Examkin

Question

Difficulty: Very hardLog Analytics Workspaces and KQL Queries

An administrator is configuring a monitoring solution for a set of Azure Virtual Machines that send diagnostics to a central Log Analytics workspace. The administrator must meet the following requirements:
1. Ensure that developers can only view diagnostic logs for the specific virtual machines they own (resource-context access), without granting them access to view logs of other resources in the workspace.
2. Write a query to retrieve the most recent CPU utilization percentage (using the `% Processor Time` counter from the `Processor` object) for each virtual machine, returning only the records where this latest CPU utilization value exceeds 80%.

Which of the following configurations and Kusto Query Language (KQL) queries should the administrator implement? (Select TWO.)

  1. Configure the Log Analytics workspace access control mode to 'Use resource or workspace permissions' and assign the Reader role to the developers on their respective virtual machines.Answer
  2. B
    Configure the Log Analytics workspace access control mode to 'Require workspace permissions' and assign the Log Analytics Reader role to the developers on the workspace.
  3. Run the query: Perf | where CounterName == "% Processor Time" and ObjectName == "Processor" | summarize arg_max(TimeGenerated, CounterValue) by Computer | where CounterValue > 80Answer
  4. D
    Run the query: Perf | summarize arg_max(TimeGenerated, CounterValue) by Computer | where CounterName == "% Processor Time" and CounterValue > 80

Answer

Configure the Log Analytics workspace access control mode to 'Use resource or workspace permissions', assign the Reader role to developers on their respective virtual machines, and run the KQL query that filters by CPU utilization before using the summarize arg_max operator.
The correct configuration uses 'Use resource or workspace permissions' to enable resource-context access, which respects Azure RBAC permissions granted on individual virtual machines. The correct KQL query filters the Perf table for CPU utilization before running summarize arg_max, ensuring that the latest CPU measurement is returned and that the query does not fail due to referencing columns that are not projected by the arg_max function.

Step-by-Step Solution

1
Determine the correct access control mode for resource-context log access.
The workspace must be set to 'Use resource or workspace permissions', and permissions must be granted at the resource (VM) level.
This allows resource-context access where permissions on individual resources dictate which logs a user can view, preventing access to unauthorized logs in the same workspace.
2
Evaluate KQL filter placement for correct metric retrieval.
Filter the Perf table for CounterName == '% Processor Time' and ObjectName == 'Processor' before summarizing.
Filtering first ensures that arg_max evaluates only the CPU performance records, finding the latest CPU measurement instead of the latest record of any arbitrary performance counter.
3
Verify schema projection in the KQL summarization step.
Use summarize arg_max(TimeGenerated, CounterValue) by Computer, which yields only Computer, TimeGenerated, and CounterValue.
Since CounterName is not projected, any filter referencing CounterName must be executed before the summarize operator to avoid compilation errors.
4
Filter final aggregated CPU metrics.
Apply the filter where CounterValue > 80 on the projected output.
This isolates virtual machines whose most recent CPU utilization measurement is strictly greater than 80%.

Key Concept

Log Analytics access control modes (resource-context vs workspace-context) and KQL query pipeline optimization and projection behavior.
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic