Examkin

Question

Difficulty: MediumImplement Azure Event Grid Solutions

You are designing an integration solution that uses Azure Event Grid to route messages to a custom Webhook endpoint. You need to configure an Event Grid subscription for a custom topic with the following requirements:
- The subscription must write any events that cannot be delivered to an Azure Blob Storage container named undelivered.
- The subscription must authenticate to the Storage account using its own system-assigned managed identity to write the dead-lettered events.
- The Webhook endpoint must successfully receive events by completing the standard synchronous validation handshake during subscription creation.

Which set of configurations must you implement to meet these requirements?

  1. Configure the Webhook to return the validation code from the validation event payload in the response body. Enable the system-assigned managed identity on the Event Grid subscription and assign it the Storage Blob Data Contributor role on the Storage account.Answer
  2. B
    Configure the Webhook to respond with a HTTP 200 OK without a response body. Generate a Shared Access Signature (SAS) token at the container level with write permission and include it in the dead-letter destination configuration.
  3. C
    Configure the Webhook to return the validation code from the validation event payload in the response body. Enable a user-assigned managed identity on the Event Grid subscription, assign it the Storage Queue Data Message Sender role, and configure an Azure Queue Storage queue as the dead-letter destination.
  4. D
    Configure the Webhook to return the validation code from the validation event payload in the response body. Enable the system-assigned managed identity on the Event Grid subscription and assign it the Storage Blob Data Reader role on the Storage account.

Answer

Configure the Webhook to return the validation code from the validation event payload in the response body. Enable the system-assigned managed identity on the Event Grid subscription and assign it the Storage Blob Data Contributor role on the Storage account.
The configuration that returns the validation code from the validation event payload in the response body correctly completes the synchronous subscription handshake. Enabling the system-assigned managed identity and granting it the Storage Blob Data Contributor role provides the Event Grid subscription with the necessary write permissions to save dead-lettered events to the storage container.

Step-by-Step Solution

1
Implement the endpoint validation handshake logic in the Webhook API.
The Webhook parses the validation code from the validation event and returns it in the response body to successfully complete the synchronous handshake.
Event Grid requires subscribers to prove ownership of the endpoint before delivering events.
2
Enable the system-assigned managed identity on the Event Grid subscription resource.
An identity is registered in Microsoft Entra ID for the subscription.
This identity will be used to authenticate write requests to the Storage account without using credentials.
3
Assign the Storage Blob Data Contributor role to the managed identity on the destination Storage account or container.
The managed identity has write access to the Blob Storage container.
Event Grid dead-lettering requires write permissions to write failed delivery events to the designated blob container.

Key Concept

Azure Event Grid webhook endpoint validation and dead-lettering with managed identities.
Rate this question

Topics

Implement Azure Event Grid Solutions