Refer to the exhibit. You are managing an active-passive FortiGate HA cluster in AWS that was deployed using CloudFormation. You have created a change set to examine the effects of some proposed…

Question

Exhibit

Options

• AThis deployment can be done without any traffic interruption.
• BBoth FortiGate VMs will get a new PhysicalResourceId.
• CThe updated FortiGate VMs will not have the latest configuration changes.
• DCloudFormation checks if you will surpass your account quota.

• A
  10% (5)
• B
  60% (30)
• C
  6% (3)
• D
  24% (12)

Explanation

When a CloudFormation change set shows Replacement: True for a resource, CloudFormation must tear down the existing resource and provision a brand-new one - and every newly created resource receives a new PhysicalResourceId. Since the change set indicates replacement for both FortiGate VM instances, both will be terminated and re-created, each receiving a new PhysicalResourceId (e.g., a new EC2 instance ID).

Why the distractors fail:

• A is wrong because replacing both instances in an active-passive cluster is highly disruptive - the active unit will go down during replacement, causing a traffic outage.
• C is a tempting trap: replaced instances do lose any out-of-band configuration changes (since they boot from the template), but the change set itself doesn't specifically reveal this outcome - it shows replacement, not a config gap.
• D is wrong because quota checking is a general CloudFormation behavior during stack creation/update, not a specific outcome tied to this particular change set.

Memory tip: Anytime you see Replacement: True in a CloudFormation change set, think "Old resource dies, new resource is born with a new ID." If you see it on multiple resources in an HA pair, that's a red flag for an outage, not a rolling update.

No community discussion yet for this question.