Examkin

Soru

Zorluk: Çok zorImplement Azure Event Grid Solutions

An organization is implementing a multi-tenant event-driven architecture using an Azure Event Grid Event Domain named `marketing-domain`. Each tenant is assigned a unique topic within the domain (for example, `marketing-domain/topics/tenant-alpha`) to isolate their marketing campaign events. You must grant a service principal representing `tenant-alpha` the minimum permissions required to create and manage their own event subscriptions within their topic, while strictly preventing them from managing or viewing subscriptions for other tenants' topics. Which configuration should you implement?

  1. A
    Assign the service principal the Event Grid Subscription Contributor role at the scope of the `marketing-domain` Event Domain and apply an advanced subject filter to the subscriptions.
  2. B
    Configure the webhook endpoint for tenant-alpha to perform a manual validation handshake by returning a subscription validation code to the domain-level control plane when subscriptions are requested.
  3. Assign the service principal the Event Grid Subscription Contributor role at the scope: `/subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.EventGrid/domains/marketing-domain/topics/tenant-alpha`Cevap
  4. D
    Assign the service principal the Event Grid Contributor role at the resource group scope and define an Azure Policy to block subscription creation for other topics.

Cevap

Assign the service principal the Event Grid Subscription Contributor role at the specific topic scope within the Event Domain.
The correct configuration is to assign the Event Grid Subscription Contributor role at the scope of the specific Event Domain topic. Azure Event Domains support granular RBAC scopes down to the individual topic level. This ensures that the tenant's service principal can only manage event subscriptions for their assigned topic, preventing access to other tenants' topics and satisfying the principle of least privilege.

Adım Adım Çözüm

1
Identify the target Event Grid resource structure and tenant boundary.
Each tenant uses a specific topic within the Event Domain (`marketing-domain/topics/tenant-alpha`).
Understanding the topic's resource path is required to apply role-based access control (RBAC) at the narrowest scope.
2
Determine the minimum built-in Azure RBAC role needed to manage subscriptions.
The Event Grid Subscription Contributor role is identified.
This role allows creating and managing event subscriptions without granting broader administrative control over the topic or domain.
3
Assign the role at the correct scope to enforce tenant isolation.
Assign the Event Grid Subscription Contributor role at the specific topic scope path.
Granting permissions at the `/subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.EventGrid/domains/marketing-domain/topics/tenant-alpha` scope prevents the service principal from viewing or interacting with other topics in the Event Domain.

Anahtar Kavram

Fine-grained role-based access control (RBAC) for Event Domain topics to isolate tenant subscriptions.
Bu soruyu puanla

Konular

Implement Azure Event Grid Solutions