SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company has a CI/CD pipeline that builds and deploys a containerized application to Amazon ECS Fargate. The pipeline uses AWS CodeBuild to run tests and build Docker images. Recently, the pipeline has been failing intermittently with the error 'CannotPullContainerError: Error response from daemon: manifest for <image> not found'. The image is stored in Amazon ECR. The team suspects the issue is related to image tag inconsistency. The pipeline tags images with the commit hash. Which change will prevent this error?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure the pipeline builds and pushes the image with a unique tag, such as the commit hash, and uses that tag in the ECS task definition.
Ensuring that the image tag is unique and not reused prevents stale image references. Using the commit hash ensures uniqueness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the Docker image in Amazon S3 instead of ECR.
Why it's wrong here
ECS Fargate task definitions pull images from a container registry using Docker registry credentials; S3 cannot serve as a Docker registry, so the pull would fail outright. It is tempting as cheap object storage, and suits static artefacts or build context, but not image distribution to Fargate.
- ✓
Ensure the pipeline builds and pushes the image with a unique tag, such as the commit hash, and uses that tag in the ECS task definition.
Why this is correct
ECS resolves the image by the exact tag in the task definition. Pushing with the commit hash and referencing that same tag guarantees the manifest exists in Amazon ECR, eliminating the intermittent CannotPullContainerError caused by tag mismatch.
- ✗
Use the 'latest' tag for all images.
Why it's wrong here
The 'latest' tag is mutable, so ECS Fargate may resolve it to a digest that no longer exists or differs from the tested build, leaving the manifest-not-found error unresolved. It is tempting for convenience, and suits local development, but the pipeline already tags immutable commit hashes, which is the correct practise.
- ✗
Retry the failed pipeline step after a delay.
Why it's wrong here
A retry does not create the missing manifest; if the deploy references a commit-hash tag that was never pushed to ECR, the pull fails identically each attempt. It is tempting because the failure is intermittent, and retries suit transient network or throttling errors, not a genuinely absent image tag.
About these practice questions
One of 984 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.