Examkin

Question

Difficulty: MediumImplement Azure Event Hubs Solutions

You are developing a C# background service that processes high-volume telemetry data from an Azure Event Hub using the EventProcessorClient class. The background service runs across multiple instances in an Azure App Service plan, and you must use Azure Blob Storage for checkpointing and load balancing partition ownership. Some telemetry payloads can occasionally exceed 64 KB. You need to configure the authentication and storage access for the application while ensuring it can handle the payload sizes and follow security best practices. Which configuration and authentication approach should you implement to meet these requirements?

  1. A
    Configure the EventProcessorClient to store checkpoints in Azure Queue Storage because Queue Storage natively supports telemetry payloads larger than 64 KB and automatically manages partition distribution.
  2. B
    Initialize the EventProcessorClient using a system-assigned managed identity, share the identity client ID across separate applications with different lifecycles, and grant the identity the Azure Event Hubs Data Receiver and Storage Queue Data Contributor roles.
  3. Initialize the EventProcessorClient using a user-assigned managed identity that is granted the Azure Event Hubs Data Receiver role on the Event Hub and the Storage Blob Data Contributor role on the Azure Blob Storage account.Answer
  4. D
    Initialize the EventProcessorClient and implement custom logic using BlobLeaseClient to manually acquire and release leases on the checkpoint blob container whenever the PartitionInitializingAsync event is raised.

Answer

Initialize the EventProcessorClient using a user-assigned managed identity that is granted the Azure Event Hubs Data Receiver role on the Event Hub and the Storage Blob Data Contributor role on the Azure Blob Storage account.
The correct approach is to initialize the EventProcessorClient using a user-assigned managed identity, which can be shared across multiple scaled App Service instances. This identity must be granted the Azure Event Hubs Data Receiver role to pull events from the Event Hub, and the Storage Blob Data Contributor role to allow the processor to manage lease blobs and store checkpoints in Azure Blob Storage.

Step-by-Step Solution

1
Select the appropriate managed identity type.
A user-assigned managed identity is chosen to enable credential sharing across multiple scaled App Service instances under a shared identity lifecycle.
System-assigned identities are tied to a single resource and cannot be shared across separate services.
2
Grant the necessary role-based access control (RBAC) roles.
The identity is assigned the Azure Event Hubs Data Receiver role on the Event Hub namespace or instance, and the Storage Blob Data Contributor role on the storage account containing the checkpoint container.
The client must be authorized to pull telemetry events and to read/write state checkpoint files and ownership lease blobs.
3
Initialize the EventProcessorClient in code.
Initialize the client using the EventProcessorClient constructor, passing the BlobContainerClient initialized with the DefaultAzureCredential configured for the user-assigned identity.
Allows the EventProcessorClient to automatically balance partitions and write checkpoint data securely using the specified identity.

Key Concept

Configuring secure authentication and checkpoint storage for Azure Event Hubs EventProcessorClient using Azure Blob Storage and RBAC.
Rate this question

Topics

Implement Azure Event Hubs Solutions