FCSS_CDS_AR-7.6 · Question #13
The cloud administration team is reviewing an AWS deployment that was done using CloudFormation. The deployment includes six FortiGate instances that required custom configuration changes after…
The correct answer is B. Some of the FortiGate instances may be deleted and replaced with new copies. When CloudFormation applies a template update that modifies certain EC2-backed resource properties (such as adding a security group), it may determine that affected instances must be replaced - meaning the original instances are terminated and new ones are launched from the…
Question
The cloud administration team is reviewing an AWS deployment that was done using CloudFormation. The deployment includes six FortiGate instances that required custom configuration changes after being deployed. The team notices that unwanted traffic is reaching some of the FortiGate instances because the template is missing a security group. To resolve this issue, the team decides to update the JSON template with the missing security group and then apply the updated template directly, without using a change set. What is the result of following this approach?
Options
- AIf new FortiGate instances are deployed later, they will include the updated changes.
- BSome of the FortiGate instances may be deleted and replaced with new copies.
- CThe update is applied, and the security group is added to all instances without interruption.
- DCloudFormation rejects the update and warns that a new full stack is required.
How the community answered
(40 responses)- A5% (2)
- B60% (24)
- C25% (10)
- D10% (4)
Explanation
When CloudFormation applies a template update that modifies certain EC2-backed resource properties (such as adding a security group), it may determine that affected instances must be replaced - meaning the original instances are terminated and new ones are launched from the updated template. Because the FortiGate instances received custom post-deployment configuration changes (outside of CloudFormation's state), those changes are not captured in the template, so any replaced instance loses them entirely - making B correct.
Why the others are wrong:
- A is misleading because it only addresses future deployments and ignores the immediate destructive impact on existing instances.
- C is incorrect because adding a security group association to an instance is not always an in-place, zero-interruption change - CloudFormation's update behavior depends on the resource type and property, and replacement is a real risk here.
- D is wrong because CloudFormation does not reject stack updates outright; it attempts to reconcile differences between the old and new template, which is what leads to the replacement risk.
Memory tip: Think of CloudFormation as a contractor who only knows what's in the blueprints - any renovations you made yourself after the original build are invisible to it. If it decides to rebuild a room, your custom work is gone. Always use a change set first to preview what CloudFormation will destroy before confirming.
Topics
Community Discussion
No community discussion yet for this question.