Examkin

Question

Difficulty: MediumLog Analytics Workspaces and KQL Queries

An administrator needs to identify all virtual machines that were successfully deleted in an Azure subscription during the last 24 hours. The diagnostic data is sent to a Log Analytics workspace.

Which of the following Kusto Query Language (KQL) queries will successfully return the records? (Select two.)

  1. AzureActivity
    | where TimeGenerated > ago(24h)
    | where OperationNameValue =~ "Microsoft.Compute/virtualMachines/delete" and ActivityStatusValue =~ "Succeeded"    Answer
  2. AzureActivity
    | where TimeGenerated >= ago(1d)
    | where OperationName == "Microsoft.Compute/virtualMachines/delete"
    | where ActivityStatus == "Succeeded"    Answer
  3. C
    AzureActivity
    | where TimeGenerated > ago(24h)
    | where OperationNameValue = "Microsoft.Compute/virtualMachines/delete" and ActivityStatusValue = "Succeeded"
  4. D
    SELECT * FROM AzureActivity
    WHERE TimeGenerated > ago(24h)
    AND OperationNameValue == "Microsoft.Compute/virtualMachines/delete"

Answer

The two correct queries start with the AzureActivity table name and use valid KQL filtering syntax, utilizing either the double equals (==) or the case-insensitive (=~) comparison operator along with the ago() function for time filtering.
The correct queries successfully retrieve the virtual machine deletion events by referencing the AzureActivity table, filtering by the last 24 hours using ago(24h) or ago(1d), and filtering for the delete operation and succeeded status using correct comparison operators (== or =~).

Step-by-Step Solution

1
Identify the target table and time constraint.
The target table is AzureActivity and the time range is the last 24 hours. The ago(24h) or ago(1d) functions must be used with the TimeGenerated column.
Log Analytics stores Azure subscription activity logs in the AzureActivity table, and time filters are typically applied to TimeGenerated.
2
Identify the deletion operation and status filter.
The operation for virtual machine deletion is 'Microsoft.Compute/virtualMachines/delete' and the successful status is 'Succeeded'.
Filtering for these specific values ensures only actual successful deletions are returned.
3
Validate comparison operators and structure.
Valid options must use tabular KQL flow (table name first, then pipes) and correct equality operators (== or =~). Single equals (=) or SQL SELECT statements are invalid.
KQL requires == or =~ for comparison in where clauses, and does not support SQL syntax.

Key Concept

Writing KQL queries on AzureActivity to filter resource events by time, operation, and status.
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic