Examkin

Question

Difficulty: MediumLog Analytics Workspaces and KQL Queries

An administrator needs to analyze subscription activity logs in a Log Analytics workspace. The administrator wants to identify all resource deletion operations that failed within the last 77 days. The results must be grouped by the user or service principal that initiated the operation (the caller) and show the count of failed deletions. Which two of the following Kusto Query Language (KQL) queries will retrieve the required information?

  1. AzureActivity | where TimeGenerated > ago(7d) | where OperationNameValue contains "delete" and ActivityStatusValue == "Failed" | summarize count() by CallerAnswer
  2. AzureActivity | where TimeGenerated >= ago(7d) | where OperationNameValue has "delete" | where ActivityStatusValue =~ "failed" | summarize count() by CallerAnswer
  3. C
    AzureActivity | where TimeGenerated > ago(7d) | where OperationNameValue contains "delete" and ActivityStatusValue == "Failed" | group by Caller
  4. D
    AzureActivity | filter TimeGenerated > ago(7d) | where OperationNameValue contains "delete" and ActivityStatusValue == "Failed" | summarize count() by Caller

Answer

The queries that retrieve the correct results use the where operator to filter records from the last 77 days, filter the operation name and status appropriately, and use the summarize operator to group the counts by caller.
The queries that use the where operator to filter by time, contains or has operators for the deletion operation, and the case-insensitive equality operator =~ or case-sensitive == to check for failed status, followed by the summarize count() by Caller clause are correct. In KQL, contains is a case-insensitive string operator, and has looks for full token matches (also case-insensitive). The =~ operator compares strings in a case-insensitive manner, making it valid for matching 'failed' regardless of its casing.

Step-by-Step Solution

1
Filter records from the AzureActivity table based on the time range of the last 77 days.
Using where TimeGenerated > ago(7d) or where TimeGenerated >= ago(7d) retrieves only the records created in the target time frame.
This limits the query scope to improve performance and satisfy the time range requirement.
2
Apply filter operators to select only failed delete operations.
Using where OperationNameValue contains "delete" (or has "delete") combined with ActivityStatusValue == "Failed" (or ActivityStatusValue =~ "failed") restricts results to the targeted event types.
This ensures only failed resource deletions are included in the aggregation.
3
Aggregate the filtered results by the caller identity.
Using summarize count() by Caller groups the remaining rows by the Caller column and calculates the count of operations.
KQL requires the summarize operator for aggregations rather than SQL's group by syntax.

Key Concept

Writing and structure of KQL queries using Azure Activity logs
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic