DVA-C02 Deployment Practice Question
A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS with Fargate. The pipeline has a deploy stage that uses Amazon ECS Blue/Green deployment. The deployment fails intermittently with a 'Task failed to start' error. The developer needs to troubleshoot the issue. Which THREE steps should the developer take? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the Amazon ECS service events for the task failure reason.
Options B, C, and E are correct. Checking Amazon ECS service events (B) provides the task failure reason directly from the ECS service. Validating the task definition JSON (C) ensures correct container image references and configuration. Verifying the task execution IAM role (E) ensures it has permissions to pull the container image from ECR. Option A (CodeBuild logs) is incorrect because the failure occurs during deployment, not build. Option D (CloudFormation stack events) is incorrect because the ECS service may not be created via CloudFormation or events there are not relevant for task failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Review the CodeBuild build logs for errors.
Why it's wrong here
CodeBuild logs capture build-time commands, test output, and artifact generation — all of which occur before the pipeline enters the deploy stage. An ECS task failing to start is a runtime infrastructure issue that happens after the artifact has been pushed; build logs will typically show a successful build followed by deployment steps that don't contain container launch details. They are useful for catching compile errors but cannot report why ECS was unable to place or start the task.
- ✓
Check the Amazon ECS service events for the task failure reason.
Why this is correct
The Amazon ECS service events tab is the authoritative source for recent service-level warnings and alarms, including deployment failures and stopped tasks. Each event often contains the exact error such as "CannotPullContainerError: Access Denied" or "task failed to start" along with a timestamp and the task ID. This is the first place an engineer should look because it directly records the reason ECS could not run the task.
- ✓
Validate that the task definition JSON is correctly formatted and references the correct container images.
Why this is correct
An invalid task definition — such as malformed JSON, a missing 'image' key, or a tag that doesn't exist in the repository — will cause ECS to reject the definition or the container to exit immediately. The validation check should confirm that the 'image' field adheres to the registry/repository:tag format and that the referenced image is actually present. Catching this early avoids time spent troubleshooting the cluster when the failure originates at definition parse time.
- ✗
Check the CloudFormation stack events for the ECS service.
Why it's wrong here
CloudFormation stack events describe the creation, update, and deletion of infrastructure resources defined in a template — they do not expose container-level runtime state. In a CodePipeline-to-ECS deployment, the ECS service and task are updated via the ECS deploy action, not through a CloudFormation stack, so there are no stack events tied to the task start failure. Relying on this would go down the wrong path because the failure is operational, not provisioning-related.
- ✓
Verify that the task execution IAM role has permissions to pull the container image from ECR.
Why this is correct
The task execution IAM role grants ECS the permission to call ECR API operations (ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, ecr:BatchCheckLayerAvailability) to pull the container image. If that role is missing a required ECR permission, the task will fail with an error resembling "CannotPullContainerError: Error response from daemon: pull access denied". Verifying the policy, and the role's trust relationship to the ECS service, is essential because the app's own 'task role' doesn't cover image pulls.
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.