Examkin

Question

Difficulty: HardCreate and Configure Azure Functions

You are designing an Azure Function App that must process files uploaded to an Azure Blob Storage container. The requirements are as follows:
- The processing of each file can take up to 20 minutes to complete.
- The storage account is secured behind an Azure Virtual Network (VNet) and does not allow public internet access.
- The Function App must authenticate to the storage account using a user-assigned managed identity named `fn-storage-identity`.
- The solution must scale dynamically based on the volume of incoming uploads.

Which combination of hosting plan and connection settings should you configure?

  1. A
    Deploy the Function App on a Consumption plan. Set the application settings StorageConnection__blobServiceUri to the storage account blob endpoint, StorageConnection__credential to managedidentity, and StorageConnection__clientId to the client ID of fn-storage-identity.
  2. B
    Deploy the Function App on a Premium plan. Set the application settings StorageConnection__blobServiceUri to the storage account blob endpoint, StorageConnection__credential to managedidentity, and omit the client ID configuration.
  3. Deploy the Function App on a Premium plan. Set the application settings StorageConnection__blobServiceUri to the storage account blob endpoint, StorageConnection__credential to managedidentity, and StorageConnection__clientId to the client ID of fn-storage-identity.Answer
  4. D
    Deploy the Function App on a Premium plan. Configure the connection setting StorageConnection to reference the storage account connection string stored in Azure Key Vault using the syntax @Microsoft.KeyVault(SecretUri=...) without configuring an access policy or Role-Based Access Control (RBAC) role for the Function App's identity on the Key Vault.

Answer

Deploy the Function App on a Premium plan, and configure the connection settings using the blob service URI, the managedidentity credential, and the client ID of the user-assigned managed identity.
The correct configuration uses the Premium plan, which supports both virtual network integration (required to access the VNet-secured storage account) and execution durations longer than 10 minutes (the default is 30 minutes, and can be configured as unbounded). Additionally, for a user-assigned managed identity, configuring the Client ID parameter is mandatory to distinguish it from a system-assigned managed identity.

Step-by-Step Solution

1
Analyze hosting plan requirements based on execution duration and networking constraints.
The Consumption plan is eliminated due to its 10-minute maximum timeout and lack of VNet integration support. The Premium plan is selected because it supports both VNet integration and longer/unbounded execution times.
Azure Functions must run on a plan that supports VNet access to reach the secured storage account, and support a 20-minute execution duration.
2
Determine the required identity-based connection configuration for the user-assigned managed identity.
To use a user-assigned identity for the storage connection, you must set the endpoint URI, specify the credential type as managedidentity, and provide the client ID of the identity.
The client ID is necessary for the runtime to locate the correct user-assigned identity associated with the Function App; otherwise, it will default to a system-assigned identity.
3
Evaluate Key Vault permission requirements for key vault references.
Confirm that any Key Vault secret references require the Function App's identity to have access policies or Azure RBAC permissions to read the secrets.
Merely pointing to a Key Vault secret URI in app settings is insufficient; access must be explicitly authorized.

Key Concept

Azure Functions hosting plans and identity-based connection configuration for user-assigned managed identities.
Rate this question

Topics

Create and Configure Azure Functions

More questions from this topic