SOA-C02 Deployment, Provisioning, and Automation Practice Question
A SysOps administrator uses AWS CloudFormation to manage a stack that includes an Amazon RDS DB instance. The administrator needs to update the stack by changing a parameter that, if applied directly, would replace the database. The administrator wants to prevent accidental replacement during the update. Which CloudFormation feature should the administrator use?
⚠ Common exam trap
Many exam-takers confuse change sets (which only preview changes) with stack policies (which actually enforce update restrictions), leading them to select change sets as a safety mechanism when they only provide visibility, not prevention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stack policy
A stack policy is a CloudFormation feature that defines which stack resources can be updated or replaced during a stack update. By setting a stack policy that explicitly denies replacement updates on the RDS DB instance, the administrator can prevent accidental replacement while still allowing other updates. This is the correct approach because it directly controls the update behavior at the resource level without requiring manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change sets
Why it's wrong here
Change sets are a dry-run feature in CloudFormation that show you a summary of the changes a stack update will make, including whether a replacement will occur. However, a change set does not enforce any protective controls; it is simply a preview that you can review and then execute if you have the appropriate IAM permissions. Even if a change set indicates that an RDS instance would be replaced, it does nothing to stop that update from happening when you run it.
- ✓
Stack policy
Why this is correct
A stack policy is the correct safeguard because it is a JSON-based policy attached to the CloudFormation stack that explicitly denies specific update actions on specific resources. By adding a rule such as a Deny on 'Update:Replace' for the RDS logical resource ID, the stack update will fail and the RDS instance will be protected from replacement even if an S3 event or trusted user attempts an update. This provides a hard guard that is enforced by CloudFormation before any changes are applied, without preventing other non-replacing updates.
- ✗
Resource-level permissions
Why it's wrong here
Resource-level permissions in IAM control whether a user can perform actions on specific resources, but they do not govern what CloudFormation does to the resources inside a stack during an update. If the user has cloudformation:UpdateStack permission on the stack, they can run an update that might replace resources; IAM does not inspect or filter the individual AWS resources being modified. To block replacement, you need a resource-level CloudFormation policy like a stack policy, not IAM resource-level permissions on the RDS instance itself.
- ✗
Stack sets
Why it's wrong here
Stack sets extend CloudFormation to deploy identical stacks across multiple AWS accounts and regions, not to protect individual resources within a single stack. A stack set is used for multi-account administration and centralized rollouts, but it does not intercept or deny resource updates like a stack policy would. If a stack in a stack set is updated in a way that replaces an RDS instance, there is nothing in the stack set mechanism that would prevent that replacement.
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.