Examkin

Soru

Zorluk: KolayImplement Azure Event Grid Solutions

You are configuring dead-lettering for an Azure Event Grid subscription that routes events for a customer portal. You must write dead-lettered events to an Azure Blob Storage container named `undelivered-events`. To meet corporate security compliance, you must use a system-assigned managed identity rather than access keys or SAS tokens. Which security configuration is required to allow Event Grid to write the dead-lettered events?

  1. Assign the Storage Blob Data Contributor role to the Event Grid system-assigned managed identity on the destination storage account.Cevap
  2. B
    Assign the Storage Blob Data Contributor role to a user-assigned managed identity enabled on the destination storage account.
  3. C
    Generate a Shared Access Signature (SAS) token with full permission scope at the storage account level and append it to the destination container URI.
  4. D
    Create an Azure Key Vault access policy that grants Secret Get permission to the Event Grid system-assigned managed identity.

Cevap

Assign the Storage Blob Data Contributor role to the Event Grid system-assigned managed identity on the destination storage account.
To allow Event Grid to write dead-lettered events using a system-assigned managed identity, you must assign the Storage Blob Data Contributor role to Event Grid's system-assigned managed identity at the storage account or container scope. This provides the minimal required permission to write block blobs.

Adım Adım Çözüm

1
Identify the identity used by Azure Event Grid.
The Event Grid subscription uses a system-assigned managed identity to authenticate.
This identity represents the Event Grid resource itself in Microsoft Entra ID.
2
Determine the required Azure RBAC role for writing blobs to Azure Storage.
The Storage Blob Data Contributor role is required.
This role allows the identity to perform write operations (such as uploading dead-letter events) on the container.
3
Grant the role assignment.
Assign the Storage Blob Data Contributor role to the Event Grid system-assigned managed identity at the storage account scope.
This authorizes Event Grid to securely write dead-letter events to the container without storing credentials.

Anahtar Kavram

Azure Event Grid dead-letter destination security using managed identity
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Implement Azure Event Grid Solutions