Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are building an application that subscribes to an Azure Event Grid topic using a custom webhook endpoint. The endpoint is a web API hosted on Azure App Service. You need to ensure that only Event Grid can invoke your webhook endpoint, preventing unauthorized requests. What should you implement in your webhook endpoint?
⚠ Common exam trap
Many candidates assume IP whitelisting (Option A) is sufficient for security, but Event Grid's outbound IPs are not static or documented for custom webhooks, making this approach unreliable and unsupported.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Validate the Aeg-SasKey header against a shared secret known to Event Grid
Event Grid sends an Aeg-SasKey header with each request to a custom webhook endpoint. By validating this header against a pre-configured shared secret (the same key used when creating the event subscription), the endpoint can confirm that the request originated from Event Grid. This prevents unauthorized actors from invoking the webhook, as they would not possess the shared secret.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IP address filtering to allow only the Azure Event Grid service tag
Why it's wrong here
While Azure service tags can simplify network security group (NSG) rules by representing a group of IP prefixes for a given Azure service, relying solely on them for authenticating Event Grid webhook requests is insufficient. Event Grid's outbound IP addresses are dynamic and can change, making static IP filtering unreliable. More critically, a service tag only indicates the traffic originates from an Azure service, not that it specifically came from your Event Grid subscription or is a legitimate event delivery, as other malicious actors could potentially spoof traffic from within the same service tag range.
- ✓
Validate the Aeg-SasKey header against a shared secret known to Event Grid
Why this is correct
This is the recommended and most secure method for authenticating Event Grid webhook deliveries. Event Grid includes an Aeg-SasKey HTTP header in every event delivery request, containing a Shared Access Signature (SAS) key. Your webhook endpoint should validate this key against the access key configured for your Event Grid subscription. This cryptographic validation confirms that the request genuinely originated from your Event Grid topic or domain, ensuring the authenticity and integrity of the event delivery.
- ✗
Require a client certificate that you upload to Event Grid
Why it's wrong here
Azure Event Grid does not support client certificate authentication for outbound event deliveries to webhook endpoints. While client certificates are used in some secure communication patterns, Event Grid's architecture for delivering events to custom HTTP endpoints relies on other authentication mechanisms. Attempting to configure Event Grid to provide a client certificate for mutual TLS authentication with your endpoint is not a supported feature.
- ✗
Use an OAuth 2.0 token from Microsoft Entra ID
Why it's wrong here
Event Grid does not utilize OAuth 2.0 tokens from Microsoft Entra ID for authenticating event deliveries to webhook endpoints. While OAuth tokens are commonly used for authenticating management plane operations with Azure services or for securing API calls between services, Event Grid's data plane delivery mechanism to custom HTTP endpoints relies on the Aeg-SasKey header for sender authentication. Your webhook endpoint would not receive an OAuth token to validate from Event Grid.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.