Examkin

Question

Difficulty: MediumImplement Azure Event Hubs Solutions

A health monitoring system uses Azure Event Hubs to collect real-time patient telemetry. You are configuring a .NET host application to consume these events using the EventProcessorClient class. You create an Azure Blob Storage container to serve as the checkpoint store. The application is configured to authenticate using a system-assigned managed identity that has been granted the Storage Blob Data Reader role on the storage container. When the application starts, it throws an exception during initialization because it cannot acquire partition leases. You need to ensure the application can successfully coordinate partition ownership and write checkpoints. Which action should you perform?

  1. A
    Configure the application to use an Azure Queue Storage queue as the checkpoint store and grant the identity the Storage Queue Data Contributor role.
  2. Grant the system-assigned managed identity the Storage Blob Data Contributor role on the storage container.Answer
  3. C
    Reconfigure the application to use a user-assigned managed identity, as system-assigned managed identities cannot be authorized for lease operations.
  4. D
    Initialize a BlobLeaseClient in the application startup code to manually release any active partition leases before starting the event processor.

Answer

Grant the system-assigned managed identity the Storage Blob Data Contributor role on the storage container.
The correct answer provides the necessary permissions for the EventProcessorClient to interact with the checkpoint store. Because the processor needs to create checkpoints and acquire/renew leases on partition ownership blobs, it requires read, write, and delete permissions on the container's blobs. The Storage Blob Data Contributor role grants these data plane permissions, resolving the authorization error.

Step-by-Step Solution

1
Identify the cause of the lease acquisition failure.
The EventProcessorClient relies on Azure Blob Storage to coordinate partition ownership (via blob leases) and track progress (via checkpoint blobs).
This establishes that the application must perform write, update, and delete actions on blobs in the storage container.
2
Evaluate the current Azure RBAC role assignments.
The system-assigned managed identity only has the Storage Blob Data Reader role, which permits reading but denies write and delete operations.
This explains why the client application throws an authorization exception when attempting to acquire or update partition ownership leases.
3
Determine the minimum required role that permits lease management.
The Storage Blob Data Contributor role provides full data-plane access to read, write, and delete blobs, fulfilling the minimum requirements of the EventProcessorClient.
Applying this role to the managed identity resolves the initialization exception while maintaining the principle of least privilege.

Key Concept

Azure Event Hubs EventProcessorClient storage requirements and Azure RBAC role configurations
Rate this question

Topics

Implement Azure Event Hubs Solutions