SOA-C03 practice question: CloudFormation and the AWS CDK (3 of 3)

Deployment, Provisioning, and Automation A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A pet insurer manages a claims project's Amazon RDS for MySQL DB instance in a CloudFormation stack. Two rules apply. First, the stack will be deleted when the project ends in two years, and a final copy of the database must remain afterward. Second, until then, no stack update may replace or delete the DB instance by accident, while other resources in the stack must stay updatable. Which TWO actions meet these requirements? (Choose two.)

Choose two answers.

A. Run drift detection on the stack every day and alert the team if the DB instance's configuration has changed.
B. Apply a stack policy that denies Update:Replace and Update:Delete on the DB instance and allows all updates on other resources.
C. Set UpdateReplacePolicy: Retain on the DB instance so that updates are not allowed to replace it during the project.
D. Set DeletionPolicy: Snapshot on the DB instance resource so that CloudFormation takes a final snapshot when the stack is deleted.
E. Turn on termination protection for the stack so that the database cannot be deleted while the project is running.

Show the answer and explanation

Answers: B, D

A. Wrong: Drift detection finds changes made outside CloudFormation after they happen. It does not prevent a stack update from replacing the database. Learn more: Detect unmanaged configuration changes to stacks and resources with drift detection (opens in a new tab)
B. Right: Correct. A stack policy controls which resources stack updates can change. Denying replacement and deletion of the DB instance blocks accidental changes, while other resources stay updatable. Learn more: Prevent updates to stack resources (opens in a new tab)
C. Wrong: UpdateReplacePolicy decides what happens to the old resource after a replacement, such as keeping it. The replacement still happens, and the application moves to a new, empty DB instance. Learn more: UpdateReplacePolicy attribute (opens in a new tab)
D. Right: Correct. With the Snapshot deletion policy, CloudFormation creates a snapshot of the DB instance before deleting it. The final copy remains after the stack is gone. Learn more: DeletionPolicy attribute (opens in a new tab)
E. Wrong: Termination protection prevents deleting the whole stack, not changes made during updates. It does not stop an update from replacing the DB instance. Learn more: Protect CloudFormation stacks from being deleted (opens in a new tab)

Explanation

Two different CloudFormation controls cover the two rules. DeletionPolicy decides what happens to a resource when the stack is deleted, and Snapshot keeps a final copy of the database. A stack policy limits what stack updates may do to specific resources. Termination protection, UpdateReplacePolicy and drift detection solve related but different problems.

SOA-C03 practice question: CloudFormation and the AWS CDK (3 of 3)

Explanation

Study

Keep practicing