Examkin

Question

Difficulty: HardImplement Azure Event Grid Solutions

A logistics company is building a real-time shipment tracking application. You are developing a REST API hosted in Azure App Service that will subscribe to transit update events from an Azure Event Grid custom topic. The REST API must receive events via a Webhook endpoint and securely authorize Event Grid to write dead-letter events to a private Azure Storage account.

Which two of the following configuration tasks or code implementations must you perform to establish the connection and handle validation?

  1. Implement code in the Webhook endpoint to respond to HTTP POST requests containing a validationCode by returning that code in a JSON object with the key validationResponse.Answer
  2. Enable a system-assigned managed identity for the Event Grid subscription or topic and assign it the Storage Blob Data Contributor role on the dead-letter storage account.Answer
  3. C
    Configure the Webhook endpoint to intercept HTTP GET requests from Event Grid and extract the validationCode from the query string parameters to perform manual validation.
  4. D
    Enable a user-assigned managed identity on the App Service hosting the Webhook and grant it the Storage Queue Data Message Sender role on the storage account.

Answer

To establish the connection and handle validation, you must implement code in the Webhook endpoint to respond to HTTP POST requests containing a validationCode by returning that code in a JSON object with the key validationResponse, and enable a system-assigned managed identity for the Event Grid subscription or topic and assign it the Storage Blob Data Contributor role on the dead-letter storage account.
For automatic endpoint validation, Event Grid sends an HTTP POST request to the Webhook endpoint with a validationCode in the body. The Webhook endpoint must respond with the validationCode in a JSON structure under the validationResponse key. For dead-lettering, Event Grid writes the failed delivery events as blobs to a storage account. The subscription or topic requires a managed identity that has the Storage Blob Data Contributor role assigned on that storage account.

Step-by-Step Solution

1
Handle Webhook handshake validation by implementing code to listen for HTTP POST requests containing a SubscriptionValidationEvent.
The endpoint successfully responds with a JSON object containing the validationResponse field set to the validationCode.
Event Grid performs an automatic handshake validation when the Webhook subscription is created.
2
Create a managed identity for the Event Grid subscription or custom topic.
Event Grid now has an identity that Microsoft Entra ID can authenticate.
A managed identity is needed to authorize Event Grid to write to resources secured by Microsoft Entra ID.
3
Grant the managed identity the Storage Blob Data Contributor role on the dead-letter destination Storage Account.
Event Grid has permission to write events to the storage account's blob container when delivery fails.
Event Grid dead-lettering requires blob write access (Storage Blob Data Contributor) to store undelivered events.

Key Concept

Azure Event Grid Webhook validation and dead-lettering authorization using managed identities.
Rate this question

Topics

Implement Azure Event Grid Solutions