An administrator needs to monitor role-based access control (RBAC) changes in an Azure subscription. You must write a KQL query in Log Analytics to retrieve all logs from the AzureActivity table related to the creation or deletion of Azure RBAC role assignments over the last 14 days. The query must display the time the operation occurred, the user who initiated the action, and the operation name. Which two KQL queries should the administrator use to achieve this goal? (Select two.)
- AzureActivity
| where TimeGenerated >= ago(14d)
| where OperationNameValue startswith "Microsoft.Authorization/roleAssignments"
| project TimeGenerated, Caller, OperationNameValueCevap - AzureActivity
| where TimeGenerated > ago(14d)
| where OperationNameValue in ("Microsoft.Authorization/roleAssignments/write", "Microsoft.Authorization/roleAssignments/delete")
| project TimeGenerated, Caller, OperationNameValueCevap - CAzureActivity
| where TimeGenerated >= ago(14d)
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/*"
| project TimeGenerated, Caller, OperationNameValue - DAzureActivity
| where TimeGenerated >= ago(14d)
| where OperationNameValue = "Microsoft.Authorization/roleAssignments/write" or OperationNameValue = "Microsoft.Authorization/roleAssignments/delete"
| project TimeGenerated, Caller, OperationNameValue
Cevap
The queries that use the 'startswith' operator to match the prefix of the role assignment operations, or the 'in' operator with the exact operation names, and use the double equals sign (==) for comparison, are correct.
The correct queries successfully filter the logs to the past 14 days, use valid KQL syntax ('startswith' or the 'in' operator) to target both 'write' and 'delete' operations for role assignments, and project the required fields.
Adım Adım Çözüm
Anahtar Kavram
Writing valid KQL queries in Log Analytics with correct operators for filtering and projection.