Examkin

Question

Difficulty: HardImplement Azure Event Grid Solutions

You are implementing an integration using Azure Event Grid. You have created an Azure Storage account named logstor with a blob container named deadletter to store events that cannot be delivered.

You need to configure a new Event Grid custom topic and an event subscription. The setup must meet the following requirements:
- All events that fail to deliver must be sent to the deadletter container.
- The custom topic must authenticate to the storage account using a system-assigned managed identity.
- No storage account access keys or connection strings can be stored in the configuration.

Which sequence of steps should you perform to configure the custom topic and subscription?

  1. 1Create the Event Grid custom topic.
  2. 2Configure the custom topic to use a system-assigned identity.
  3. 3Assign the Storage Blob Data Contributor role to the custom topic's identity at the scope of the storage account.
  4. 4Create the event subscription on the custom topic, specifying the dead-letter container and selecting the system-assigned identity.

Answer

The correct sequence of steps is to first create the Event Grid custom topic, configure it to use a system-assigned identity, assign the Storage Blob Data Contributor role to the topic's identity at the scope of the storage account, and finally create the event subscription specifying the dead-letter container and selecting the system-assigned identity.
To securely configure dead-lettering using a system-assigned managed identity, the custom topic must be created first to act as the host for the identity. The system-assigned identity is then enabled on the custom topic, which creates its corresponding enterprise application representation in Microsoft Entra ID. Next, this identity must be granted the Storage Blob Data Contributor role on the destination storage account scope to permit writing events. Finally, the event subscription is created, referencing the dead-letter container and designating the system-assigned managed identity for authentication.

Step-by-Step Solution

1
Create the Event Grid custom topic.
A new custom topic resource is provisioned in Azure.
The custom topic is the parent resource that hosts the managed identity.
2
Configure the custom topic to use a system-assigned identity.
Azure creates an identity for the custom topic in Microsoft Entra ID.
The identity must exist in Microsoft Entra ID before RBAC roles can be assigned to it.
3
Assign the Storage Blob Data Contributor role to the custom topic's identity at the scope of the storage account.
The custom topic's managed identity receives write permissions to the blob storage.
Azure Event Grid validates access to the dead-letter container when the event subscription is created.
4
Create the event subscription on the custom topic, specifying the dead-letter container and selecting the system-assigned identity.
The subscription is successfully created and active.
The subscription is the final resource configured to route events and handle dead-lettering.

Key Concept

Configuring Event Grid dead-lettering with managed identities requires creating the parent resource, establishing its identity, granting appropriate storage roles, and then creating the subscription referencing both the dead-letter destination and the identity.
Rate this question

Topics

Implement Azure Event Grid Solutions