Examkin

Question

Difficulty: HardLog Analytics Workspaces and KQL Queries

An administrator needs to monitor access requests to an Azure Key Vault named KV1. The administrator must write a Kusto Query Language (KQL) query in a Log Analytics workspace to identify all key retrieval operations that resulted in an HTTP status code of 401 (Unauthorized) within the past 24 hours. The administrator also needs to ensure that KV1 is configured to send the necessary log data to the workspace.

Which of the following actions or query fragments must be implemented to achieve this goal? (Select TWO)

  1. Write the following query fragment:
    kql
    AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where ResourceProvider == "MICROSOFT.KEYVAULT"
    | where OperationName == "KeyGet" and ResultSignature == "401"
    Answer
  2. Configure a diagnostic setting on KV1 to send the AuditEvent log category to the Log Analytics workspace.Answer
  3. C
    Write the following query fragment:
    kql
    AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where ResourceProvider == "MICROSOFT.KEYVAULT"
    | filter OperationName == "KeyGet" and ResultSignature == 401
  4. D
    Configure a diagnostic setting on KV1 to send only the AllMetrics metric category to the Log Analytics workspace.
  5. E
    Create an Azure Monitor alert rule with an action group that contains only an empty email notification contact list.

Answer

To achieve the monitoring goal, the administrator must configure a diagnostic setting on the Key Vault to forward the AuditEvent log category to the Log Analytics workspace, and run a KQL query on the AzureDiagnostics table filtering by the Key Vault ResourceProvider, the KeyGet OperationName, and a string-matched ResultSignature of "401" within the past 24 hours.
The correct actions require first establishing the data pipeline by configuring the Key Vault diagnostic settings to send AuditEvent logs to the Log Analytics workspace. Once routed, the data is queryable in the AzureDiagnostics table. The correct KQL query uses the 'where' operator to filter by the MICROSOFT.KEYVAULT ResourceProvider, the KeyGet OperationName, and compares the ResultSignature column against the string value "401" within the past 24 hours.

Step-by-Step Solution

1
Enable the log source ingestion in the Azure Key Vault diagnostic settings.
The AuditEvent log category is configured to be sent to the Log Analytics workspace.
By default, Azure Key Vault logs are not stored. Sending the AuditEvent category routes operations data to the workspace, creating and populating the AzureDiagnostics table.
2
Filter query data by resource provider and time range.
The KQL query retrieves AzureDiagnostics logs where TimeGenerated > ago(24h) and ResourceProvider == "MICROSOFT.KEYVAULT".
This restricts the query context to Key Vault logs generated within the designated 24-hour analysis window.
3
Filter by operation and status code using proper types.
The query applies the filter OperationName == "KeyGet" and ResultSignature == "401".
This isolates key retrieval requests and checks for unauthorized access. The status code must be a string comparison because ResultSignature is a string column.

Key Concept

Log Analytics Workspace data routing via Diagnostic Settings and parsing structured logs using valid Kusto Query Language (KQL) syntax, operators, and schemas.
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic