Your application uses CloudFormation to orchestrate your application’s resources. During the testing phase before the application went live, a developer accidentally changed the Amazon RDS instance type in the CloudFormation template and updated the stack. This has caused the instance to be re-created, resulting In the loss of test data. How should you prevent others from updating the stack resources?

Answer options:

A.Within the AWS CloudFormation parameter with which users can select the Amazon RDS instance type, set AllowedValues only to contain the current instance type.
B.Use an AWS CloudFormation stack policy to deny updates to the instance.
C.In the AWS CloudFormation template, set the AWS::RDS::DBInstance’s DBlnstanceClass property to be read-only.
D.Subscribe to the AWS CloudFormation notification “BeforeResourceUpdate,” and call CancelStackUpdate if the resource identified is the Amazon RDS instance.
E.Update the stack using ChangeSets.

Answer – B
When you create a stack, all update actions are allowed on all resources. By default, anyone with stack update permissions can update all of the resources in the stack. Some resources might require an interruption or be completely replaced during an update, resulting in new physical IDs or completely new storage. You can prevent stack resources from being unintentionally updated or deleted during a stack update by using a stack policy. A stack policy is a JSON document that defines the update actions that can be performed on designated resources.
After you set a stack policy, all of the resources in the stack are protected by default. To allow updates on specific resources, you specify an explicit 
Allow
 statement for those resources in your stack policy. You can define only one stack policy per stack. But you can protect multiple resources within a single policy. A stack policy applies to all AWS CloudFormation users who attempt to update the stack. You can`t associate different stack policies with different users.
A stack policy applies only during stack updates. It doesn`t provide access controls like an AWS Identity and Access Management (IAM) policy. Use a stack policy only as a fail-safe mechanism to prevent accidental updates to specific stack resources. To control access to AWS resources or actions, use IAM.
Please refer the following link
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html