For Azure Service Bus to be used as a source for Azure Event Grid, the Service Bus namespace must be on the Premium tier. This integration feature, which allows emitting events such as ActiveMessagesAvailableWithNoListeners, is explicitly available only in the Premium tier and is not supported in the Basic or Standard tiers.

To configure the integration, a user or principal must create an Event Grid subscription on the Service Bus resource. This is a management plane operation that requires the Microsoft.EventGrid/eventSubscriptions/write permission on the Service Bus namespace. Among the choices provided, the Contributor role grants the necessary permissions to manage resources, including setting up such integrations. The Owner role also works but is more permissive, making Contributor the choice that follows the principle of least privilege for management tasks. The data plane roles (Azure Service Bus Data Owner/Receiver) do not grant the required management permissions for this setup.

Microsoft Azure Documentation, "Azure Service Bus as an Event Grid source": This document explicitly states the tier requirement.

Reference: Under the "Prerequisites" section, it states, "Create a Service Bus Premium namespace... This feature is available for the Service Bus Premium tier only."

Microsoft Azure Documentation, "Azure built-in roles for Azure Service Bus": This page details the permissions for Azure RBAC roles related to Service Bus.

Reference: The description for the Contributor role shows that it grants full access to manage all resources, which includes the necessary permissions to create event subscriptions. The data plane roles (Azure Service Bus Data Owner, Azure Service Bus Data Receiver) are shown to only contain data-related actions (e.g., .../messages/send/action, .../messages/receive/action) and lack the management permissions required for configuration.

Microsoft Azure Documentation, "Event handlers for Azure Event Grid events": This documentation clarifies the permissions needed to create an event subscription.

Reference: In various sections, it's explained that to create an event subscription, the identity performing the action needs write permission on the event source resource, such as Microsoft.EventGrid/eventSubscriptions/write, which is included in the Contributor and Owner roles.

The staticwebapp.config.json file is configured to handle the authentication flow.

1. The responseOverrides property is selected to define a custom action when a specific HTTP status code is returned by the application. This is the correct section for creating a custom login redirect flow.
2. When an unauthenticated user attempts to access a protected route, the system issues a 401 (Unauthorized) error. This is the status code that must be intercepted to redirect the user to log in.
3. The redirect sends the user to the appropriate identity provider. The question specifies using Azure AD, for which the correct provider keyword is aad. The redirect path is /.auth/login/aad.
4. To ensure the user returns to the specific training page after authenticating, the system needs the original URL. The referrer option leverages the HTTP Referer header, which contains the address of the page that initiated the request to the login page. This effectively captures the originally requested URL for the post-login redirection.

Microsoft Learn. (2023). Configuration file for Azure Static Web Apps. See the "Response overrides" section (Sub-section: "Example"), which details how to configure a redirect for a 401 status code.

Microsoft Learn. (2024). Authentication and authorization for Azure Static Web Apps. Consult the "Providers" and "Sign in" sections for the list of provider keywords, including aad for Azure Active Directory, and the structure of login paths.

Fielding, R., et al. (1999). Hypertext Transfer Protocol -- HTTP/1.1. RFC 2616, Section 14.36 "Referer". This official specification defines the Referer request-header field, which allows the server to identify the URI of the resource from which the Request-URI was obtained. This is the underlying mechanism that makes referrer a viable option for post-login redirection. (DOI: https://doi.org/10.17487/RFC2616).

The Standard test is the most suitable option as it meets all specified requirements while minimizing implementation effort. It is a portal-configured test that requires no custom code. The Standard test functionality explicitly includes options to:

1. Parse dependent requests: This allows the test to download and measure the performance of images, scripts, and other files linked from the main HTML page.

2. Validate TLS certificates: It includes a setting to enable SSL certificate validity checks.

3. Configure custom request headers: The configuration pane allows for the addition of custom key-value pairs for request headers.

This combination of features directly addresses the scenario's needs without the overhead of custom coding or complex test file creation.

A. Custom TrackAvailability test: Incorrect. This option requires writing, deploying, and maintaining custom code using the Application Insights SDK, which violates the requirement to minimize development and implementation efforts.

C. URL ping test: Incorrect. This is a classic, basic test that only checks the response from a single URL. It does not have the capability to parse dependent requests, which is a key requirement.

D. Multi-step web test: Incorrect. This test is designed for recording and replaying a sequence of user interactions (e.g., a sign-in process). It is more complex to create, requiring a .webtest file from Visual Studio, and is overkill for testing a single URL, thus failing the minimal effort requirement.

1. Microsoft Learn

Application Insights Documentation. "Monitor the availability of any website". This document compares the different availability test types. It describes the Standard test as a single-request test that includes features like "SSL certificate validity" and "custom headers." Under the "Success criteria" section for Standard tests

it explicitly lists the option to "Parse dependent requests."

Reference Section: "Availability test types" and "Success criteria" table.

2. Microsoft Learn

Application Insights Documentation. "Monitor the availability of any website". This same document describes Multi-step web tests as being for a "sequence of web requests" and notes they are "created in Visual Studio Enterprise

" which represents a higher implementation effort than a portal-configured Standard test.

Reference Section: "Availability test types" > "Multi-step web test (classic)".

3. Microsoft Learn

Application Insights Documentation. "Application Insights API for custom events and metrics". This document details the TrackAvailability() method

showing it is part of the SDK and used within custom code to send availability telemetry

confirming that option A requires development effort.

Reference Section: "Availability".

To minimize data loss for an Azure Cache for Redis instance during a data center outage, data persistence must be configured. This feature saves a snapshot of the cache data to a persistent Azure Storage account. This directly addresses the need for data durability beyond the cache's in-memory store.

To further minimize the amount of data lost (i.e., reduce the Recovery Point Objective), the frequency of these snapshots should be set to the shortest possible interval. By taking backups more frequently, the window of potential data loss between the last successful backup and a failure event is reduced.

B. Configure second storage account for persistence: Azure Cache for Redis persistence is configured with a single primary storage account. Geo-redundancy is managed at the storage account level (e.g., using GRS), not by configuring a second account in the cache settings.

D. Configure Azure Redis with RDS persistence: "RDS persistence" is not a valid persistence model for Azure Cache for Redis. The available models are RDB (Redis Database file) and AOF (Append Only File).

1. Microsoft Azure Documentation

"Configure data persistence for Azure Cache for Redis": This document explicitly states

"Redis persistence allows you to persist data stored in Redis... You can also take snapshots and back up the data

which you can load in case of a hardware failure." This supports enabling persistence (Answer A). The configuration section shows the "Backup Frequency" setting

with a minimum value of 15 minutes

which is essential for minimizing data loss (Answer C). The documentation also confirms that only a single storage account is configured for persistence

making option B incorrect.

Source: https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-how-to-premium-persistence

Section: "What is data persistence?" and "Configure data persistence".

2. Microsoft Azure Documentation

"High availability for Azure Cache for Redis": This document discusses disaster recovery strategies. It highlights data persistence as a key mechanism for recovering data after a catastrophic failure

stating

"Persistence: Azure Cache for Redis persistence saves your cache's data to an Azure Storage account. If the primary data center goes down

you can either bring up the cache in another region and have it load the data from storage..." This reinforces the importance of persistence (Answer A) for outage scenarios.

Source: https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability

Section: "Disaster recovery".

The proposed solution does not meet the goal because an Azure Function app on a Consumption plan using a standard Blob trigger cannot guarantee execution within one minute. The Blob trigger uses a polling mechanism to detect new blobs. When a Function App on a Consumption plan becomes idle (a "cold start" scenario), there can be a delay of up to 10 minutes before it detects and processes a new blob. Since the requirement states the process must start in less than one minute, this potential latency makes the solution unreliable for meeting the stated goal.

A. Yes: This is incorrect. While the Blob trigger will eventually process the image, it does not guarantee the sub-one-minute start time required, due to potential polling delays of up to 10 minutes in a cold-start scenario on the Consumption plan.

1. Microsoft Docs: Azure Blob storage trigger for Azure Functions. Under the "Blob polling" section

the documentation explicitly states the potential for latency.

Reference: Microsoft Learn. (2023). Azure Blob storage trigger for Azure Functions. "On a Consumption plan

there can be up to a 10-minute delay in processing new blobs if a function app has gone idle. To avoid this latency... You can also consider using an Event Grid trigger instead of a blob trigger."

Location: Found in the "Blob polling" section of the document.

2. Microsoft Docs: Compare hosting options - Azure Functions. This document compares the different hosting plans and their features

highlighting that the Consumption plan can scale to zero

which leads to the possibility of cold starts.

Reference: Microsoft Learn. (2023). Azure Functions hosting options.

Location: See the feature comparison table

specifically regarding "Scale to zero" for the Consumption plan.

3. Microsoft Docs: Event Grid trigger for Azure Functions. This document explains how Event Grid provides a push-based

low-latency mechanism that is recommended for scenarios requiring a faster response to Blob storage events than the standard Blob trigger can guarantee.

Reference: Microsoft Learn. (2023). Azure Event Grid trigger for Azure Functions.

Location: The overview section describes how Event Grid enables reactive programming and near-real-time responses to events from Azure services.

The described usage pattern, where a small subset of elements is accessed more frequently, is the ideal scenario for a Least Recently Used (LRU) eviction algorithm. LRU ensures that when the cache is full, the keys that have not been accessed for the longest time are removed first. This strategy effectively keeps the "hot" or frequently used data in the cache, optimizing performance.

Both allkeys-lru and volatile-lru implement this LRU logic. allkeys-lru applies the policy to the entire keyspace, while volatile-lru applies it only to keys that have an expiration (TTL) set. Both are correct and effective policies for achieving the goal.

A. noeviction: This policy prevents keys from being evicted, returning errors on write operations when memory is full, which is contrary to the requirement.

D. allkeys-random: Evicting keys randomly is inefficient for this pattern, as it could remove a frequently accessed key, causing a cache miss.

E. volatile-ttl: This policy evicts keys based on the shortest remaining time-to-live, not on access frequency, which does not match the usage pattern.

F. volatile-random: Similar to allkeys-random, this policy is inefficient because it might randomly evict a frequently used key from the volatile set.

1. Microsoft Docs

Azure Cache for Redis documentation

"Eviction policies" section. This document explicitly describes the available maxmemory-policy settings. It states that allkeys-lru "Evicts the least recently used keys out of all keys" and volatile-lru "Evicts the least recently used keys out of all keys with an expire set

" confirming their suitability for LRU-based caching scenarios.

Source: https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-configure#eviction-policies

2. Redis.io Documentation

"Eviction policies" section. As Azure Cache for Redis is based on Redis

this official documentation is a primary source. It details how LRU policies work: "allkeys-lru: remove any key accordingly to the LRU algorithm" and "volatile-lru: remove the key with an expire set that was least recently used." This directly supports using LRU for patterns with frequently accessed subsets.

Source: https://redis.io/docs/latest/operate/ossandstack/management/eviction/#eviction-policies

The Azure Blob Storage change feed is designed to provide a durable, ordered, and read-only log of all changes (creations, modifications, deletions) that occur in a storage account. Client applications poll this log to process changes. However, the documentation states that change feed records are appended to the log within an order of a few minutes of the change. This latency does not meet the strict requirement for the processing to begin in less than one minute. A more suitable solution for this low-latency, event-driven scenario would be to use Azure Event Grid, which is designed for near-real-time event delivery.

A. Yes: This is incorrect because the change feed's design for ordered, asynchronous log processing results in a latency of several minutes, which fails to meet the "less than one minute" requirement for starting the process.

1. Microsoft Docs

"Change feed support in Azure Blob Storage":

Section: How the change feed works: "Change feed records are created within an order of a few minutes of the change." This statement directly confirms that the latency is greater than the one-minute requirement.

Section: Overview: The document describes the change feed as a "log of changes" that client applications "can read...at any time

" which implies a polling mechanism rather than a near-real-time push trigger.

2. Microsoft Docs

"Reacting to Blob storage events":

Section: Blob storage events and Event Grid: "Azure Blob storage offers eventing via Azure Event Grid. You can use this feature to trigger an Azure Function or webhook when a blob is created or deleted." This document presents Event Grid as the primary solution for low-latency

event-driven reactions to blob operations

which is the goal of the scenario.

The question implies the configuration of an Azure Container Instances (ACI) deployment using a YAML file. For a backend service like ContentUploadService, a common and secure architectural pattern is to deploy it within a virtual network, making it accessible only via a private IP address.

1. osType: Linux (C): Every ACI container group must have its operating system type defined. Linux is a valid and common choice for containerized applications.

2. type: Private (A): To deploy a container group into a virtual network with a private IP address, the ipAddress property's type must be set to Private. This restricts access to the service from within the virtual network, which is appropriate for a backend component.

Note: The option types: Private contains a typo; the correct property name in the ACI YAML schema is type.

B. Add the following markup to line CS24:osType: Windows

While Windows is a valid osType, the combination of a private IP and a Linux container is a more common pattern for microservices, and only one OS can be chosen.

D. Add the following markup to line CS23:types: Public

Configuring the service with a Public IP type would expose it to the internet, which is generally not recommended for a backend upload service due to security concerns.

1. Microsoft Documentation

Azure Container Instances: The osType property is mandatory for a container group. Its value must be either Linux or Windows.

Source: Microsoft Docs

"YAML reference for Azure Container Instances"

Section: osType.

2. Microsoft Documentation

Azure Container Instances: To deploy a container group with a private IP address within an Azure virtual network

you must specify an ipAddress object with the type property set to Private.

Source: Microsoft Docs

"Deploy container instances into an Azure virtual network"

Section: "Deploy with YAML".

3. Microsoft Documentation

Azure Container Instances: The ipAddress property within the container group properties is used to specify the IP address settings. The type sub-property can be Public or Private.

Source: Microsoft Docs

"YAML reference for Azure Container Instances"

Section: ipAddress.

ContentUploadService is deployed as an Azure Container Instance.

The most direct way to see the real-time web-server (stdout/stderr) log stream for an ACI is to attach to the running container.

az container attach --resource-group --name streams the HTTP server log output immediately, enabling you to diagnose request/response issues before you consider any other diagnostic step.

A. az webapp log – Works only for Azure App Service; ContentUploadService runs in ACI, not a Web App.

B. az ams live-output – Targets Azure Media Services live events, unrelated to container logging.

C. az monitor activity-log – Retrieves Azure control-plane events, not application-level HTTP server logs.

1. Microsoft Azure CLI Reference – az container attach: “Attach local standard output and error streams to a running container.” (docs.microsoft.com/cli/azure/container#az-container-attach

Section: Examples)

2. Microsoft Learn

AZ-204 Module “Implement and deploy containerized apps”: Step “Troubleshoot the ContentUploadService” – uses az container attach to view HTTP log output (learn.microsoft.com/training/modules/implement-containerized-solutions/).

3. Microsoft Azure Documentation – Azure Monitor Activity Log description: “Provides insight into subscription-level events… not application logs.” (docs.microsoft.com/azure/azure-monitor/platform/activity-log

Section: What is Activity Log?)

Data stored in the Azure Blob storage Archive tier is offline and must be rehydrated to an online tier (Hot or Cool) before it can be accessed. The process of rehydration has a defined latency. The standard rehydration priority, which is the default, can take up to 15 hours to complete. While a high-priority option exists for blobs under 10 GB that can complete in under an hour, a general Service-Level Agreement (SLA) must account for the standard, guaranteed timeframe. Therefore, documenting an SLA of up to 15 hours is appropriate for all data recovery requests from the archive tier.

A. at least two days: This is incorrect. The maximum time for standard priority rehydration is 15 hours, which is significantly less than two days (48 hours).

C. at least one day: This is incorrect. The standard rehydration SLA is a maximum of 15 hours, which is less than one day (24 hours).

D. between zero and 60 minutes: This is incorrect as it only reflects the high-priority rehydration option, which is not the default and has size limitations (under 10 GB). A general SLA should be based on the standard priority.

---

1. Microsoft Docs

"Rehydrate a blob from the archive tier": This document explicitly states the latency for rehydration. Under the "Rehydration options" section

it specifies

"A standard-priority rehydration request is processed in the order it was received and may take up to 15 hours to complete." It also notes

"A high-priority rehydration request... may complete in under one hour for objects under 10 GB in size." This confirms that the standard SLA is up to 15 hours.

Source: Microsoft Azure Documentation

"Rehydrate a blob from the archive tier via the Azure portal"

Section: "Rehydration options".

2. Microsoft Docs

"Access tiers for blob data": This document provides an overview of storage tiers. In the table comparing access tiers

for the Archive tier

the "Rehydration latency" is listed as "Up to 15 hours (standard priority)". This establishes the 15-hour timeframe as the standard service level for data recovery from the archive.

Source: Microsoft Azure Documentation

"Access tiers for blob data"

Section: "Summary of access tier options".