Examkin

Soru

Zorluk: Çok zorImplement Azure Event Grid Solutions

An organization is implementing a cloud-based event-driven architecture using Azure Event Grid. You are tasked with creating an event subscription for a custom Event Grid topic that forwards events to an external, third-party REST API via a Webhook.

The architecture has the following constraints and requirements:
1. Endpoint Validation: The third-party API processes incoming requests asynchronously. Upon receiving a request, it immediately returns an HTTP status code of 202 Accepted and does not support returning a JSON response body synchronously.
2. Dead-Lettering: Any events that fail to deliver must be stored in a secure Azure Blob Storage container named 'deadletters'. You must avoid storing any static credentials or SAS tokens in the subscription configuration.

Which of the following configuration strategies should you implement to satisfy these requirements?

  1. A
    Configure the webhook to parse the synchronous validation handshake request and return the validationCode in the response headers of the HTTP 202 Accepted response, and configure dead-lettering using the custom topic's system-assigned managed identity with the Storage Blob Data Contributor role on the storage account.
  2. Capture the SubscriptionValidationEvent sent to the webhook, extract the validationUrl, send an HTTP GET request to that URL within 10 minutes, and configure dead-lettering by enabling a system-assigned managed identity on the custom topic and granting it the Storage Blob Data Contributor role on the storage account.Cevap
  3. C
    Capture the SubscriptionValidationEvent sent to the webhook, extract the validationUrl, send an HTTP GET request to that URL within 10 minutes, and configure dead-lettering by enabling a system-assigned managed identity on the destination storage account and granting the custom topic Reader permissions to it.
  4. D
    Capture the SubscriptionValidationEvent sent to the webhook, extract the validationUrl, send an HTTP GET request to that URL within 10 minutes, and configure dead-lettering by appending an account-level SAS token with full Read, Write, Delete, and List permissions valid for 10 years to the storage container URI.

Cevap

To satisfy the requirements, perform manual validation by capturing the SubscriptionValidationEvent, extracting the validationUrl, and sending an HTTP GET request to that URL within 10 minutes. For dead-lettering, enable a system-assigned managed identity on the Event Grid custom topic and grant it the Storage Blob Data Contributor role on the destination storage account.
The correct strategy implements manual (asynchronous) validation by parsing the SubscriptionValidationEvent sent to the webhook, extracting the validationUrl, and sending an HTTP GET request to it within 10 minutes. For credential-free dead-lettering, a system-assigned managed identity is enabled on the custom topic, and it is assigned the Storage Blob Data Contributor role on the destination storage account to grant Event Grid the necessary write permissions.

Adım Adım Çözüm

1
Determine the endpoint validation type based on the response behavior.
Since the webhook endpoint returns HTTP 202 Accepted synchronously and does not return the validationCode in the body, synchronous validation is impossible. An asynchronous (manual) validation handshake must be used.
Event Grid synchronous validation fails if the endpoint does not return a JSON payload containing the validationResponse synchronously within the body of a successful HTTP response.
2
Complete the manual validation handshake.
Retrieve the validationUrl from the Microsoft.EventGrid.SubscriptionValidationEvent payload received by the webhook, and perform an HTTP GET request to that URL.
Performing an HTTP GET request to the validationUrl validates the endpoint ownership and activates the event subscription. The URL is valid for 10 minutes.
3
Identify the credential-free authentication mechanism for dead-lettering.
Select managed identities as the authentication mechanism for accessing the Azure Blob Storage account.
Managed identities allow Azure resources to authenticate securely without storing credentials in the code or deployment configurations.
4
Configure the managed identity and assign appropriate roles.
Enable a system-assigned managed identity on the Event Grid custom topic. Assign the 'Storage Blob Data Contributor' role to the topic's managed identity on the target storage account.
The Event Grid topic requires write permissions (Storage Blob Data Contributor) to upload and write dead-lettered events to the storage container. Reader permissions or configuring the identity on the storage account itself will fail.

Anahtar Kavram

Azure Event Grid manual webhook validation and secure dead-lettering configuration using managed identities
Bu soruyu puanla

Konular

Implement Azure Event Grid Solutions