Examkin

Soru

Zorluk: ZorLog Analytics Workspaces and KQL Queries

An administrator configures diagnostic settings for an Azure Key Vault named Vault1 to send all audit logs to a Log Analytics workspace. In the diagnostic settings configuration, the administrator selects the Resource-specific destination table option.

The administrator needs to write a KQL query that retrieves the count of failed secret retrieval (SecretGet) operations over the last seven days, grouped by the name of the secret.

Which KQL query should the administrator run?

  1. AKVAudit
    | where TimeGenerated > ago(7d)
    | where OperationName == "SecretGet"
    | where ResultSignature != "200"
    | summarize count() by ObjectName    Cevap
  2. B
    AzureDiagnostics
    | where TimeGenerated > ago(7d)
    | where OperationName == "SecretGet"
    | where ResultSignature != "200"
    | summarize count() by ObjectName_s
  3. C
    AKVAudit
    | where TimeGenerated > ago(7d)
    | where OperationName == "SecretGet"
    | where ResultSignature != "200"
    | summarize count() by ObjectName_s
  4. D
    AKVAudit
    | where TimeGenerated > ago(7d)
    | where OperationName == "SecretGet"
    | where ResultSignature != "200"
    | group by ObjectName

Cevap

The query that targets the AKVAudit table, filters by a TimeGenerated within the last seven days, specifies the 'SecretGet' OperationName, filters out successful '200' responses in ResultSignature, and aggregates the count using the summarize operator by the ObjectName column.
The correct query targets the AKVAudit table because Key Vault diagnostic logs are directed to this table when the Resource-specific destination option is selected. It correctly filters for the 'SecretGet' operation type, identifies failures by checking for a ResultSignature other than the HTTP success status code of '200', and aggregates the results by the ObjectName column using the KQL summarize operator.

Adım Adım Çözüm

1
Determine the target table for the Key Vault logs based on the diagnostic settings configuration.
Because the Resource-specific option is selected, Key Vault logs are sent to the dedicated AKVAudit table rather than the shared AzureDiagnostics table.
Choosing the correct table is necessary to ensure the query returns data.
2
Identify the correct column name for the secret name in the target table.
Resource-specific tables use clean, predefined schemas without type suffixes, meaning the secret name is in ObjectName instead of ObjectName_s.
Referencing the incorrect column name will result in a query failure or empty results.
3
Construct the filter and aggregation clauses using valid KQL syntax.
Apply 'where TimeGenerated > ago(7d)' to filter by time, 'where OperationName == "SecretGet"' and 'where ResultSignature != "200"' to filter for failed secret retrievals, and 'summarize count() by ObjectName' to group and aggregate.
Using correct KQL operators such as summarize and by ensures the query compiles and returns the requested count.

Anahtar Kavram

Querying resource-specific Azure diagnostic logs using KQL
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Log Analytics Workspaces and KQL Queries

Bu konudan daha fazla soru