- A
Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional
The stack policy evaluates each update action per resource. A Deny on Replace for the RDS logical resource ID prevents CloudFormation from completing any update that would recreate the database — the update fails with a clear policy error. A temporary override policy passed via --stack-policy-during-update can explicitly allow the replacement for a deliberate migration.
- B
Enable deletion protection on the RDS instance to prevent CloudFormation from deleting it
Why wrong: RDS deletion protection prevents accidental deletion through the API or console, and also causes CloudFormation delete-stack to fail for that resource. However, deletion protection does not prevent CloudFormation from replacing the instance (replacing creates a new instance and deletes the old one). A stack policy must be used to block the Replace action.
- C
Use CloudFormation change sets to preview the update and manually reject any change set that includes a replacement
Why wrong: Change sets allow previewing before executing, which is good practice. However, if the operator forgets to review or a CI/CD pipeline applies the change set automatically, the replacement can still occur. A stack policy enforces the protection automatically without relying on human review.
- D
Add a DeletionPolicy: Retain attribute to the RDS resource in the template
Why wrong: DeletionPolicy: Retain prevents CloudFormation from deleting the physical resource when the logical resource is removed from the stack or the stack is deleted. It does not prevent CloudFormation from replacing the resource due to a property change during a stack update — that is controlled by the UpdateReplacePolicy attribute (also Retain) and the stack policy.
Quick Answer
The answer is to set a CloudFormation stack policy that denies Replace and Delete actions on the RDS resource, requiring an explicit override policy when a replacement is intentional. This works because a stack policy acts as a resource-level firewall, allowing you to specify which update, replace, or delete actions are permitted or denied for individual resources within the stack. For the AWS Certified SysOps Administrator Associate SOA-C02 exam, this tests your understanding of how to prevent accidental data loss during stack updates, a common real-world scenario. A frequent trap is confusing stack policies with IAM policies—remember that stack policies control update behavior on resources, not who can perform the update. The key memory tip is "Deny to protect, override to replace": by default, deny replacement on critical data stores like RDS, and only allow it when you explicitly pass a permissive policy during the update.
SOA-C02 Practice Question: CloudFormation stack policy to prevent accidental…
This SOA-C02 practice question tests your understanding of deployment, provisioning, and automation. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: cloudFormation stack policy. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A CloudFormation stack manages an RDS database, an S3 bucket, and several Lambda functions. During a recent stack update, a property change caused CloudFormation to replace the RDS instance, deleting the database and re-creating it — resulting in data loss. The team wants to prevent any future stack update from replacing or deleting the RDS instance without an explicit override. What CloudFormation feature accomplishes this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional
Option A is correct because a CloudFormation stack policy can explicitly deny Update (which includes replacement) and Delete actions on specific resources, such as the RDS instance. To intentionally perform a replacement, the user must provide an override stack policy during the update that allows the action, ensuring that no accidental replacement occurs without explicit consent.
Key principle: CloudFormation stack policy
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional
Why this is correct
The stack policy evaluates each update action per resource. A Deny on Replace for the RDS logical resource ID prevents CloudFormation from completing any update that would recreate the database — the update fails with a clear policy error. A temporary override policy passed via --stack-policy-during-update can explicitly allow the replacement for a deliberate migration.
Related concept
CloudFormation stack policy
- ✗
Enable deletion protection on the RDS instance to prevent CloudFormation from deleting it
Why it's wrong here
RDS deletion protection prevents accidental deletion through the API or console, and also causes CloudFormation delete-stack to fail for that resource. However, deletion protection does not prevent CloudFormation from replacing the instance (replacing creates a new instance and deletes the old one). A stack policy must be used to block the Replace action.
- ✗
Use CloudFormation change sets to preview the update and manually reject any change set that includes a replacement
Why it's wrong here
Change sets allow previewing before executing, which is good practice. However, if the operator forgets to review or a CI/CD pipeline applies the change set automatically, the replacement can still occur. A stack policy enforces the protection automatically without relying on human review.
- ✗
Add a DeletionPolicy: Retain attribute to the RDS resource in the template
Why it's wrong here
DeletionPolicy: Retain prevents CloudFormation from deleting the physical resource when the logical resource is removed from the stack or the stack is deleted. It does not prevent CloudFormation from replacing the resource due to a property change during a stack update — that is controlled by the UpdateReplacePolicy attribute (also Retain) and the stack policy.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse RDS deletion protection or DeletionPolicy: Retain with stack policies, mistakenly believing those features can block CloudFormation from replacing a resource during an update, when in fact they only protect against deletion in specific scenarios (e.g., stack deletion or direct API calls).
Detailed technical explanation
How to think about this question
A CloudFormation stack policy is a JSON document that defines allowed or denied actions (e.g., Update, Delete, Replace) on specific resources. When a stack update attempts an action that is denied by the policy, CloudFormation fails the update unless the caller provides a temporary override policy that permits the action. This is different from resource-level attributes like DeletionPolicy or RDS deletion protection, which operate at the service level and do not intercept CloudFormation's internal replacement logic.
KKey Concepts to Remember
- CloudFormation stack policy
- resource update protection
- Replacement action
- StatefulResources
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
CloudFormation stack policy
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Review cloudFormation stack policy, then practise related SOA-C02 questions on the same topic to reinforce the concept.
- →
Deployment, Provisioning, and Automation — study guide chapter
Learn the concepts, then practise the questions
- →
Deployment, Provisioning, and Automation practice questions
Targeted practice on this topic area only
- →
All SOA-C02 questions
1,546 questions across all exam domains
- →
AWS Certified SysOps Administrator Associate SOA-C02 study guide
Full concept coverage aligned to exam objectives
- →
SOA-C02 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SOA-C02 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Monitoring, Logging, and Remediation practice questions
Practise SOA-C02 questions linked to Monitoring, Logging, and Remediation.
Reliability and Business Continuity practice questions
Practise SOA-C02 questions linked to Reliability and Business Continuity.
Deployment, Provisioning, and Automation practice questions
Practise SOA-C02 questions linked to Deployment, Provisioning, and Automation.
Security and Compliance practice questions
Practise SOA-C02 questions linked to Security and Compliance.
Networking and Content Delivery practice questions
Practise SOA-C02 questions linked to Networking and Content Delivery.
Cost and Performance Optimization practice questions
Practise SOA-C02 questions linked to Cost and Performance Optimization.
SOA-C02 fundamentals practice questions
Practise SOA-C02 questions linked to SOA-C02 fundamentals.
SOA-C02 scenario practice questions
Practise SOA-C02 questions linked to SOA-C02 scenario.
SOA-C02 troubleshooting practice questions
Practise SOA-C02 questions linked to SOA-C02 troubleshooting.
Practice this exam
Start a free SOA-C02 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SOA-C02 question test?
Deployment, Provisioning, and Automation — This question tests Deployment, Provisioning, and Automation — CloudFormation stack policy.
What is the correct answer to this question?
The correct answer is: Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional — Option A is correct because a CloudFormation stack policy can explicitly deny Update (which includes replacement) and Delete actions on specific resources, such as the RDS instance. To intentionally perform a replacement, the user must provide an override stack policy during the update that allows the action, ensuring that no accidental replacement occurs without explicit consent.
What should I do if I get this SOA-C02 question wrong?
Review cloudFormation stack policy, then practise related SOA-C02 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
CloudFormation stack policy
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.