HOTSPOT You are creating an app that uses Event Grid to connect with other services. Your app's event data will be sent to a serverless function that checks compliance. This function is maintained by your company. You write a new event subscription at the scope of your resource. The event must be invalidated after a specific period of time. You need to configure Event Grid to ensure security. What should you implement? To answer, select the appropriate options in [he answer area. NOTE: Each correct selection is worth one point 
So, for the auto-expiry requirement, SAS tokens make sense because you can set how long they're valid and Azure Event Grid will reject requests once they expire. The validationCode handshake is just a one-time thing to prove ownership, not ongoing access control. I think the intention is to use SAS tokens for this scenario, but happy to hear if anyone sees it differently.
SAS token with expiry looks right since that's made for time-limited access. The key here is the auto-invalidation part, and that's baked into how SAS works for webhooks. Pretty sure that's what's needed, unless I'm missing something subtle.
Wait, does "must be invalidated after a specific period" mean just for the event subscription authentication, or for each event delivery? If it's about temporary access to the endpoint, SAS tokens fit, but if it's ongoing validation, the answer might change.