DVA-C02 Deployment Practice Question
A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS with Fargate. The pipeline has a deploy stage that uses Amazon ECS Blue/Green deployment. The deployment fails intermittently with a 'Task failed to start' error. The developer needs to troubleshoot the issue. Which THREE steps should the developer take? (Choose three.)
⚠ Common exam trap
The trap is chasing the build stage (CodeBuild logs) or stack-level tooling (CloudFormation events) when the failure is at ECS task startup — candidates must recognize that ECS service events and the execution role are the authoritative sources for 'task failed to start'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the Amazon ECS service events for the task failure reason.
Option B is correct because Amazon ECS service events provide the most direct diagnostic messages for tasks that fail to start, including reasons such as image pull failures, resource constraints, or unhealthy load balancer targets. Option C is correct because a malformed task definition JSON or an incorrect container image reference will prevent ECS from launching the task, producing exactly the 'Task failed to start' symptom. Option E is correct because the task execution IAM role must have permissions such as ecr:GetAuthorizationToken and ecr:BatchGetImage to pull the image from ECR; missing permissions cause task startup failures. Option A is not appropriate because CodeBuild logs relate to the build stage, not the ECS deploy stage where the task fails to start. Option D is not appropriate because the pipeline uses Amazon ECS Blue/Green deployment, not a CloudFormation stack, so CloudFormation stack events would not explain the ECS task failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Review the CodeBuild build logs for errors.
Why it's wrong here
CodeBuild logs capture build-time commands, test output, and artifact generation — all of which occur before the pipeline enters the deploy stage. An ECS task failing to start is a runtime infrastructure issue that happens after the artifact has been pushed; build logs will typically show a successful build followed by deployment steps that don't contain container launch details. They are useful for catching compile errors but cannot report why ECS was unable to place or start the task.
- ✓
Check the Amazon ECS service events for the task failure reason.
Why this is correct
The Amazon ECS service events tab is the authoritative source for recent service-level warnings and alarms, including deployment failures and stopped tasks. Each event often contains the exact error such as "CannotPullContainerError: Access Denied" or "task failed to start" along with a timestamp and the task ID. This is the first place an engineer should look because it directly records the reason ECS could not run the task.
- ✓
Validate that the task definition JSON is correctly formatted and references the correct container images.
Why this is correct
An invalid task definition — such as malformed JSON, a missing 'image' key, or a tag that doesn't exist in the repository — will cause ECS to reject the definition or the container to exit immediately. The validation check should confirm that the 'image' field adheres to the registry/repository:tag format and that the referenced image is actually present. Catching this early avoids time spent troubleshooting the cluster when the failure originates at definition parse time.
- ✗
Check the CloudFormation stack events for the ECS service.
Why it's wrong here
CloudFormation stack events describe the creation, update, and deletion of infrastructure resources defined in a template — they do not expose container-level runtime state. In a CodePipeline-to-ECS deployment, the ECS service and task are updated via the ECS deploy action, not through a CloudFormation stack, so there are no stack events tied to the task start failure. Relying on this would go down the wrong path because the failure is operational, not provisioning-related.
- ✓
Verify that the task execution IAM role has permissions to pull the container image from ECR.
Why this is correct
The task execution IAM role grants ECS the permission to call ECR API operations (ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, ecr:BatchCheckLayerAvailability) to pull the container image. If that role is missing a required ECR permission, the task will fail with an error resembling "CannotPullContainerError: Error response from daemon: pull access denied". Verifying the policy, and the role's trust relationship to the ECS service, is essential because the app's own 'task role' doesn't cover image pulls.
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.