SOA-C02 Deployment, Provisioning, and Automation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  DeletionPolicy attribute with value 'Retain'

  Why this is correct

  The DeletionPolicy attribute with value Retain is the correct CloudFormation resource-level setting to preserve an S3 bucket when its stack is deleted. It instructs CloudFormation to skip deleting the underlying resource, so the bucket and all objects remain in the AWS account as an orphaned resource. This is designed exactly for the use case of retaining stateful data such as S3 buckets or DynamoDB tables after infrastructure teardown.

• ✗

  DeletionPolicy attribute with value 'Protect'

  Why it's wrong here

  The value 'Protect' is not one of the three valid DeletionPolicy values—Delete, Retain, and Snapshot—so CloudFormation would reject the template with a validation error before creating the stack. Even if a user mistakenly assumes 'Protect' implies retention, the AWS API enum constraint prevents it from being interpreted as a policy at all. The correct way to preserve the bucket is to set DeletionPolicy to Retain, never a nonexistent 'Protect' value.

• ✗

  DeletionPolicy attribute with value 'Delete'

  Why it's wrong here

  DeletionPolicy with value Delete is actually the default behavior, meaning CloudFormation will attempt to remove the S3 bucket when the stack is deleted. If the bucket contains objects, the deletion often fails because a non-empty S3 bucket cannot be removed, which can cause the entire stack deletion to fail. In a scenario where the bucket must be retained regardless of contents, this option is wrong because it either destroys an empty bucket or blocks teardown rather than preserving the resource.

• ✗

  Stack policy

  Why it's wrong here

  A stack policy is a JSON-based access-control document that CloudFormation applies during stack updates to prevent specific resources from being modified or deleted by update operations, such as Update:Modify and Update:Delete actions. It does not govern what happens during a stack deletion—at that point, CloudFormation evaluates the resource DeletionPolicy, not the stack policy. For this reason, a stack policy cannot keep the bucket around after stack deletion; it only guards against accidental changes while the stack is being updated.

Go deeper

Related to this question