Examkin

Question

Difficulty: HardLog Analytics Workspaces and KQL Queries

An administrator is configuring log monitoring for an Azure virtual machine named VM1. VM1 sends its performance logs to a Log Analytics workspace named Workspace1. The workspace is configured to use the 'Use resource or workspace permissions' access mode. A user named User1 is assigned only the Reader role for VM1. User1 has no roles assigned for Workspace1 or its resource group. User1 needs to run a query to analyze the average CPU utilization of VM1 over the last 24 hours, aggregated in 1-hour intervals. Which action should the administrator instruct User1 to perform?

  1. Open the Logs blade of VM1 in the Azure portal, and run the query: Perf | where TimeGenerated > ago(24h) and CounterName == '% Processor Time' | summarize AvgCPU = avg(CounterValue) by bin(TimeGenerated, 1h)Answer
  2. B
    Open the Logs blade of Workspace1 in the Azure portal, and run the query: Perf | where Computer == 'VM1' and TimeGenerated > ago(24h) and CounterName == '% Processor Time' | summarize AvgCPU = avg(CounterValue) by bin(TimeGenerated, 1h)
  3. C
    Open the Logs blade of VM1 in the Azure portal, and run the query: workspace('Workspace1').Perf | where TimeGenerated > ago(24h) and CounterName == '% Processor Time' | summarize AvgCPU = avg(CounterValue) by bin(TimeGenerated, 1h)
  4. D
    Open the Logs blade of VM1 in the Azure portal, and run the query: AzureActivity | where TimeGenerated > ago(24h) and OperationNameValue == 'Microsoft.Compute/virtualMachines/read' | summarize Count = count() by bin(TimeGenerated, 1h)

Answer

Open the Logs blade of VM1 in the Azure portal and query the Perf table using the correct KQL aggregation syntax.
The correct option instructs User1 to query from the VM1 Logs blade, which leverages resource-context access. Since User1 has Reader rights on VM1 and the workspace allows resource-context queries, User1 can query VM1 logs. The KQL query correctly retrieves performance metrics, filters for CPU percentage, and aggregates data in 1-hour intervals.

Step-by-Step Solution

1
Determine the access context based on permissions.
Resource-context
User1 has Reader permissions on VM1 but no permissions on Workspace1. Since 'Use resource or workspace permissions' is enabled, User1 can query VM1's logs but only when scoped to VM1 (resource-context).
2
Select the portal entry point.
VM1 Logs blade
Opening Logs from VM1 automatically scopes the query to VM1's logs. Accessing from Workspace1 requires workspace-level permissions, which User1 lacks.
3
Construct the KQL query on the correct table.
Perf table query with binning
Performance metrics are sent to the Perf table. The query must filter by CounterName == '% Processor Time' and aggregate CounterValue using avg() by bin(TimeGenerated, 1h) to produce hourly averages.

Key Concept

Resource-context vs. Workspace-context access modes and KQL Performance table schema
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic