Examkin

Question

Difficulty: Very hardImplement Azure Event Grid Solutions

You are designing a secure, event-driven solution in Azure. You have an Event Grid custom topic and a Webhook endpoint. You must route events from the custom topic to the Webhook endpoint.

To ensure reliability and security, you must meet the following requirements:
- If event delivery to the Webhook fails, events must be dead-lettered to an Azure Storage blob container.
- Event Grid must write the dead-letter events to the container using a system-assigned managed identity.
- The subscription must be successfully validated.

Which four actions should you perform in sequence to configure the solution? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  1. 1Enable a system-assigned managed identity on the Event Grid custom topic.
  2. 2Assign the Storage Blob Data Contributor role to the custom topic's managed identity on the destination storage account.
  3. 3Configure the Webhook endpoint to parse the incoming JSON array and return the validationCode from the subscription validation request.
  4. 4Create the Event Grid subscription, specifying the Webhook endpoint, the storage container for dead-lettering, and configuring the subscription to use the custom topic's identity for dead-letter delivery.

Answer

First, enable a system-assigned managed identity on the Event Grid custom topic. Second, assign the Storage Blob Data Contributor role to the custom topic's managed identity on the destination storage account. Third, configure the Webhook endpoint to parse the incoming JSON array and return the validationCode from the subscription validation request. Finally, create the Event Grid subscription, specifying the Webhook endpoint, the storage container for dead-lettering, and configuring the subscription to use the custom topic's identity for dead-letter delivery.
To set up the scenario securely and reliably, you must follow a dependency chain. First, you enable a system-assigned managed identity on the Event Grid custom topic so that the security principal exists in Microsoft Entra. Second, you assign the Storage Blob Data Contributor role to that newly created identity on the storage account, ensuring the permission is active. Third, you configure the Webhook endpoint application to handle the subscription validation handshake. Finally, you create the Event Grid subscription, which triggers both the synchronous Webhook handshake and the dead-letter write validation using the configured managed identity.

Step-by-Step Solution

1
Enable a system-assigned managed identity on the Event Grid custom topic.
A Microsoft Entra security principal is generated for the custom topic resource.
You must establish the identity principal before you can assign RBAC permissions to it.
2
Assign the Storage Blob Data Contributor role to the custom topic's managed identity on the storage account.
The identity principal is granted write permissions on the storage account blob service.
During the creation of the event subscription, Azure Event Grid performs a write validation check against the dead-letter destination. If the role is not already assigned, subscription creation will fail.
3
Configure the Webhook endpoint to parse the incoming JSON array and return the validationCode from the subscription validation request.
The Webhook application is ready to respond to Event Grid's validation handshake.
When the event subscription is created, Event Grid sends a synchronous HTTP POST validation request. If the endpoint does not return the code, the subscription fails to create.
4
Create the Event Grid subscription, specifying the Webhook endpoint, the storage container for dead-lettering, and configuring the subscription to use the custom topic's identity for dead-letter delivery.
The event subscription is created, the validation handshake completes successfully, and dead-lettering is secured.
This registers the subscription in Azure and initiates the synchronous validation and dead-letter permissions validation checks.

Key Concept

Azure Event Grid custom topic subscription lifecycle, including managed identities for dead-lettering and endpoint validation handshakes.
Estimated Time:3m 0s
Rate this question

Topics

Implement Azure Event Grid Solutions