DOP-C02 - Configuration Management and Infrastructure as Code - Section 2.1

Define cloud infrastructure as code with AWS CloudFormation templates, nested stacks, change sets and stack policies.

Define AWS infrastructure using AWS CloudFormation templates with nested stacks for modular reuse, and preview modifications safely through change sets before applying them. Apply stack policies to protect critical resources from accidental replacement or deletion.

AWS CloudFormationNested stacksChange setsStack policies

Practice question for this objective

Free sampleConfiguration Management and Infrastructure as Codemedium

An engineer is about to change the name property of a resource in an "AWS CloudFormation" stack and knows from experience that some property changes force CloudFormation to replace the resource by creating a new one and deleting the old. Before running the update on a production stack, the engineer wants the pipeline to reveal exactly which resources would be replaced so a risky change can be caught in review. Which mechanism MOST directly surfaces the replacement impact ahead of time?

  • ARun drift detection on the stack first so the report identifies which resources the pending update is going to replace once it runs.
  • BCreate a change set for the proposed update and inspect its "Replacement" field, which marks each resource that the update would replace before any change is applied. Correct
  • CAdd an "UpdateReplacePolicy" of "Retain" to the resource so that the pipeline lists every resource that would be replaced when the update runs.
  • DValidate the template with the validate-template operation so the pipeline returns the list of resources that the update would need to replace.
Use a CloudFormation change set and its Replacement field to preview which resources an update would recreate before applying it. Some property updates cannot be applied in place, so CloudFormation replaces the resource by provisioning a new one and removing the old; a change set describes the planned actions and sets a Replacement indicator for each affected resource, letting reviewers detect a disruptive recreate during approval rather than discovering it mid-deployment.

Why A is wrong: Drift detection compares live resources to the currently deployed template, not to a proposed new template, so it reveals existing drift rather than the replacements a future update would cause.

Why B is correct: A change set computes the resource-level diff against the live stack, including a Replacement value of True for resources that an update would recreate, so reviewers see the exact replacement impact before execution.

Why C is wrong: UpdateReplacePolicy only decides whether the old resource is kept or deleted when a replacement happens; it changes the outcome of replacement but does not preview which resources will be replaced.

Why D is wrong: Template validation only checks structural correctness and parameter declarations; it has no view of the deployed stack, so it cannot determine which resources an update would replace.

See more DOP-C02 practice questions, answers explained.

More in this domain

Back to all Configuration Management and Infrastructure as Code objectives, or the DOP-C02 cert hub.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.