Examkin

Question

Difficulty: MediumImplement Azure Event Hubs Solutions

A telemetry processing application runs as a C# worker service on Azure Container Apps. The application uses the EventProcessorClient from the Azure.Messaging.EventHubs.Processor library to consume messages from an Azure Event Hub and uses an Azure Blob Storage container for checkpointing. The Container App is configured to use a user-assigned managed identity. During testing, you observe that partition ownership cannot be established, and checkpointing fails with access and lease errors. Which two actions must you perform to configure the storage client and resolve these issues? (Select two.)

  1. Assign the Storage Blob Data Contributor role to the user-assigned managed identity on the storage container.Answer
  2. Initialize the BlobContainerClient using DefaultAzureCredential configured with the client ID of the user-assigned managed identity.Answer
  3. C
    Implement custom lease-handling logic using BlobLeaseClient to manually release leases on partition blobs after each event batch is processed.
  4. D
    Configure the EventProcessorClient using a system-assigned managed identity while passing the client ID of the user-assigned managed identity to the token credential options.

Answer

To resolve the checkpointing issues, you must assign the Storage Blob Data Contributor role to the user-assigned managed identity on the storage container and initialize the BlobContainerClient using DefaultAzureCredential configured with the client ID of the user-assigned managed identity.
To enable EventProcessorClient checkpointing, the user-assigned managed identity requires data-plane write access (Storage Blob Data Contributor) on the container to write lease and checkpoint metadata. Additionally, because the application utilizes a user-assigned managed identity, the developer must explicitly specify the client ID in DefaultAzureCredentialOptions to ensure the correct identity is resolved.

Step-by-Step Solution

1
Assign the appropriate data-plane role to the identity.
The user-assigned managed identity receives permission to read, write, and delete blobs inside the container.
The EventProcessorClient uses blobs inside the container to track ownership and store checkpoint markers.
2
Configure the token credential with the client ID of the user-assigned managed identity.
The identity is correctly resolved during runtime authentication rather than failing or reverting to a system-assigned identity.
User-assigned managed identities are not automatically selected by default credential configurations and must be targeted via their client ID.
3
Initialize the EventProcessorClient using the properly authenticated BlobContainerClient.
The processor successfully coordinates partition ownership across instances and records checkpoint offsets without lease or permission failures.
A properly configured container client provides the backend storage access required by the event processor.

Key Concept

Configuring EventProcessorClient storage checkpointing with user-assigned managed identities and Azure RBAC roles.
Rate this question

Topics

Implement Azure Event Hubs Solutions