Examkin

Question

Difficulty: HardLog Analytics Workspaces and KQL Queries

An administrator is configuring diagnostics for an Azure Container Registry named acr1. Diagnostic logs are configured to send repository events to a Log Analytics workspace.

You need to write a Kusto Query Language (KQL) query to count the number of successful image pull operations (where the operation is RepositoryPull and the result is Success) initiated from IP addresses outside of the corporate subnet 192.168.0.0/16 during the last 48 hours. The results must be grouped by the repository name and the caller's IP address.

Which KQL query should you run?

  1. ContainerRegistryRepositoryEvents
    | where TimeGenerated > ago(48h)
    | where OperationName == "RepositoryPull" and Result == "Success"
    | where not(ipv4_is_in_range(CallerIpAddress, "192.168.0.0/16"))
    | summarize PullCount = count() by Repository, CallerIpAddress    Answer
  2. B
    AzureActivity
    | where TimeGenerated > ago(48h)
    | where OperationNameValue == "Microsoft.ContainerRegistry/registries/pull"
    | where ActivityStatus == "Success"
    | where not(ipv4_is_in_range(CallerIpAddress, "192.168.0.0/16"))
    | summarize PullCount = count() by Resource, CallerIpAddress
  3. C
    ContainerRegistryRepositoryEvents
    | summarize PullCount = count() by Repository, CallerIpAddress
    | where TimeGenerated > ago(48h)
    | where OperationName == "RepositoryPull" and Result == "Success"
    | where ipv4_is_in_range(CallerIpAddress, "192.168.0.0/16") == false
  4. D
    ContainerRegistryRepositoryEvents
    | where TimeGenerated >= ago(48h)
    | where OperationName = "RepositoryPull" and Result = "Success"
    | where CallerIpAddress != "192.168.0.0/16"
    | group by Repository, CallerIpAddress

Answer

The query starting with ContainerRegistryRepositoryEvents and using not(ipv4_is_in_range(CallerIpAddress, '192.168.0.0/16')) to filter the subnet is correct.
The correct query targets the ContainerRegistryRepositoryEvents table, which contains data-plane event logs for the Azure Container Registry. It applies filters for the last 48 hours using TimeGenerated > ago(48h), restricts the logs to successful pull operations, excludes the specified subnet using the not(ipv4_is_in_range()) function, and groups the count of operations using summarize PullCount = count() by Repository, CallerIpAddress.

Step-by-Step Solution

1
Select the log source table.
ContainerRegistryRepositoryEvents
Data-plane events like registry pull operations are logged in resource-specific diagnostic tables rather than the AzureActivity control-plane log table.
2
Apply the time range and operation status filters.
TimeGenerated > ago(48h) and OperationName == 'RepositoryPull' and Result == 'Success'
Filters must be applied early in the pipeline to optimize query performance and ensure columns are not projected away before filtering.
3
Exclude the corporate subnet range.
not(ipv4_is_in_range(CallerIpAddress, '192.168.0.0/16'))
Direct inequality comparison (!=) checks for literal string match rather than evaluating IP addresses within a CIDR subnet block. The ipv4_is_in_range function evaluates subnet membership correctly.
4
Aggregate the counts by repository and IP address.
summarize PullCount = count() by Repository, CallerIpAddress
The KQL summarize operator with count() groups and aggregates the filtered rows as required.

Key Concept

Selecting correct resource diagnostic tables and performing CIDR-based IP filtering in KQL.
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic