Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are configuring an Azure Event Grid subscription to trigger an Azure Function when a blob is created in a storage account. However, the function is not being triggered. You have verified that the function endpoint is reachable and the storage account is in the same region. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on storage account networking or function app settings (like AzureWebJobsStorage) instead of recognizing that Event Grid requires explicit RBAC permissions when the function endpoint is secured with Azure AD authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Event Grid subscription does not have the required RBAC role on the function.
If the Azure Function app is secured with Azure AD authentication, and the Event Grid subscription is configured to use a managed identity for delivery, then that managed identity requires an appropriate RBAC role (e.g., 'Azure Function Data Sender' or a custom role allowing `Microsoft.Web/sites/functions/invoke/action`) on the function app to successfully invoke the function. Without this role, Event Grid cannot authorize its call to the function, even if the endpoint is network reachable. This is a common misconfiguration when the function is protected by Azure AD authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The storage account has public network access disabled.
Why it's wrong here
Disabling public network access on a storage account does not inherently prevent Event Grid from delivering events to a function app. Event Grid can successfully deliver events to secure endpoints, including function apps, by leveraging private endpoints or service endpoints configured for the function app. As long as the Event Grid system topic has network access to the function app's private endpoint, events will flow, making public network access status irrelevant for the trigger mechanism itself.
- ✗
The AzureWebJobsStorage connection string is missing from the function app settings.
Why it's wrong here
The AzureWebJobsStorage connection string is crucial for the Azure Functions runtime itself, used for managing host keys, logging, and internal state. However, it is not directly involved in the mechanism by which an Event Grid subscription triggers a function. Event Grid delivers events via HTTP POST requests to the function's HTTP trigger endpoint, independent of the function app's internal storage configuration. Therefore, a missing AzureWebJobsStorage setting would cause general function app issues but not specifically prevent an Event Grid trigger from attempting to invoke the function.
- ✗
Blob versioning is not enabled on the storage account.
Why it's wrong here
Blob versioning is a feature of Azure Blob Storage that automatically saves previous versions of a blob when it is modified or deleted, primarily for data recovery and auditing purposes. While useful for managing data integrity within the storage account, it has no bearing on whether Event Grid can detect new blob creations or modifications and subsequently trigger a function. Event Grid subscriptions listen for specific event types, such as Microsoft.Storage.BlobCreated, regardless of whether versioning is enabled on the source blob container.
- ✓
The Event Grid subscription does not have the required RBAC role on the function.
Why this is correct
For an Event Grid subscription to successfully deliver events to an Azure Function app, the Event Grid system topic's managed identity or service principal requires appropriate permissions on the target function. Specifically, the 'Event Grid Data Sender' role must be assigned to the function app or its containing resource group. Without this role, Event Grid lacks the necessary authorization to invoke the function's HTTP endpoint, resulting in delivery failures even if the endpoint is otherwise accessible. This RBAC assignment ensures secure communication and event delivery.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Azure Event Grid
Azure Event Grid is a fully managed event routing service that allows applications and services to react to events in real time using a publish-subscribe model.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.