Examkin

Question

Difficulty: HardImplement Application Insights Profiler, Snapshot Debugger, and Smart Detection

A development team implements Application Insights monitoring for a .NET 8.0 web API hosted on an Azure App Service using a Premium v3 plan. During testing, the team confirms that the Snapshot Debugger is enabled in the application configuration. However, when developers attempt to open a debug snapshot from an unhandled exception in the Azure portal, they are blocked by an access denied message. The developers already hold the Contributor role at the subscription level. Which of the following actions must be taken to allow the developers to view the debug snapshots?

  1. Assign the Application Insights Snapshot Debugger Access role to the developers' Microsoft Entra accounts.Answer
  2. B
    Assign the Monitoring Contributor role to the developers' Microsoft Entra accounts.
  3. C
    Configure the system-assigned managed identity of the App Service with the Storage Blob Data Reader role.
  4. D
    Scale the App Service plan to the Isolated v2 tier and enable diagnostics logging.

Answer

Assign the Application Insights Snapshot Debugger Access role to the developers' Microsoft Entra accounts.
The correct action is to assign the Application Insights Snapshot Debugger Access role to the developers' Microsoft Entra accounts. Azure restricts snapshot visibility because snapshots can capture sensitive personal or proprietary data in local variables during an exception. Even Subscription Owners and Contributors cannot view snapshots by default. They must be explicitly granted the Application Insights Snapshot Debugger Access role.

Step-by-Step Solution

1
Analyze the access requirement for Application Insights Snapshot Debugger snapshots.
Identify that debug snapshots contain sensitive application state, local variables, and memory dumps, requiring specialized access control beyond standard Contributor/Owner roles.
By design, Azure restricts access to snapshot data to protect potentially sensitive information stored in variables at the time of the exception.
2
Identify the specific RBAC role required to view the debug snapshots.
The correct role is the Application Insights Snapshot Debugger Access role.
This built-in role provides the necessary read permissions for Snapshot Debugger telemetry data.
3
Assign the role to the developers' accounts.
Assign the role at either the Subscription, Resource Group, or individual Application Insights resource level.
Role assignments propagate down to the Application Insights instance, granting portal access to the developers.

Key Concept

Snapshot Debugger RBAC Permissions
Rate this question

Topics

Implement Application Insights Profiler, Snapshot Debugger, and Smart Detection