.
✗
Resource-level permissions
Why it's wrong here
Resource-level permissions control which users can perform actions on specific resources, but they do not prevent replacement within an update if the user has permission to update the stack.
✗
Stack sets
Why it's wrong here
Stack sets are used to deploy CloudFormation stacks across multiple accounts and regions, not to protect individual resources within a stack.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse change sets (which only preview changes) with stack policies (which actually enforce update restrictions), leading them to select change sets as a safety mechanism when they only provide visibility, not prevention.
Detailed technical explanation
How to think about this question
A stack policy is a JSON document that you attach to a stack to specify allowed or denied update actions (e.g., Update:Replace, Update:Modify) on specific resources. During a stack update, CloudFormation evaluates the stack policy before applying changes; if the policy denies a replacement action on a resource, the update fails with an error rather than replacing the resource. This is particularly useful for production databases where an accidental replacement could cause data loss or prolonged downtime.
KKey Concepts to Remember
Stack policies prevent specific update actions on resources within a CloudFormation stack.
They are JSON documents defining 'Allow' or 'Deny' rules for update operations.
Stack policies apply to all users attempting to update the stack, regardless of their IAM permissions.
They are particularly useful for protecting critical resources like databases from accidental replacement or deletion.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Stack policies prevent specific update actions on resources within a CloudFormation stack.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review stack policies prevent specific update actions on resources within a CloudFormation stack., then practise related SOA-C02 questions on the same topic to reinforce the concept.
Deployment, Provisioning, and Automation — This question tests Deployment, Provisioning, and Automation — Stack policies prevent specific update actions on resources within a CloudFormation stack..
What is the correct answer to this question?
The correct answer is: Stack policy — A stack policy is a CloudFormation feature that defines which stack resources can be updated or replaced during a stack update. By setting a stack policy that explicitly denies replacement updates on the RDS DB instance, the administrator can prevent accidental replacement while still allowing other updates. This is the correct approach because it directly controls the update behavior at the resource level without requiring manual intervention.
What should I do if I get this SOA-C02 question wrong?
Review stack policies prevent specific update actions on resources within a CloudFormation stack., then practise related SOA-C02 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Stack policies prevent specific update actions on resources within a CloudFormation stack.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.