Examkin

Question

Difficulty: Very hardImplement Azure Service Bus Solutions

You are developing a .NET background service that processes high-value medical prescription renewal messages from an Azure Service Bus queue named `prescriptions-queue`. The system has the following requirements:

1. Messages must be processed reliably; if the application crashes or restarts while a message is being processed, the message must not be lost and must be made available for reprocessing.
2. The application must authenticate to the Service Bus namespace using a managed identity that has an independent lifecycle from the hosting Azure resource.
3. The identity must follow the principle of least privilege, with permissions scoped directly to the queue rather than the entire namespace or resource group.

Which combination of Azure Role-Based Access Control (RBAC) role assignment and code implementation should you use?

  1. A
    Assign the Azure Service Bus Data Receiver role to a System-Assigned Managed Identity at the resource group scope. In code, instantiate the ServiceBusClient using DefaultAzureCredential without specifying a client ID, and create the ServiceBusProcessor using ServiceBusProcessorOptions set to ServiceBusReceiveMode.PeekLock.
  2. Assign the Azure Service Bus Data Receiver role to the User-Assigned Managed Identity at the queue scope. In code, instantiate the ServiceBusClient using DefaultAzureCredential configured with the identity's client ID, and create the ServiceBusProcessor using ServiceBusProcessorOptions set to ServiceBusReceiveMode.PeekLock.Answer
  3. C
    Assign the Azure Service Bus Data Receiver role to the User-Assigned Managed Identity at the queue scope. In code, instantiate the ServiceBusClient using DefaultAzureCredential configured with the identity's client ID, and create the ServiceBusProcessor using ServiceBusProcessorOptions set to ServiceBusReceiveMode.ReceiveAndDelete.
  4. D
    Generate a Shared Access Signature (SAS) token at the Service Bus Namespace level with Manage, Send, and Listen permissions. In code, instantiate the ServiceBusClient using the namespace connection string containing the SAS token, and create the ServiceBusProcessor using ServiceBusProcessorOptions set to ServiceBusReceiveMode.PeekLock.

Answer

Assign the Azure Service Bus Data Receiver role to the User-Assigned Managed Identity at the queue scope. In code, instantiate the ServiceBusClient using DefaultAzureCredential configured with the identity's client ID, and create the ServiceBusProcessor using ServiceBusProcessorOptions set to ServiceBusReceiveMode.PeekLock.
The correct implementation requires assigning the 'Azure Service Bus Data Receiver' role directly to the User-Assigned Managed Identity at the queue scope. This meets the least privilege principle and the independent lifecycle criteria. In the code, configuring DefaultAzureCredential with the specific user-assigned client ID and setting the processor to PeekLock mode ensures that if the background service crashes during processing, the lock will time out and the message will safely reappear on the queue for subsequent processing.

Step-by-Step Solution

1
Select the correct identity model for lifecycle requirements.
Identify that a User-Assigned Managed Identity must be used.
The scenario requires the identity to have an independent lifecycle from the hosting resource, which matches User-Assigned rather than System-Assigned.
2
Apply the least privilege principle for Azure Service Bus RBAC.
Assign the 'Azure Service Bus Data Receiver' role scoped strictly to the queue 'prescriptions-queue'.
Scoping the role to the queue rather than the namespace or resource group satisfies the minimum required scope for consuming messages.
3
Configure the client and processor for message durability.
Instantiate the client with DefaultAzureCredential pointing to the user identity's client ID and use PeekLock receive mode.
Specifying the client ID targets the correct User-Assigned Identity. PeekLock ensures that messages are locked, processed, and explicitly settled (completed), preventing message loss if the application crashes.

Key Concept

Configuring passwordless Managed Identity authentication and PeekLock receive reliability for Azure Service Bus processing.
Rate this question

Topics

Implement Azure Service Bus Solutions