Examkin

Soru

Zorluk: OrtaLog Analytics Workspaces and KQL Queries

An administrator needs to write a KQL query in Log Analytics to identify all failed secret retrieval operations (SecretGet) in an Azure Key Vault. The query must find operations that failed due to unauthorized access (status codes 401 or 403) within the last 7 days.

Which two of the following KQL queries will return the correct results? (Select TWO)

  1. AzureDiagnostics
    | where TimeGenerated > ago(7d)
    | where ResourceProvider == "MICROSOFT.KEYVAULT" and OperationName == "SecretGet"
    | where ResultSignature in ("401", "403")    Cevap
  2. AzureDiagnostics
    | where ResourceProvider == "MICROSOFT.KEYVAULT"
    | where OperationName == "SecretGet"
    | where ResultSignature == "401" or ResultSignature == "403"
    | where TimeGenerated >= ago(7d)    Cevap
  3. C
    AzureDiagnostics
    | where TimeGenerated > ago(7d)
    | where ResourceProvider = "MICROSOFT.KEYVAULT"
    | where OperationName = "SecretGet"
    | where ResultSignature == 401 or 403
  4. D
    AzureDiagnostics
    | where TimeGenerated > ago(7d)
    | select ResourceProvider, OperationName, ResultSignature
    | where ResourceProvider == "MICROSOFT.KEYVAULT"
    | where OperationName == "SecretGet"
    | where ResultSignature in ("401", "403")

Cevap

The correct queries are the ones that use the double equals operator (`==`) for equality comparison, filter using the string values `"401"` and `"403"`, and do not use the SQL-style `select` keyword.
The correct queries use valid Kusto Query Language (KQL) syntax to filter the Log Analytics workspace. Specifically, they utilize the double equals operator (`==`) for equality comparison, filter the time range properly with the `ago` function, and query `ResultSignature` against string values (since diagnostic status codes in `AzureDiagnostics` are stored as strings). The order of the `where` clauses does not affect the correctness of the KQL query, so both variations are valid.

Adım Adım Çözüm

1
Filter the dataset to the correct time range and resource provider.
The query includes `where TimeGenerated > ago(7d)` and `where ResourceProvider == "MICROSOFT.KEYVAULT"`.
This restricts the search scope to Key Vault logs from the past 7 days to optimize query performance.
2
Filter by the specific operation and failure status codes.
The query applies `where OperationName == "SecretGet"` and checks for `ResultSignature` values of "401" or "403".
This retrieves only the failed secret retrieval operations.
3
Verify KQL syntax and operator usage.
Use double equals (`==`) for comparisons and either `in ("401", "403")` or `ResultSignature == "401" or ResultSignature == "403"`.
KQL uses `==` for equality comparison and requires explicit operands for logical conditions, while columns must be projected using `project` rather than SQL `select`.

Anahtar Kavram

Writing valid KQL queries in Azure Log Analytics to filter diagnostic logs using proper comparison operators, string matching, and standard KQL syntax.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Log Analytics Workspaces and KQL Queries

Bu konudan daha fazla soru