Examkin

Question

Difficulty: HardLog Analytics Workspaces and KQL Queries

An administrator needs to identify unauthorized access attempts to an Azure Key Vault named KV-Prod. You are tasked with writing a Kusto Query Language (KQL) query in Log Analytics to retrieve all secret retrieval operations (SecretGet) that failed due to unauthorized access (HTTP status codes 401 or 403) within the last 24 hours. The query must only output the columns for TimeGenerated, Resource, CallerIPAddress, and ResultSignature. Which KQL query should you use?

  1. AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where ResourceProvider == "MICROSOFT.KEYVAULT"
    | where OperationName == "SecretGet"
    | where ResultSignature in ("401", "403")
    | project TimeGenerated, Resource, CallerIPAddress, ResultSignature    Answer
  2. B
    AzureDiagnostics
    | project TimeGenerated, Resource, CallerIPAddress, ResultSignature
    | where TimeGenerated > ago(24h) and ResourceProvider == "MICROSOFT.KEYVAULT"
    | where OperationName == "SecretGet" and (ResultSignature == "401" or ResultSignature == "403")
  3. C
    SELECT TimeGenerated, Resource, CallerIPAddress, ResultSignature
    FROM AzureDiagnostics
    WHERE TimeGenerated > ago(24h)
    AND ResourceProvider = 'MICROSOFT.KEYVAULT'
    AND OperationName = 'SecretGet'
    AND ResultSignature IN ('401', '403')
  4. D
    AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where ResourceProvider = "MICROSOFT.KEYVAULT"
    | where OperationName = "SecretGet"
    | where ResultSignature == "401" or "403"
    | project TimeGenerated, Resource, CallerIPAddress, ResultSignature

Answer

The query that starts with the AzureDiagnostics table, filters for records from the last 24 hours, restricts the resource provider to Microsoft Key Vault, filters for SecretGet operations and status codes 401 or 403, and then projects the required columns.
The correct query correctly follows the tabular operator syntax of KQL. It first filters the AzureDiagnostics table by TimeGenerated, ResourceProvider, OperationName, and ResultSignature, and then uses the project operator to output only the requested columns.

Step-by-Step Solution

1
Filter by time range first to optimize query performance.
The query begins with `AzureDiagnostics | where TimeGenerated > ago(24h)`.
Filtering by time first minimizes the dataset scanned by subsequent operators.
2
Filter by Key Vault resource provider and SecretGet operation.
Add `| where ResourceProvider == "MICROSOFT.KEYVAULT"` and `| where OperationName == "SecretGet"`.
This isolates diagnostic logs originating from Azure Key Vault specifically for secret retrieval actions.
3
Filter for unauthorized or forbidden HTTP status codes.
Add `| where ResultSignature in ("401", "403")`.
This captures diagnostic logs where the request was rejected due to authentication or authorization failures.
4
Project the specific columns requested in the output.
Add `| project TimeGenerated, Resource, CallerIPAddress, ResultSignature`.
This limits the returned columns to only those requested, completing the query.

Key Concept

Writing KQL queries using valid syntax and operator sequencing to analyze Azure diagnostics data.
Estimated Time:2m 0s
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic