Refer to the exhibit. An ML engineer creates a CloudFormation stack with this template. The stack creation succeeds, but when the engineer tries to invoke the endpoint, it returns a ModelError. The CloudWatch logs show that the container exited with error. What is the MOST likely cause?
The role must have ECR permissions to pull the image; if missing, the container fails to start.
Why this answer
The CloudFormation template likely does not grant the SageMaker execution role the necessary `ecr:GetDownloadUrlForLayer` and `ecr:BatchGetImage` permissions to pull the container image from Amazon ECR. Without these permissions, the SageMaker service cannot download the Docker image to the ML compute instances, causing the container to fail with a ModelError and exit error in CloudWatch logs.
Exam trap
The trap here is that candidates often assume a ModelError is always due to model artifacts or code issues, but in CloudFormation deployments, the most frequent cause is missing ECR permissions for the execution role, especially when the image is in a different account or the role is not explicitly granted pull access.
How to eliminate wrong answers
Option B is wrong because the initial instance count of 2 is not inherently insufficient; SageMaker can scale horizontally, and a ModelError with container exit is not caused by instance count but by the container failing to start. Option C is wrong because the endpoint does not need to be in a VPC to access S3; SageMaker endpoints can access S3 via the internet or VPC endpoints, and the error is a container exit, not a network timeout. Option D is wrong because CloudFormation creates resources in dependency order; the EndpointConfig references the Model, and if the Model were not created, the stack creation would fail, not succeed.