Examkin

Soru

Zorluk: OrtaImplement Azure Queue Storage Solutions

You are developing a C# background service that runs on an Azure Virtual Machine and processes data files. The service needs to authenticate to an Azure Queue Storage queue named tasks-queue and enqueue processing tasks. Some task payloads are estimated to be around 128 KB128\text{ KB} in size. You must ensure that the solution adheres to the principle of least privilege, uses passwordless authentication where possible, and handles the task payloads successfully.

Which of the following designs should you implement?

  1. Authenticate the queue client using a system-assigned managed identity via DefaultAzureCredential, store the 128 KB128\text{ KB} payloads in Azure Blob Storage, and write the blob reference URL as the queue message.Cevap
  2. B
    Authenticate the queue client using a system-assigned managed identity via DefaultAzureCredential, and write the raw 128 KB128\text{ KB} payload directly to the queue as a single message.
  3. C
    Authenticate the queue client using an account-level Shared Access Signature (SAS) token configured with full read, write, and delete permissions for the entire storage account.
  4. D
    Authenticate the queue client using a system-assigned managed identity that is shared across multiple independent Azure Virtual Machines running the background service.

Cevap

Authenticate the queue client using a system-assigned managed identity via DefaultAzureCredential, store the 128 KB128\text{ KB} payloads in Azure Blob Storage, and write the blob reference URL as the queue message.
The correct design uses a system-assigned managed identity via DefaultAzureCredential to securely connect to the queue without credentials stored in code, satisfying the least privilege and passwordless requirements. Since the payload size is 128 KB128\text{ KB} and exceeds the 64 KB64\text{ KB} hard limit of Azure Queue Storage, the payload is offloaded to Azure Blob Storage, and a reference URL is written to the queue instead (the claim-check pattern).

Adım Adım Çözüm

1
Analyze the payload size constraint.
Since 128 KB128\text{ KB} exceeds the 64 KB64\text{ KB} Azure Queue Storage message size limit, the claim-check pattern must be used.
Azure Queue Storage cannot accept messages larger than 64 KB64\text{ KB} directly.
2
Determine the authentication method conforming to least privilege.
A system-assigned managed identity via DefaultAzureCredential provides passwordless, scope-restricted authentication.
Managed identities avoid stored credentials and can be restricted to specific resources using Azure RBAC.
3
Verify identity sharing constraints.
A system-assigned managed identity is tied strictly to one VM instance and cannot be shared across multiple resources.
To share an identity across multiple VMs, a user-assigned managed identity would be required instead.

Anahtar Kavram

Handling large message payloads via Blob Storage and secure access using managed identities in Azure Queue Storage
Bu soruyu puanla

Konular

Implement Azure Queue Storage Solutions