Examkin

Question

Difficulty: MediumLog Analytics Workspaces and KQL Queries

An administrator needs to analyze subscription activity logs in a Log Analytics workspace. The administrator must identify all successful deletions of Azure resource locks that occurred within the last 14 days.

Which of the following KQL queries will return the correct results? (Select two.)

  1. AzureActivity
    | where TimeGenerated > ago(14d)
    | where OperationNameValue =~ "Microsoft.Authorization/locks/delete"
    | where ActivityStatusValue =~ "Success"    Answer
  2. B
    AzureActivity
    | where TimeGenerated > 14d
    | where OperationNameValue == "Microsoft.Authorization/locks/delete"
    | where ActivityStatusValue == "Success"
  3. AzureActivity
    | where TimeGenerated >= ago(14d)
    | where OperationNameValue contains "locks/delete" and ActivityStatusValue == "Success"    Answer
  4. D
    AzureActivity
    | where TimeGenerated > ago(14d)
    | select OperationNameValue, ActivityStatusValue, Caller
    | where OperationNameValue == "Microsoft.Authorization/locks/delete" and ActivityStatusValue == "Success"

Answer

The KQL queries that correctly retrieve the successful deletions of resource locks in the last 14 days are the query using the ago(14d) function with case-insensitive operators (=~) and the query using the contains operator with a logical 'and' clause.
The correct queries successfully filter the logs using valid KQL syntax. The query that utilizes the =~ operator ensures case-insensitive matching for both the operation name and the success status, while referencing ago(14d) to limit the results to the last 14 days. The other correct query utilizes the contains operator to search for the substring 'locks/delete' and combines the conditions on a single line using the 'and' logical operator, which is functionally equivalent and syntactically valid.

Step-by-Step Solution

1
Filter by time range
Filter the rows using TimeGenerated and the ago(14d) function to capture events from the last 14 days.
Log Analytics stores the event timestamp in the TimeGenerated column, which must be compared to a datetime. The ago(14d) function returns the datetime representing 14 days ago.
2
Filter by operation type and status
Apply filters on OperationNameValue (using =~ or contains) and ActivityStatusValue (matching 'Success').
Resource lock deletions generate events under the operation name Microsoft.Authorization/locks/delete, and successful executions are marked as Success in the ActivityStatusValue column.
3
Apply valid KQL syntax
Ensure that the queries use correct operators (like project instead of select, and ago() instead of direct timespan values).
Using SQL keywords like select or comparing datetime to timespan values directly results in query compilation errors in Log Analytics.

Key Concept

Writing KQL queries to retrieve activity log events from a Log Analytics workspace using proper time, string comparison, and projection filters.
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic