AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Contoso is building a serverless application using Azure Functions. One function needs to read messages from an Azure Event Hub and store them in Azure Blob Storage. The function uses the Event Hubs trigger. The team wants to authenticate to both Event Hubs and Blob Storage using managed identities. The Function app has system-assigned managed identity enabled. Which role assignments are required on the Event Hubs namespace and the storage account?
⚠ Common exam trap
Candidates often confuse the 'Data Sender' role (for output bindings) with the 'Data Receiver' role (for triggers), or assume a generic 'Reader' role exists for Event Hubs, leading them to pick options with invalid or mismatched roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the 'Azure Event Hubs Data Receiver' role to the managed identity on the Event Hubs namespace. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account.
The function uses an Event Hubs trigger, which requires the 'Azure Event Hubs Data Receiver' role to read messages from the Event Hubs namespace. To write data to Azure Blob Storage, the 'Storage Blob Data Contributor' role is needed on the storage account. Both roles are assigned to the function app's system-assigned managed identity, enabling secure, keyless authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the 'Azure Event Hubs Data Sender' role and 'Storage Blob Data Reader' role.
Why it's wrong here
The 'Azure Event Hubs Data Sender' role grants permissions to send messages to an Event Hub, not to receive or consume them. A serverless application designed to process events from an Event Hub requires a role that enables reading from the Event Hub. Furthermore, the 'Storage Blob Data Reader' role only allows read access to blobs, which is insufficient if the application needs to write processed data, manage checkpoints, or perform any other write operations to a storage account.
- ✗
Assign the 'Azure Event Hubs Data Reader' role (which does not exist) and 'Storage Blob Data Contributor' role.
Why it's wrong here
This option is incorrect because 'Azure Event Hubs Data Reader' is not a valid built-in Azure Role-Based Access Control (RBAC) role. To consume events from an Azure Event Hub, the correct and specific role required is 'Azure Event Hubs Data Receiver'. While 'Storage Blob Data Contributor' would correctly provide the necessary permissions for writing to blob storage, the non-existent Event Hubs role makes this combination unworkable for the intended purpose.
- ✓
Assign the 'Azure Event Hubs Data Receiver' role to the managed identity on the Event Hubs namespace. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account.
Why this is correct
This option correctly assigns the necessary permissions for a serverless application to consume events from Event Hubs and interact with blob storage. The 'Azure Event Hubs Data Receiver' role grants the managed identity the specific authorization to read and process messages from an Event Hub. Simultaneously, the 'Storage Blob Data Contributor' role provides comprehensive access to read, write, and delete blobs, which is essential for tasks such as managing Event Hub consumer group checkpoints or storing processed data outputs within an Azure Storage Account, adhering to the principle of least privilege.
- ✗
Assign the 'Azure Event Hubs Data Owner' role and 'Storage Blob Data Owner' role.
Why it's wrong here
Assigning the 'Azure Event Hubs Data Owner' and 'Storage Blob Data Owner' roles grants excessively broad permissions to the managed identity. 'Owner' roles provide full control over the respective resources, including the ability to manage access, which far exceeds the operational requirements of a serverless application that only needs to consume events and write data to storage. This approach violates the principle of least privilege, introducing unnecessary security risks by granting more permissions than are functionally required for the application to operate securely.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Durable Functions
Durable Functions is an extension of Azure Functions that lets you write stateful workflows in code, managing complex sequences of tasks, retries, and delays automatically.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.