DOP-C02 practice question: CloudFormation templates, change sets and stack updates (2 of 2)
Configuration Management and IaC A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
An online retailer manages its checkout network with an AWS CloudFormation stack. A stack update that adds an inbound rule to a security group failed because a rule with the same port and source already exists; an engineer had added it in the console during an incident.
The security team wants the stack to describe the approved configuration again, without deleting the security group, which other stacks reference through exports. Before anything changes, the team wants to see every property of the stack's resources that no longer matches the template.
The update must be done through CloudFormation so that the stack's history stays complete and the change is reviewed in a change set first.
Which approach meets these requirements?
Choose one answer.
AA. Delete the stack with the retain option for the security group, create a new stack with the approved template, and import the retained security group into the new stack.
BB. Use the security group's DeletionPolicy of Snapshot and update the template with the approved rules, so that CloudFormation replaces the group and keeps a backup of the old rules.
CC. Update the stack with the template again, and let CloudFormation overwrite the manual rule, because CloudFormation always restores resources to their template state during an update.
DD. Run drift detection to identify the changed resource and property values, then either remove the manual rule or add it to the template, and run a change set before the update.
Show the answer and explanation
Answer: D
A. Wrong: Deleting the stack breaks the exports that other stacks reference, and the import adds a second change. The stack history is also no longer continuous, which the team wanted to keep. Learn more: DeletionPolicy attribute (opens in a new tab)
B. Wrong: Snapshot is not a supported deletion policy for security groups, and forcing a replacement would change the group's ID, which breaks the other stacks that import it. It also does not show which properties drifted. Learn more: DeletionPolicy attribute (opens in a new tab)
Drift detection reports which resource properties changed outside CloudFormation, so the team sees the manual rule before changing anything. The team then removes the rule or adds it to the template, and a change set shows the result before the update. Deleting the stack or replacing the group breaks exports, and rerunning the update does not undo manual changes.
Want more on CloudFormation templates, change sets and stack updates? The 5 full-length practice sets have 9 more CloudFormation templates, change sets and stack updates questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →