DOP-C02 Incident and Event Response Practice Question
A DevOps engineer receives an alert that an Amazon ECS service is failing to start tasks. The service uses the Fargate launch type. The task definition includes a container that requires port 8080. The security group associated with the service allows inbound traffic on port 8080. What should the engineer check NEXT?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the VPC subnets have a route to a NAT Gateway or Internet Gateway.
Fargate tasks require network connectivity to pull container images from ECR (or Docker Hub) and to send logs to CloudWatch. Without a route to a NAT Gateway (for private subnets) or an Internet Gateway (for public subnets), the task cannot pull the image and fails to start. Option B is incorrect: while the image must exist, the immediate symptom of tasks failing to start when the image is missing would be an 'image not found' error, not a generic failure; the security group already allows inbound traffic on port 8080, but outbound connectivity is the issue. Option C is incorrect: insufficient CPU/memory would cause tasks to enter a 'CPU exhausted' or 'memory exhausted' state, not prevent them from starting entirely. Option D is incorrect: the security group allows inbound traffic, but the issue is about egress connectivity for the task to reach the image registry.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify that the VPC subnets have a route to a NAT Gateway or Internet Gateway.
Why this is correct
Fargate tasks must download their container images from Amazon ECR before they enter the RUNNING state. If the service is configured to use private subnets that lack a route to a NAT Gateway (or a subnet with an Internet Gateway for public IPs), the task cannot establish outbound connectivity to the image registry, causing the deployment to hang in PROVISIONING and eventually fail. Verifying the subnet route tables for a 0.0.0.0/0 route to a NAT Gateway or IGW directly addresses the most likely cause of image pull failures.
- ✗
Confirm that the task definition's container image exists in ECR.
Why it's wrong here
Merely confirming that the container image exists in ECR does not diagnose a network-path issue; if the image were missing, the task definition would still be valid but the ECS agent would emit a distinct `CannotPullContainerError` indicating an unknown repository or tag. The image URI in the task definition is a static reference, and since the task definition was presumably registered successfully, the image is not the cause of tasks failing to start. This check is a red herring because it ignores the required data-plane connectivity between the task's elastic network interface and the ECR endpoint.
- ✗
Check if the task definition has sufficient CPU and memory allocated.
Why it's wrong here
The CPU and memory values declared in the task definition are used by the Amazon ECS scheduler for placement and by the runtime to enforce limits; they do not govern whether a Fargate task can reach the internet to pull its image. If the requested resources exceeded the Fargate maximum, task registration would fail with a validation error, and if they caused placement issues, you would see a capacity error rather than a generic 'task failed to start' alert. Therefore, adjusting CPU/memory would not resolve the underlying routing problem and is not the correct troubleshooting step.
- ✗
Review the security group rules for outbound traffic.
Why it's wrong here
Security group outbound rules are a stateful firewall layer that can block egress to ECR, but by default AWS creates security groups with an allow-all outbound rule, so a missing explicit outbound rule is rarely the cause of image pull failures. Even if the security group permitted all outbound traffic, that alone is insufficient because packets still need a valid route in the subnet's route table to reach a NAT Gateway or Internet Gateway. Reviewing outbound rules would thus be a secondary verification after confirming the subnet has a proper route, making it an incorrect first step.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,487 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.