DVA-C02 Troubleshooting and Optimization Practice Question
An application running on Amazon ECS with Fargate is unable to pull an image from Amazon ECR. The task definition uses the 'default' task execution role. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often confuse the task execution role with the task role, assuming the task role handles all permissions including image pulling, when in fact the task execution role is a separate IAM role specifically required for ECR image pulls and CloudWatch Logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The task execution role does not have permissions to pull from ECR.
When using Amazon ECS with Fargate, the task execution role (not the task role) is responsible for pulling container images from Amazon ECR. The 'default' task execution role is created automatically but lacks the necessary permissions (e.g., ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:BatchCheckLayerAvailability) unless explicitly attached via an IAM policy. Since the question states the task definition uses the 'default' task execution role, the most likely cause is that this role does not have the required ECR permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The task role does not have permissions to access ECR.
Why it's wrong here
The task role, also known as the task IAM role, is specifically designed to grant permissions to the application code running *inside* the container. These permissions allow the application to interact with other AWS services (e.g., S3, DynamoDB) during its runtime. It is not utilized by the underlying ECS agent or Fargate infrastructure to authenticate and pull container images from Amazon ECR; that function is handled by a different IAM role.
- ✗
The ECS cluster does not have permissions to access ECR.
Why it's wrong here
An Amazon ECS cluster is a logical grouping that organizes and manages your tasks or container instances. As a conceptual construct, the cluster itself does not possess or assume IAM permissions to perform actions like pulling container images. Instead, the necessary infrastructure-level permissions for operations such as image retrieval from ECR are assigned to specific IAM roles associated with the individual tasks or the underlying execution environment.
- ✗
The ECS service role does not have permissions to access ECR.
Why it's wrong here
The Amazon ECS service role (often automatically created as `AWSServiceRoleForECS`) is primarily used by the ECS service itself to make calls to other AWS services on your behalf. Its main functions include registering and deregistering tasks with a load balancer, managing service discovery, and scaling tasks. This role facilitates service-level orchestration and integration but is not involved in the process of authenticating and pulling container images for individual tasks.
- ✓
The task execution role does not have permissions to pull from ECR.
Why this is correct
The Amazon ECS task execution role grants permissions to the ECS agent or the Fargate infrastructure to perform essential actions on your behalf, *before* your application code even starts. This includes crucial operations such as pulling container images from Amazon ECR, pushing container logs to Amazon CloudWatch Logs, and retrieving sensitive data from AWS Secrets Manager or Parameter Store for image pull authentication. For successful image retrieval, this role specifically requires permissions like `ecr:GetDownloadUrlForLayer`, `ecr:BatchGetImage`, and `ecr:BatchCheckLayerAvailability` to authenticate and download image layers, without which the task launch will fail.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.