Tüm alıştırma soruları

972 soru

Tüm türler972 Çoktan seçmeli497 Çoklu seçim269 Eşleştirme9 Sıralama171 Boşluk doldurma26

An administrator needs to configure an Azure CDN Standard from Microsoft endpoint to use a custom domain secured with a custom TLS certificate stored in Azure Key Vault. The configuration must be completed successfully with minimum delay, and all validation checks must succeed. What is the correct order of steps to configure the custom domain and TLS certificate?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order is: (1) Register the Azure CDN service principal in Microsoft Entra ID. (2) Configure the Key Vault access policy to grant the service principal permissions. (3) Create the DNS CNAME record. (4) Add the custom domain to the CDN endpoint. (5) Enable HTTPS on the custom domain and select the certificate from Key Vault.

The configuration must follow a strict dependency path: The Azure CDN service principal must be registered in Microsoft Entra ID first so that it can be granted access to the Key Vault. The DNS CNAME record must be created prior to adding the custom domain to the CDN endpoint to pass the domain ownership validation check. Finally, once the custom domain is registered and Key Vault permissions are established, HTTPS can be enabled using the custom certificate.

Adım Adım Çözüm

The Azure CDN service principal identity is created and recognized within the tenant.

The service principal must exist in the directory before you can reference it in Key Vault access policies.

Create a Key Vault access policy that grants the Azure CDN service principal Get permissions for certificates and secrets.

Azure CDN is authorized to retrieve certificates from the Key Vault.

Azure CDN needs these permissions to fetch and install the custom TLS certificate on the CDN edge servers.

Create a CNAME record with your DNS provider mapping the custom domain to the CDN endpoint.

DNS requests for the custom domain are routed to the CDN endpoint.

Azure CDN performs validation against the DNS CNAME record when adding the custom domain to ensure domain ownership.

Add the custom domain to the Azure CDN endpoint in the Azure Portal.

The custom domain is associated with the endpoint.

The domain must be associated with the endpoint before HTTPS can be configured for it.

Enable HTTPS on the custom domain, select 'Use my own certificate', and select the Key Vault, secret, and version.

The custom domain is secured with the custom TLS certificate.

This is the final step where Azure CDN retrieves the TLS certificate from Key Vault and deploys it to the edge nodes.

Anahtar Kavram

Configuring custom domains and TLS certificates from Azure Key Vault on Azure CDN endpoints.

Soru 842Soru →

You are configuring a custom domain with HTTPS enabled for an Azure CDN endpoint. You plan to use a CDN-managed certificate to secure the custom domain.

Arrange the steps in the correct order to configure and enable HTTPS for the custom domain on your Azure CDN endpoint.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with creating the CNAME record, adding the custom domain to the CDN endpoint, enabling HTTPS with CDN-managed certificate, allowing the automated domain validation to complete, and finally waiting for the provisioning and activation status to show Active.

The correct order requires creating the CNAME mapping first, registering the custom domain, enabling HTTPS with CDN-managed configuration, validating domain ownership, and waiting for the final propagation. This ensures that validation succeeds at each step without errors.

Adım Adım Çözüm

Create a CNAME record mapping the custom domain to the CDN endpoint.

DNS propagation of the mapping to the endpoint.

Ensures Azure CDN can verify the domain association in the next step.

Add the custom domain to the endpoint in the Azure portal.

The custom domain is registered and associated with the CDN endpoint.

Enables the domain to receive traffic routed through the CDN.

Enable Custom Domain HTTPS and select CDN managed certificate.

The HTTPS configuration workflow is initiated.

Tells Azure CDN to automatically manage the SSL/TLS certificate creation and renewal.

Let Azure CDN validate the domain ownership via CNAME.

Domain ownership is verified.

Necessary security check before issuing a public certificate.

Wait for the certificate to propagate and status to transition to Active.

HTTPS traffic to the custom domain is successfully encrypted.

Completes the SSL binding process across all global edge servers.

Anahtar Kavram

Configuring custom domain HTTPS using CDN-managed certificates on Azure CDN endpoints.

Soru 843Soru →

An organization is deploying a globally distributed .NET microservice that consumes telemetry using the Azure.Messaging.EventHubs SDK. The application uses EventProcessorClient with Azure Blob Storage as the checkpoint store. You are configuring authentication and concurrency management for the processor instances. Which TWO of the following configurations or architectural decisions are required for the EventProcessorClient to function correctly and scale dynamically?

Geçerli olan tümünü seçin

The target Blob container used for checkpointing must be created in the Azure Storage account prior to starting the EventProcessorClient execution.

The security principal used by the consumer application must be assigned the 'Storage Blob Data Contributor' role on the Azure Storage container.

To prevent partition ownership conflicts, you must programmatically acquire an exclusive, active write lease on the checkpoint blobs and supply this Lease ID to the client options before starting the processor.

You must configure the application with a System-Assigned Managed Identity to share the credential token across multiple distinct processor instances running in separate App Services.

Cevabı ve açıklamayı göster

Cevap: The target Blob container used for checkpointing must be created in the Azure Storage account prior to starting the EventProcessorClient execution.; The security principal used by the consumer application must be assigned the 'Storage Blob Data Contributor' role on the Azure Storage container.

Cevap

The correct configurations are creating the target Blob container prior to starting execution and assigning the 'Storage Blob Data Contributor' role on the storage container to the security principal of the consumer application.

The checkpoint store container must exist beforehand because the EventProcessorClient will throw a 404 (ContainerNotFound) error instead of auto-creating it. Additionally, the processor requires write access to create and update blobs tracking partition ownership and checkpoint offsets, which is granted via the 'Storage Blob Data Contributor' RBAC role.

Adım Adım Çözüm

Ensure the storage container for checkpointing is provisioned.

The EventProcessorClient will find the container and avoid throwing a ContainerNotFound exception.

The SDK does not provision the storage container automatically; it only creates blobs within it.

Assign the appropriate Azure RBAC role to the application's managed identity.

The identity receives read/write access to checkpoint blobs.

Storage Blob Data Contributor permissions are required for metadata updates and blob creation.

Allow the client to manage partition leases natively using metadata.

Dynamic load balancing succeeds without lease locking conflicts.

Manually leasing checkpoint blobs blocks the processor client's internal lease management.

Anahtar Kavram

Configuring EventProcessorClient checkpointing, permissions, and partition management in Azure Event Hubs.

Tahmini Süre:3m 0s

Soru 844Soru →

You are implementing an integration using Azure Event Grid. You have created an Azure Storage account named logstor with a blob container named deadletter to store events that cannot be delivered.

You need to configure a new Event Grid custom topic and an event subscription. The setup must meet the following requirements:
- All events that fail to deliver must be sent to the deadletter container.
- The custom topic must authenticate to the storage account using a system-assigned managed identity.
- No storage account access keys or connection strings can be stored in the configuration.

Which sequence of steps should you perform to configure the custom topic and subscription?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is to first create the Event Grid custom topic, configure it to use a system-assigned identity, assign the Storage Blob Data Contributor role to the topic's identity at the scope of the storage account, and finally create the event subscription specifying the dead-letter container and selecting the system-assigned identity.

To securely configure dead-lettering using a system-assigned managed identity, the custom topic must be created first to act as the host for the identity. The system-assigned identity is then enabled on the custom topic, which creates its corresponding enterprise application representation in Microsoft Entra ID. Next, this identity must be granted the Storage Blob Data Contributor role on the destination storage account scope to permit writing events. Finally, the event subscription is created, referencing the dead-letter container and designating the system-assigned managed identity for authentication.

Adım Adım Çözüm

Create the Event Grid custom topic.

A new custom topic resource is provisioned in Azure.

The custom topic is the parent resource that hosts the managed identity.

Configure the custom topic to use a system-assigned identity.

Azure creates an identity for the custom topic in Microsoft Entra ID.

The identity must exist in Microsoft Entra ID before RBAC roles can be assigned to it.

Assign the Storage Blob Data Contributor role to the custom topic's identity at the scope of the storage account.

The custom topic's managed identity receives write permissions to the blob storage.

Azure Event Grid validates access to the dead-letter container when the event subscription is created.

Create the event subscription on the custom topic, specifying the dead-letter container and selecting the system-assigned identity.

The subscription is successfully created and active.

The subscription is the final resource configured to route events and handle dead-lettering.

Anahtar Kavram

Configuring Event Grid dead-lettering with managed identities requires creating the parent resource, establishing its identity, granting appropriate storage roles, and then creating the subscription referencing both the dead-letter destination and the identity.

Soru 845Soru →

You are troubleshooting a performance issue in a web application. You need to identify the top 3 operations with the longest average duration over the past 12 hours by querying the Application Insights telemetry. The query must be optimized to minimize data scan limits and query execution time.

Which Kusto Query Language (KQL) query should you run to retrieve this data efficiently?

requests
| where timestamp > ago(12h)
| summarize AvgDuration = avg(duration) by name
| top 3 by AvgDuration desc

requests
| summarize AvgDuration = avg(duration) by name
| top 3 by AvgDuration desc

requests
| summarize AvgDuration = avg(duration) by name, timestamp
| where timestamp > ago(12h)
| top 3 by AvgDuration desc

requests
| where timestamp > ago(12h)
| summarize avg(duration) by name
| top 3 by duration desc

Cevabı ve açıklamayı göster

Cevap: requests
| where timestamp > ago(12h)
| summarize AvgDuration = avg(duration) by name
| top 3 by AvgDuration desc

Cevap

The KQL query that filters by timestamp > ago(12h) first, aggregates the average duration using summarize AvgDuration = avg(duration) by name, and then uses top 3 by AvgDuration desc.

The correct query filters the requests table by timestamp first, ensuring only telemetry from the past 12 hours is scanned and processed. It then calculates the average duration using the summarize operator and correctly references the aggregated alias in the top operator.

Adım Adım Çözüm

Filter incoming records by time range using a where clause.

Limits the dataset to requests from the last 12 hours.

Applying time range filters first is the primary optimization best practice in KQL queries.

Aggregate the data using the summarize operator to calculate the average duration grouped by operation name.

Produces a set of distinct operation names with their respective average durations.

Required to identify the performance metrics per operation.

Sort the results and limit the output using the top operator.

Returns the 3 operations with the highest average duration.

Extracts the top 3 bottlenecks from the summarized telemetry.

Anahtar Kavram

KQL Query Optimization with Time Range Filtering

Soru 846Soru →

You are configuring a custom gateway domain for an Azure API Management (APIM) instance named `apim-prod`. The SSL/TLS certificate for the custom domain `api.contoso.com` is stored in an Azure Key Vault named `kv-prod`. The security team requires that the custom domain must automatically use the latest version of the certificate whenever it is renewed in the Key Vault. You have enabled a system-assigned managed identity for the `apim-prod` instance. Which configuration steps should you implement to meet these requirements?

Configure an access policy in the key vault that grants the API Management system-assigned managed identity the Get permission for Certificates. In the API Management custom domain settings, configure the certificate using a Key Vault certificate URI that includes the specific certificate version.

Configure an access policy in the key vault that grants the API Management system-assigned managed identity the Get permission for Secrets. In the API Management custom domain settings, configure the certificate using a Key Vault secret URI that includes the specific secret version.

Configure an access policy in the key vault that grants the API Management built-in service principal the Get permission for Keys. In the API Management custom domain settings, configure the certificate using a Key Vault secret URI that excludes the specific secret version.

Cevabı ve açıklamayı göster

Cevap: Configure an access policy in the key vault that grants the API Management system-assigned managed identity the Get permission for Secrets. In the API Management custom domain settings, configure the certificate using a Key Vault secret URI that excludes the specific secret version.

Cevap

To configure a custom domain in Azure API Management using a certificate from Key Vault with auto-rotation, two conditions must be met: First, API Management must be granted 'Secret Get' permission in Key Vault. This is because SSL/TLS certificates containing private keys are accessed as secrets. Second, the secret identifier URI specified in API Management must exclude the version segment, prompting API Management to periodically pull the latest version of the certificate.

Adım Adım Çözüm

Assign Key Vault permissions to the API Management system-assigned managed identity.

The identity receives the 'Secret Get' permission inside the key vault.

API Management requires Secret Get permissions to retrieve the certificate alongside its private key, which is represented as a secret within Key Vault.

Configure the custom domain in the API Management instance settings.

The gateway hostname is linked to the Key Vault certificate resource.

This links the custom domain endpoint to the secret identifier from Key Vault.

Reference the Key Vault secret URI without specifying the version identifier.

The certificate is bound to the custom domain and will auto-rotate when a new version is created in Key Vault.

Omitting the version identifier enables auto-rotation. If a version identifier is included in the URI, API Management will remain pinned to that specific version indefinitely.

Anahtar Kavram

Key Vault integration for custom domains in Azure API Management with certificate auto-rotation.

Tahmini Süre:3m 0s

Soru 847Soru →

You are analyzing application performance issues for an Azure Web App by using Application Insights. You need to write a Kusto Query Language (KQL) query that retrieves the top 5 external dependency calls with the longest average duration over the last 24 hours. The query must execute efficiently and avoid scanning unnecessary historical data.

Which two of the following queries should you use?

Geçerli olan tümünü seçin

dependencies
| where timestamp > ago(24h)
| summarize AvgDuration = avg(duration) by name
| top 5 by AvgDuration desc

dependencies
| where timestamp > ago(24h)
| summarize AvgDuration = avg(duration) by name
| order by AvgDuration desc
| take 5

dependencies
| summarize AvgDuration = avg(duration) by name, timestamp
| where timestamp > ago(24h)
| top 5 by AvgDuration desc

dependencies
| summarize AvgDuration = avg(duration) by name
| top 5 by AvgDuration desc

Cevabı ve açıklamayı göster

Cevap

The queries that first filter dependencies by timestamp > ago(24h) and then summarize duration by name using either 'top 5 by AvgDuration desc' or 'order by AvgDuration desc | take 5' are correct.

The correct queries apply the time filter (where timestamp > ago(24h)) immediately after referencing the dependencies table. This ensures the query engine only scans the last 24 hours of data. The aggregation calculates the average duration grouped by name. Finally, the top 5 or order by and take 5 operators are functionally equivalent ways to retrieve the 5 slowest dependencies.

Adım Adım Çözüm

Apply a time-range filter as the very first step in the query pipeline.

Limits the input dataset to dependency telemetry from the last 24 hours, preventing a full scan of historical data.

KQL is most efficient when the dataset is reduced early in the execution plan, especially for timestamp-based partitions.

Aggregate the duration of the filtered dependencies using the avg function, grouping by the dependency name.

Calculates the average duration for each unique dependency name over the last 24 hours.

Grouping by name allows us to identify which external dependencies are causing bottlenecks.

Sort and limit the results to the top 5 records.

Returns the 5 dependencies with the highest average duration.

Using either 'top 5 by AvgDuration desc' or 'order by AvgDuration desc | take 5' achieves the same output.

Anahtar Kavram

Efficient telemetry querying in Application Insights using Kusto Query Language (KQL) by filtering on timestamp first.

Soru 848Soru →

You are configuring an Azure CDN Standard from Microsoft endpoint for a web application. The application delivers dynamic user profile banners from the path `/assets/banners/`. The banners are updated periodically, and the application appends a query string containing a version token (for example, `/assets/banners/user1.png?v=982a` where ` $v$ ` represents the version token) to ensure updates are reflected immediately.

The origin server serves these banners with a `Cache-Control: public, max-age=600` header (representing a duration of ` $10$ ` minutes). You need to configure the CDN caching rules to meet the following requirements:
- Cache the banners on the CDN edge servers for ` $5$ ` days.
- Ensure that users receive the correct version of the banner matching their version token query string.
- Optimize cache utilization by avoiding unnecessary calls to the origin server for cached banner versions.

Which configuration should you apply to the CDN endpoint?

Create a custom caching rule for the path `/assets/banners/*` with the caching behavior set to Override and duration set to

5

days. Set the query string caching behavior of the endpoint to Ignore query strings.

Create a custom caching rule for the path `/assets/banners/*` with the caching behavior set to Override and duration set to

5

days. Set the query string caching behavior of the endpoint to Cache every unique URL.

Create a custom caching rule for the path `/assets/banners/*` with the caching behavior set to Override and duration set to

5

days. Set the query string caching behavior of the endpoint to Bypass caching.

Create a custom caching rule for the path `/assets/banners/*` with the caching behavior set to Set if missing and duration set to

5

days. Set the query string caching behavior of the endpoint to Cache every unique URL.

Cevabı ve açıklamayı göster

Cevap: Create a custom caching rule for the path `/assets/banners/*` with the caching behavior set to Override and duration set to $5$ days. Set the query string caching behavior of the endpoint to Cache every unique URL.

Cevap

Create a custom caching rule for the path `/assets/banners/*` with the caching behavior set to Override and duration set to

5

days. Set the query string caching behavior of the endpoint to Cache every unique URL.

The correct configuration uses the 'Override' caching behavior for the path `/assets/banners/*` with a duration of `

5

` days, which forces the CDN to ignore the origin's shorter `Cache-Control` header (10 minutes) and apply the `

5

-day` lifetime. Additionally, configuring the query string caching behavior to 'Cache every unique URL' ensures that each unique version token (e.g., `

v=982a

`) causes the CDN to cache that specific variant of the banner, preventing stale banner delivery while still caching the files to reduce origin load.

Adım Adım Çözüm

Select the correct caching behavior to handle the origin server's existing Cache-Control header.

Choose 'Override' caching behavior instead of 'Set if missing'.

Since the origin server sends a Cache-Control header (max-age=

600

seconds), using 'Set if missing' would respect the origin's

10

-minute cache duration. 'Override' is required to ignore the origin header and apply the desired

5

-day duration.

Configure the path and duration for the caching rule.

Set the path to `/assets/banners/*` and the duration to `

5

` days.

This target matches the directory containing user banners and applies the required

5

-day cache lifetime.

Determine the appropriate query string caching behavior for versioned assets.

Set the query string caching behavior of the endpoint to 'Cache every unique URL'.

Since the application uses a query string parameter to differentiate between banner versions, selecting 'Cache every unique URL' ensures that different versions of the same file are cached separately. 'Ignore query strings' would serve stale content, and 'Bypass caching' would prevent caching entirely.

Anahtar Kavram

Azure CDN caching rules and query string caching behaviors allow developers to control how files are cached at the edge. The 'Override' caching behavior replaces origin cache headers, while 'Cache every unique URL' is critical for caching dynamic or versioned assets that rely on query string parameters.

Tahmini Süre:2m 0s

Soru 849Soru →

You are configuring caching rules for an Azure CDN Standard from Microsoft endpoint that delivers content for a web application. The application has the following requirements:
- The homepage (/index.html) must cache promotional landing pages differently based on the query string parameters (e.g., ?promo=summer vs ?promo=winter).
- Rest API endpoints under the path /api/ must never be cached by the CDN, regardless of any caching headers returned by the origin server.

Which two configurations should you apply to meet these requirements?

Geçerli olan tümünü seçin

Configure the global query string caching behavior to Cache every unique URL.

Create a custom caching rule with a match path of /api/* and set the caching behavior to Bypass cache.

Configure the global query string caching behavior to Bypass caching.

Create a custom caching rule with a match path of /api/* and set the caching behavior to Set if missing.

Cevabı ve açıklamayı göster

Cevap: Configure the global query string caching behavior to Cache every unique URL.; Create a custom caching rule with a match path of /api/* and set the caching behavior to Bypass cache.

Cevap

Configure the global query string caching behavior to Cache every unique URL, and create a custom caching rule with a match path of /api/* and set the caching behavior to Bypass cache.

Configuring the global query string caching behavior to 'Cache every unique URL' ensures that each unique promotional query string serves a cached page specific to that parameter. Creating a custom caching rule for the path /api/* with the caching behavior 'Bypass cache' ensures that API endpoints are never cached by the CDN, ignoring any cache-control headers from the origin server.

Adım Adım Çözüm

Analyze the query string caching requirement.

Since different versions of /index.html must be cached based on the query string parameters, the CDN needs to treat each unique query string URL as a separate cacheable resource.

This is achieved by setting the global query string caching behavior to 'Cache every unique URL'.

Analyze the API caching requirement.

API endpoints under the path /api/ must never be cached by the CDN, regardless of origin headers.

Creating a custom caching rule targeting /api/* with the caching behavior set to 'Bypass cache' overrides all origin headers and prevents the CDN from caching these endpoints.

Anahtar Kavram

Azure CDN caching rules allow customizing how files are cached based on file paths, file extensions, and query string parameters. Custom caching rules can override or bypass origin cache-control headers, and query string caching behavior determines how the CDN caches unique URLs containing query strings.

Soru 850Soru →

You are analyzing telemetry for a high-volume e-commerce API hosted on Azure. You need to identify requests processed within the last 12 hours where the cumulative duration of all associated external dependency calls accounts for more than 75% of the total request duration. The telemetry database contains millions of records per hour, and your query must be optimized to prevent execution timeouts and minimize data scan limits. Which of the following Kusto Query Language (KQL) queries should you use?

let start = ago(12h);
let dep_metrics = dependencies
| where timestamp > start
| summarize total_dep_duration = sum(duration) by operation_Id;
requests
| where timestamp > start
| join kind=inner dep_metrics on operation_Id
| where total_dep_duration > (duration * 0.75)
| project operation_Id, name, duration, total_dep_duration

let start = ago(12h);
let dep_metrics = dependencies
| summarize total_dep_duration = sum(duration) by operation_Id;
requests
| where timestamp > start
| join kind=inner dep_metrics on operation_Id
| where total_dep_duration > (duration * 0.75)
| project operation_Id, name, duration, total_dep_duration

let start = ago(12h);
let dep_metrics = dependencies
| where timestamp > start
| summarize total_dep_duration = sum(duration) by operation_Id;
requests
| join kind=inner dep_metrics on operation_Id
| where timestamp > start
| where total_dep_duration > (duration * 0.75)
| project operation_Id, name, duration, total_dep_duration

Cevabı ve açıklamayı göster

Cevap: let start = ago(12h);
let dep_metrics = dependencies
| where timestamp > start
| summarize total_dep_duration = sum(duration) by operation_Id;
requests
| where timestamp > start
| join kind=inner dep_metrics on operation_Id
| where total_dep_duration > (duration * 0.75)
| project operation_Id, name, duration, total_dep_duration

Cevap

The query that filters both the dependencies and requests tables by the 12-hour timestamp before performing the inner join.

The correct query applies the timestamp filter to both the dependencies table and the requests table prior to the join operation. In Kusto, filtering data as early as possible in the query pipeline reduces the CPU and memory footprint, which is critical for querying high-volume telemetry tables without exceeding resource limits or causing query timeouts.

Adım Adım Çözüm

Define the start time boundary using a let statement to ensure consistency.

A reusable time variable representing 12 hours ago.

Reusing the time boundary avoids recalculating the duration offset and keeps the query clean.

Filter the dependencies table by the start time and aggregate the total duration of dependency calls grouped by operation_Id.

An aggregated temporary dataset of dependency durations for the last 12 hours.

Applying the time filter before summarizing reduces the data volume to process during aggregation.

Filter the requests table by the start time before performing the inner join with the dependency durations.

A joined dataset linking requests from the last 12 hours with their respective dependency totals.

Applying the time filter to both tables prior to the join minimizes the join workload, preventing timeouts in high-volume environments.

Filter the joined results where the total dependency duration is greater than 75% of the request duration, and project the final columns.

The final filtered list of slow requests matching the criteria.

This completes the logical requirements of the scenario.

Anahtar Kavram

Optimizing KQL queries in Azure Monitor by applying time-range filters early on all tables before performing joins.

Soru 851Soru →

You are provisioning and configuring a production Azure API Management (APIM) instance that must connect to both internal and external APIs. You must meet the following requirements:
- The APIM instance must run within a private subnet of an Azure Virtual Network (VNet) in internal mode so that it is not exposed directly to the public internet.
- The API gateway must be deployed across two distinct Azure regions to ensure high availability and minimize latency for global clients.
- All custom domain TLS/SSL certificates must be securely stored in Azure Key Vault and automatically updated when a new version is uploaded.

Which of the following configuration steps must you perform to meet these requirements? (Select THREE.)

Geçerli olan tümünü seçin

Provision the APIM instance using the Premium tier and configure the Virtual Network setting to Internal.

Enable a system-assigned managed identity for the APIM instance and grant it the Key Vault Secrets User role on the Azure Key Vault.

Add the secondary geographic region under the Locations settings of the APIM instance to scale out the gateway.

Provision the APIM instance using the Developer tier to support internal VNet integration and multi-region deployment while keeping costs low.

Create a Shared Access Signature (SAS) token with secret read permissions on the Key Vault and configure it in the APIM Custom Domains settings.

Grant the APIM system-assigned managed identity the Key Vault Administrator role to ensure it can update DNS zones and certificates.

Cevabı ve açıklamayı göster

Cevap: Provision the APIM instance using the Premium tier and configure the Virtual Network setting to Internal.; Enable a system-assigned managed identity for the APIM instance and grant it the Key Vault Secrets User role on the Azure Key Vault.; Add the secondary geographic region under the Locations settings of the APIM instance to scale out the gateway.

Cevap

To meet the requirements, you must provision the APIM instance using the Premium tier and configure the Virtual Network setting to Internal, enable a system-assigned managed identity for the APIM instance and grant it the Key Vault Secrets User role on the Azure Key Vault, and add the secondary geographic region under the Locations settings of the APIM instance to scale out the gateway.

The solution requires the Premium tier of Azure API Management, as it is the only production tier that supports both virtual network integration and multi-region scale-out. A system-assigned managed identity is enabled on the APIM instance, and it is granted the Key Vault Secrets User role on the Key Vault, which allows the gateway to retrieve the TLS certificates for custom domains securely under least privilege. Finally, the secondary region is added under the Locations settings of the APIM instance in the Azure portal or deployment template.

Adım Adım Çözüm

Determine the required Azure API Management tier.

Premium tier must be selected.

VNet integration and multi-region deployment are only supported in the Premium (and Developer, which is non-production) tiers.

Configure the network isolation.

Virtual Network connectivity is configured to 'Internal' mode.

This ensures the gateway is only reachable from within the VNet or via VPN/ExpressRoute.

Configure Key Vault certificate access.

Enable system-assigned managed identity on APIM and assign the 'Key Vault Secrets User' role.

APIM needs to fetch certificates from Key Vault using its managed identity under least privilege.

Set up global distribution.

Add a secondary location under the Locations settings of APIM.

This scales the gateway to a second region for global latency reduction and high availability.

Anahtar Kavram

Azure API Management provisioning tiers, virtual network integration, multi-region scaling, and Key Vault integration using managed identities.

Soru 852Soru →

You are monitoring an Azure Web App using Application Insights. You need to write an optimized Kusto Query Language (KQL) query to analyze successful dependency calls to an external API named 'PaymentGateway' over the last 24 hours. The query must return the average duration of these calls grouped by the custom dimension 'TenantId'. Which KQL query should you run?

dependencies
| where timestamp > ago(24h)
| where name == "PaymentGateway" and success == true
| extend Tenant = tostring(customDimensions.TenantId)
| summarize AvgDuration = avg(duration) by Tenant

dependencies
| where name == "PaymentGateway" and success == true
| extend Tenant = tostring(customDimensions.TenantId)
| summarize AvgDuration = avg(duration) by Tenant

dependencies
| where timestamp > ago(24h)
| where name == "PaymentGateway" and success == true
| extend Tenant = tostring(customDimensions.tenantid)
| summarize AvgDuration = avg(duration) by Tenant

dependencies
| where timestamp > ago(24h)
| where name == "PaymentGateway" and success == true
| where connectionString == "InstrumentationKey=00000000-0000-0000-0000-000000000000"
| extend Tenant = tostring(customDimensions.TenantId)
| summarize AvgDuration = avg(duration) by Tenant

Cevabı ve açıklamayı göster

Cevap: dependencies
| where timestamp > ago(24h)
| where name == "PaymentGateway" and success == true
| extend Tenant = tostring(customDimensions.TenantId)
| summarize AvgDuration = avg(duration) by Tenant

Cevap

The KQL query that filters by timestamp > ago(24h), checks for successful 'PaymentGateway' calls, extracts the case-sensitive customDimensions.TenantId, and summarizes the average duration by Tenant.

The correct query begins with a time filter ('timestamp > ago(24h)') to ensure optimal query execution. It then filters for successful dependency calls specifically named 'PaymentGateway'. Next, it correctly extracts the case-sensitive 'TenantId' from the 'customDimensions' dynamic field using the 'tostring()' function and assigns it to an alias. Finally, it uses the 'summarize' operator with the 'avg(duration)' aggregation function to calculate the average duration grouped by the tenant alias.

Adım Adım Çözüm

Apply a time-range filter using the timestamp column.

Limits the query scan to telemetry from the last 24 hours, optimizing query performance.

Omitting a time range forces KQL to scan the entire historical telemetry dataset, which is inefficient and may exceed query limits.

Filter by the dependency name and success status.

Isolates records where the dependency name is 'PaymentGateway' and success is true.

We are specifically interested in successful calls to this particular external gateway.

Access and cast the custom dimension TenantId.

Extracts the dynamic property 'TenantId' from customDimensions and casts it to a string using tostring().

Custom dimensions are stored as dynamic JSON objects and are case-sensitive. The property name 'TenantId' must match the casing used when the telemetry was logged.

Summarize the average duration grouped by the tenant.

Outputs a table containing each unique Tenant and its average dependency call duration.

The 'summarize' operator with the 'avg()' aggregation function calculates the average duration grouped by the 'Tenant' key.

Anahtar Kavram

Querying and filtering custom dimensions within Application Insights telemetry tables using KQL while maintaining performance through time-range filters.

Tahmini Süre:1m 30s

Soru 853Soru →

A company is planning to deploy a new Azure API Management (APIM) instance in the Premium tier. The instance must be integrated with an existing Azure Virtual Network (VNet) in Internal mode to expose APIs only to internal clients. During the deployment phase, the administrator attempts to provision the APIM instance inside a subnet that already contains several running virtual machines. The deployment fails during the provisioning stage. You need to resolve the provisioning failure and successfully deploy the APIM instance. Which of the following actions should you take?

Enable the Microsoft.Web service endpoint on the existing subnet, and configure a system-assigned managed identity to authorize the virtual machines to share the subnet.

Change the API Management pricing tier to Consumption, as the Consumption tier supports deployment into shared subnets with existing virtual machines.

Create a new subnet that is dedicated exclusively to the API Management instance with a prefix of at least

/29

, and ensure no other resources are deployed in it.

Apply a Network Security Group (NSG) to the existing subnet that includes an inbound security rule referencing the @Microsoft.KeyVault prefix to authorize the virtual machines.

Cevabı ve açıklamayı göster

Cevap: Create a new subnet that is dedicated exclusively to the API Management instance with a prefix of at least $/29$ , and ensure no other resources are deployed in it.

Cevap

Create a new subnet that is dedicated exclusively to the API Management instance with a prefix of at least

/29

, and ensure no other resources are deployed in it.

The correct solution involves creating a dedicated subnet for the API Management instance. Azure API Management requires a dedicated subnet that contains no other resource types. The subnet must be at least

/29

(with

/28

recommended for upgrades and scaling) to accommodate the IP allocations needed by the instance.

Adım Adım Çözüm

Identify the cause of the provisioning failure.

The deployment fails because the selected subnet is currently shared with virtual machines, which violates API Management provisioning constraints.

API Management requires a dedicated subnet that contains no other resource types.

Determine the subnet size requirements.

The subnet must have a prefix of at least

/29

, though

/28

is recommended to support future scaling and upgrades.

API Management allocates multiple IP addresses within its subnet for internal load balancing, gateway nodes, and upgrade processes.

Create and associate a new subnet.

A new, empty subnet is created with the required size, and the API Management provisioning process is initiated targeting this new subnet.

This satisfies the network isolation and size requirements, allowing the Premium tier APIM instance to provision successfully in Internal VNet mode.

Anahtar Kavram

API Management Virtual Network Integration Subnet Requirements

Soru 854Soru →

You are developing a .NET background worker service that consumes high-throughput sensor telemetry from an Azure Event Hub using the EventProcessorClient class from the Azure.Messaging.EventHubs.Processor library. The service is containerized and deployed to Azure Container Apps with multiple replica instances sharing the same consumer group.

To coordinate partition ownership and perform checkpointing, you configure the EventProcessorClient to use a container in an Azure Blob Storage account. You configure the Azure Container App to use a User-Assigned Managed Identity.

During deployment, the service instances start up but fail to claim partition ownership. The container logs output multiple RequestFailedException errors with an HTTP status of 403 (Authorization Failed) when attempting to perform write operations on the checkpoint blobs. You verify that the User-Assigned Managed Identity has been assigned the Storage Blob Data Contributor role on the storage account scope.

Which of the following describes the cause of this lease coordination failure and the correct resolution?

The EventProcessorClient is restricted by the Azure SDK design to only utilize system-assigned managed identities for lease management. To resolve this, you must enable the system-assigned managed identity on the Container App, assign it the Owner role on the storage account, and disable the user-assigned managed identity.

The EventProcessorClient is attempting to modify active leases that are locked. To resolve this, you must run a background task that uses BlobClient.DeleteAsync() without specifying a lease ID to force-delete the active lease blobs in the checkpoints container before the processor starts.

The DefaultAzureCredential was instantiated without configuration, causing it to fall back to the system-assigned managed identity (or another default credential) which does not have permissions on the storage container. To resolve this, specify the client ID of the user-assigned managed identity in the DefaultAzureCredentialOptions when initializing the credential.

The checkpoint metadata payload exceeds the 64 KB storage limit allowed for lease blobs in Azure Blob Storage. To resolve this, you must store the telemetry event payloads in Azure Queue Storage instead of Azure Event Hubs to keep the partition state below the size limit.

Cevabı ve açıklamayı göster

Cevap: The DefaultAzureCredential was instantiated without configuration, causing it to fall back to the system-assigned managed identity (or another default credential) which does not have permissions on the storage container. To resolve this, specify the client ID of the user-assigned managed identity in the DefaultAzureCredentialOptions when initializing the credential.

Cevap

When using user-assigned managed identities in environments with multiple identities or where the client ID must be explicitly declared, DefaultAzureCredential will not automatically select the user-assigned identity. Without specifying the client ID, the credential will attempt to use the system-assigned managed identity or fall back to other credentials, resulting in a 403 Forbidden error because that identity lacks the Storage Blob Data Contributor role. Providing the client ID via DefaultAzureCredentialOptions ensures the correct identity is selected and authenticated.

Adım Adım Çözüm

Identify the resource throwing the HTTP 403 authorization error.

The EventProcessorClient throws RequestFailedException (403) when writing to Blob Storage.

Blob Storage requires appropriate write permissions (Storage Blob Data Contributor) to store checkpoints and claim partition leases.

Analyze the credential mechanism used for BlobContainerClient.

DefaultAzureCredential is used without specifying a client ID.

In environments with user-assigned managed identities, DefaultAzureCredential requires the specific client ID to locate and use that identity; otherwise, it defaults to the system-assigned identity.

Verify the role assignments for the identity.

The user-assigned identity has Storage Blob Data Contributor, but the system-assigned identity does not exist or lacks permissions.

Specifying the client ID in DefaultAzureCredentialOptions aligns the active credential with the authorized identity, restoring lease coordination functionality.

Anahtar Kavram

Configuring identity-based authentication and lease coordination in EventProcessorClient

Soru 855Soru →

You are developing an integration solution that consumes events from an Azure Event Grid custom topic. You create an HTTP-triggered Azure Function to act as the Webhook subscription endpoint. Due to strict enterprise firewall rules, the Azure Function is hosted in a private VNet with no outbound public internet access, which prevents it from performing an asynchronous subscription validation handshake via the validation URL.

You need to implement C# code within the Azure Function to perform a synchronous subscription validation handshake when Event Grid sends the initial validation request.

Which C# code snippet should you implement inside the Azure Function to successfully complete the validation handshake?

if (req.Headers.TryGetValue("Aeg-Event-Type", out var headerValue) && headerValue == "SubscriptionValidation")
{
string requestBody = await new StreamReader(req.Body).ReadToEndAsync();
var events = JsonConvert.DeserializeObject<List<CustomValidationEvent>>(requestBody);
var code = events[0].Data.ValidationCode;
return new OkObjectResult(new { validationCode = code });
}

string requestBody = await new StreamReader(req.Body).ReadToEndAsync();
var events = JsonConvert.DeserializeObject<List<CustomValidationEvent>>(requestBody);
if (events[0].EventType == "Microsoft.EventGrid.SubscriptionValidationEvent")
{
using (var client = new HttpClient())
{
await client.GetAsync(events[0].Data.ValidationUrl);
}
return new OkResult();
}

Cevabı ve açıklamayı göster

Cevap: if (req.Headers.TryGetValue("Aeg-Event-Type", out var headerValue) && headerValue == "SubscriptionValidation")
{
string requestBody = await new StreamReader(req.Body).ReadToEndAsync();
var events = JsonConvert.DeserializeObject<List<CustomValidationEvent>>(requestBody);
var code = events[0].Data.ValidationCode;
return new OkObjectResult(new { validationResponse = code });
}

Cevap

The correct code snippet checks if the 'Aeg-Event-Type' header equals 'SubscriptionValidation', reads the request body, deserializes it to retrieve the validation code from the first event's data payload, and then returns a 200 OK result with a JSON object that contains the key 'validationResponse' mapped to the validation code.

The correct response pattern checks the HTTP request header 'Aeg-Event-Type' for the value 'SubscriptionValidation'. It then deserializes the request body, extracts the validation code, and returns it synchronously in a JSON payload with the property name 'validationResponse'. This conforms to the required Azure Event Grid protocol for synchronous subscription validation.

Adım Adım Çözüm

Inspect request headers for Event Grid handshake signatures.

Identify the 'Aeg-Event-Type' header and verify that its value is 'SubscriptionValidation'.

This confirms that the incoming POST request is a validation handshake request sent by Azure Event Grid rather than a standard event notification.

Read and deserialize the JSON request body payload.

Extract the 'validationCode' from the 'data' property of the first event object in the deserialized array.

Event Grid sends validation requests as an array containing a single validation event that holds the unique authorization code.

Construct a synchronous HTTP response containing the validation response payload.

Create a JSON object structure with the property 'validationResponse' set to the extracted validation code.

For synchronous handshakes, Event Grid expects an HTTP 200 OK response containing a JSON body structured specifically as { "validationResponse": "<validationCode>" }.

Anahtar Kavram

Azure Event Grid Webhook synchronous validation handshake requirements.

Soru 856Soru →

You need to write an optimized Kusto Query Language (KQL) query that returns the average duration of failed dependency calls grouped by target for the last 12 hours. The query must be optimized to filter the data as early as possible. How should you complete the KQL query to satisfy these requirements? Complete the query by filling in the missing KQL operators and fields in the blanks.

Aşağıdaki boşlukları doldurun

dependencies
| timestamp > ago(12h)
| where == false
| AverageDuration = avg(duration) by target

Cevabı ve açıklamayı göster

Cevap

The completed query uses the 'where' operator to filter by timestamp first, the 'success' property to filter for failed dependency calls, and the 'summarize' operator to compute the average duration by target.

The query starts with the 'dependencies' table. It filters for records from the last 12 hours using '| where timestamp > ago(12h)' to ensure the query remains optimized. Next, it filters for unsuccessful calls using '| where success == false'. Finally, it groups the results and calculates the average duration using '| summarize AverageDuration = avg(duration) by target'.

Adım Adım Çözüm

Filter the dataset by time range immediately after referencing the telemetry table.

Using the 'where' operator to filter 'timestamp > ago(12h)' minimizes the query scope.

In KQL, filtering by timestamp as early as possible prevents scanning unnecessary historical logs, optimizing performance.

Filter specifically for dependency calls that failed.

Reference the boolean column 'success' and check if its value is false.

The Application Insights dependencies table represents execution success via the 'success' boolean property.

Summarize the average duration grouped by target.

Use the 'summarize' operator and the 'avg' aggregation function.

The 'summarize' operator groups data by specified columns and aggregates target metrics.

Anahtar Kavram

Writing optimized KQL queries on Application Insights telemetry by applying early time filters and performing aggregations.

Tahmini Süre:1m 30s

Soru 857Soru →

You are developing a secure Web API hosted in Azure App Service. The API requires mutual TLS (mTLS) client certificate authentication for all incoming requests. You need to configure availability monitoring for this API using Application Insights. The solution must verify that the API successfully authenticates clients using their client certificates. Which monitoring solution should you implement?

Configure a Standard web test in Application Insights. In the request configuration, set the HTTPS URL of the API and add a custom header named X-Client-Cert containing the secret identifier of the client certificate stored in Azure Key Vault.

Create an Azure Function app with a timer-triggered function. Retrieve the client certificate, perform the HTTPS request to the API, and instantiate a new TelemetryClient using the default parameterless constructor without setting the APPLICATIONINSIGHTS_CONNECTION_STRING environment variable before calling TrackAvailability.

Create an Azure Function app with a timer-triggered function. Configure the function to retrieve the client certificate from Azure Key Vault using a managed identity, perform the HTTPS request to the API with the certificate attached, and send the result using the TrackAvailability method of the TelemetryClient class.

Create an Azure Function app with a timer-triggered function. Configure a system-assigned managed identity for the Function app, grant it the Monitoring Metrics Publisher role on the App Service, and write code to push availability metrics directly to Azure Monitor using the Azure Monitor REST API.

Cevabı ve açıklamayı göster

Cevap: Create an Azure Function app with a timer-triggered function. Configure the function to retrieve the client certificate from Azure Key Vault using a managed identity, perform the HTTPS request to the API with the certificate attached, and send the result using the TrackAvailability method of the TelemetryClient class.

Cevap

To monitor an API requiring client certificate authentication, standard Application Insights web tests cannot be used because they do not support mutual TLS (mTLS) client certificate presentation. A custom availability test must be implemented. An Azure Function with a timer trigger can run on a schedule, securely retrieve the client certificate from Azure Key Vault using a managed identity, make the HTTPS call with the client certificate, and send the availability metrics using the TrackAvailability method of the TelemetryClient class.

Adım Adım Çözüm

Determine if standard Application Insights tests can be used.

Standard ping and web tests do not support presenting client certificates for mutual TLS (mTLS) authentication, requiring a custom solution.

Standard tests run from public Azure test locations and cannot authenticate using custom client certificates.

Select the hosting mechanism for the custom availability test.

A timer-triggered Azure Function is chosen to run the test logic on a schedule.

Azure Functions offer a serverless, scheduled execution environment that integrates well with Key Vault and Application Insights.

Retrieve the certificate and perform the request.

Use a managed identity to authenticate against Azure Key Vault, fetch the certificate, and attach it to the HTTP request client.

This avoids hardcoding credentials and ensures secure certificate retrieval.

Track and report the availability status.

Instantiate TelemetryClient with the correct connection string and call the TrackAvailability method.

The TrackAvailability method publishes the results into the availability telemetry table, which enables built-in availability reporting and alerting.

Anahtar Kavram

Custom availability monitoring using TelemetryClient.TrackAvailability() for endpoints requiring client certificate authentication.

Soru 858Soru →

You are developing a telemetry ingestion solution in .NET that uses the Azure.Messaging.EventHubs.Processor library. The application must consume events, manage partition load balancing using Azure Blob Storage, perform checkpointing to prevent processing duplicate messages from the last known state, and shut down gracefully. You need to implement the lifecycle of the EventProcessorClient. In which order should you perform the tasks?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with initializing the client and storage containers, followed by assigning the event and error delegates, launching the processing thread, checkpointing during active event consumption, and finally stopping processing to release leases.

The correct order ensures that the necessary storage and processor clients are instantiated first. Next, handlers must be assigned before the client starts processing, as starting without handlers throws an exception. Checkpoints are recorded during the processing stage as events are consumed. Finally, stopping the processor releases partition leases and terminates the client lifecycle cleanly.

Adım Adım Çözüm

Initialize the EventProcessorClient and BlobContainerClient.

Connections to Azure Event Hubs and the checkpoint store are prepared.

Establishes connection details and links the processor to the Blob Storage container that manages ownership leases and offsets.

The processor is configured with the logic required to handle incoming messages and errors.

The SDK requires both event and error handler delegates to be defined before the client is started, otherwise an InvalidOperationException is thrown.

Start event processing and lease acquisition.

The background thread starts reading events and claiming partition leases.

Invoking StartProcessingAsync initiates partition load balancing and events start flowing to the handler.

Perform checkpoints inside the event processing handler.

The current partition state is persisted to Blob Storage.

Invoking UpdateCheckpointAsync on the event arguments saves progress, allowing the processor to resume from this point in case of failure.

Stop the processor and release partition leases.

Event consumption stops and partition leases are released cleanly.

Invoking StopProcessingAsync ensures that other consumer instances can immediately assume ownership of the partitions without waiting for lease timeouts.

Anahtar Kavram

Lifecycle management and checkpointing configuration for the Azure.Messaging.EventHubs EventProcessorClient SDK.

Soru 859Soru →

An organization uses Azure API Management (APIM) to secure and manage a legacy backend REST API. You are tasked with configuring a policy definition at the API level to meet the following operational and security requirements:
1. Rate-limit incoming calls to a maximum of 100 requests per minute based on the client IP address.
2. Validate that the incoming request contains a valid JSON Web Token (JWT) issued by a trusted identity provider before any backend communication occurs.
3. Cache HTTP GET responses for 60 seconds to reduce the load on the legacy backend.
4. Strip the 'Server' header from all backend responses before they are returned to client applications.

Which XML policy configuration correctly implements these requirements while preventing unauthorized clients from bypassing token validation on cache hits?

Cevabı ve açıklamayı göster

Cevap: <policies>
<inbound>
<base />
<rate-limit-by-key calls="100" renewal-period="60" counter-key="@(context.Request.IpAddress)" />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized">
<openid-config url="https://login.microsoftonline.com/common/.well-known/openid-configuration" />
</validate-jwt>
<cache-lookup vary-by-developer="false" vary-by-developer-groups="false" downstream-caching-type="none" />
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
<cache-store duration="60" />
<set-header name="Server" exists-action="delete" />
</outbound>
<on-error>
<base />
</on-error>
</policies>

Cevap

The configuration that places the rate-limit-by-key, validate-jwt, and cache-lookup policies in the inbound section (in that order), and the cache-store and set-header (delete Server) policies in the outbound section is the only correct and secure solution.

The correct configuration establishes a secure and logical processing flow. In the inbound section, the rate limit check runs first to mitigate denial-of-service attempts. Next, validate-jwt verifies the client's token, ensuring that only authenticated users proceed. Only after successful token verification is cache-lookup executed, which protects the cached data. In the outbound section, cache-store saves the valid backend response, and set-header successfully deletes the 'Server' header from the outbound HTTP response.

Adım Adım Çözüm

Determine the proper section for JWT validation.

JWT validation must occur in the inbound section to authenticate the client before routing the request or serving data.

Placing authentication checks like validate-jwt in the inbound section secures the API endpoints and blocks unauthorized traffic early.

Determine the correct ordering of validate-jwt relative to cache-lookup.

The validate-jwt policy must precede the cache-lookup policy.

If cache-lookup is placed before validate-jwt, a cache hit will bypass the token validation entirely, resulting in a security vulnerability where unauthenticated clients can read cached responses.

Determine the proper sections for caching policies.

The cache-lookup policy must be in the inbound section, and the cache-store policy must be in the outbound section.

API Management checks the cache during the inbound processing phase and saves the generated response to the cache during the outbound phase.

Determine the proper section for response header modification.

The set-header policy designed to delete the Server header must reside in the outbound section.

Since the Server header is generated by the backend service, it can only be removed from the response headers during the outbound processing phase.

Anahtar Kavram

Azure API Management policy evaluation order, caching logic, and authentication sequencing.

Soru 860Soru →

You are implementing an event-driven solution that uses Azure Event Grid. You have an Event Grid system topic named `kv-system-topic` associated with an Azure Key Vault instance.

You need to configure an event subscription that routes events to an Azure Service Bus queue. The subscription must meet the following requirements:
- Any undelivered events must be written to a private blob container named `dlq-container` in an Azure Storage account named `saeventgridlogs`.
- The system topic must authenticate to the storage account using its system-assigned managed identity.
- Least privilege access must be enforced.

Which sequence of actions should you perform to configure the identity and create the subscription? Arrange the actions in the correct order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

Enable the system-assigned managed identity on the system topic, retrieve its principal ID, assign the Storage Blob Data Contributor role to the identity at the storage account scope, and then create the event subscription specifying the Service Bus queue endpoint, the dead-letter blob container, and the system-assigned identity.

To configure an Event Grid subscription with dead-lettering using a system-assigned managed identity, the managed identity must first be enabled on the system topic. Next, the principal ID of that managed identity must be retrieved to allow role assignment. The Storage Blob Data Contributor role must then be assigned to that principal ID at the scope of the destination storage account so that Event Grid has permission to write dead-letter events. Finally, the event subscription can be created referencing the dead-letter container and configuring the dead-letter identity to use the system-assigned identity. Performing these steps in any other order will fail, as Event Grid validates write access to the dead-letter destination at subscription creation time.

Adım Adım Çözüm

Enable the system-assigned managed identity on the Event Grid system topic.

A service principal is created in Microsoft Entra ID representing the kv-system-topic.

This establishes the identity that will be granted access to the storage account.

Obtain the principal ID of the newly created managed identity.

The principal ID GUID is retrieved.

The principal ID is required for the subsequent role assignment command.

Assign the Storage Blob Data Contributor role to the principal ID at the scope of the saeventgridlogs storage account.

The managed identity is authorized to write blobs to the storage account.

Event Grid must have write permissions to the storage account to successfully validate and write dead-letter events.

Create the event subscription, configuring the dead-letter destination and setting the dead-letter identity to system-assigned.

The subscription is validated and created successfully.

Since the identity has the correct permissions, Event Grid's validation check passes and the event subscription is established.

Anahtar Kavram

Configuring dead-lettering with managed identities in Azure Event Grid subscription creation.

ÖncekiSayfa 43 / 49Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram