Question 970 An operations analyst must filter log records by timestamp and failure text across many services. Which query language is commonly used for Log Analytics? Filter exported log CSV manually instead of using the available KQL query A virtual machine BIOS configuration format Kusto Query Language (KQL) An ARM template parameter file alone Explanation Correct Answer C:KQL supports filtering and aggregating Azure Monitor log data. Incorrect Answers A:Offline filtering is not the native workspace query language for supported Log Analytics log tables. B:Guest firmware doesn't query workspace logs. D:A deployment definition isn't a log query language.
Question 971 An employee can see the Log Analytics workspace but cannot view sensitive log records. What authorization topic should be checked? Assume workspace Reader visibility grants unrestricted access to all collected log tables Effective permissions to query workspace data and applicable table/resource scopes Only the pricing calculator currency Treat directory sign-in success alone as authorization to read every workspace table Explanation Correct Answer B:Workspace metadata visibility doesn't necessarily grant all log data rights. Incorrect Answers A:Viewing workspace metadata is not equivalent to every log-data read permission at applicable table and resource scopes. C:Cost model inputs don't grant data access. D:Authentication does not supersede applicable workspace, table and resource-scope data permissions.
Question 972 A team has thousands of cloud failure events but wants just errors from a particular application service over the last hour. What query approach is appropriate? Use an unfiltered query that returns every log row even when only errors are needed Read only the alphabetical list of Azure subscriptions Filter relevant log tables by resource identity, severity and time window in KQL Resize every VM before examining evidence Explanation Correct Answer C:Targeted queries narrow incident evidence to the affected workload. Incorrect Answers A:A broad query ignores the requested error-only evidence and can create excess data processing. B:Names don't reveal exception messages. D:Blind capacity changes aren't a log investigation.
Question 973 An on-call engineer wants error counts per 15-minute interval for a service. Which analytics operation helps? Change the storage account's Hot access tier Sort raw error logs by timestamp without grouping them into intervals Add a VNet peering link to the query text Summarize relevant log events into time bins Explanation Correct Answer D:Aggregated log queries reveal when exception volume rises. Incorrect Answers A:Blob temperature doesn't aggregate errors. B:Sorting events does not produce the requested counts per 15-minute time window. C:Peering isn't a log aggregation operation.
Question 974 An organization sends verbose logs from every test resource to one workspace and sees costs rise. Which lever should it assess? Resize the affected VM without adjusting verbose log volume or retention Telemetry ingestion volume, filtering and retention settings Only the VM resource name length Reduce dashboard refresh frequency without addressing excessive log ingestion or retention Explanation Correct Answer B:Log analytics spending depends partly on data volume and retention choices. Incorrect Answers A:VM CPU capacity is a separate meter and does not directly fix high workspace log ingestion charges. C:Names don't account for high ingest bytes. D:Changing visualization frequency does not by itself reduce the collected volume or stored retention of verbose telemetry.
Question 975 An investigator cannot query six-month-old logs because the workspace only retains shorter hot-query history. What should be checked? Assume deleting a dashboard immediately deletes historical workspace log records Increase the workspace's real-time query timeout without examining log-retention settings Configured retention or archive options and permitted retrieval methods The VM's temporary disk type only Explanation Correct Answer C:Older data availability depends on chosen retention and archive configuration. Incorrect Answers A:Visualization removal is not a log-retention policy; data follows the workspace retention configuration. B:Query timeout cannot retrieve log data that has already left the hot-query retention window. D:Guest disk doesn't determine workspace data retention.
Question 976 A storage account generates diagnostic logs, but they never appear in a workspace. What initial configuration should be reviewed? Whether supported diagnostic categories are enabled and sent to the intended workspace Only the storage account's name length Only the region-pair friendly name Only VM scale-set capacity Explanation Correct Answer A:Resources don't necessarily stream every diagnostic category automatically. Incorrect Answers B:Names don't enable diagnostic collection. C:Geo pairing doesn't route logs. D:Compute instances don't configure storage diagnostics.
Question 977 A manager wants the exact text of failed requests, but the operator only has a CPU chart. Which telemetry difference matters? Detailed log/event collection is needed beyond aggregate performance metrics A VM availability set can reconstruct HTTP payloads Metrics always include the full HTTP error body for every request Treat numerical Azure Monitor metrics as automatically containing complete exception call stacks Explanation Correct Answer A:CPU measurements don't contain request exception messages. Incorrect Answers B:Compute placement doesn't record request logs. C:Metrics are numeric summaries. D:Metrics and detailed collected logs carry different kinds of telemetry and cannot always substitute for one another.
Question 978 A team proposes copying customer passwords into central log records to simplify debugging. What should administrators do? Make the workspace anonymously readable for faster troubleshooting Treat a resource tag named Private as sufficient protection Store plaintext passwords in more log workspaces for redundancy Avoid logging secrets and apply least-privilege access/retention to telemetry Explanation Correct Answer D:Diagnostic value doesn't justify exposing sensitive authentication material. Incorrect Answers A:Public telemetry could leak sensitive data. B:Tags aren't confidentiality controls. C:Replication increases exposure.
Question 979 An enterprise needs telemetry processing to satisfy specific data residency requirements. What workspace planning decision matters? Assume all log records always remain in the app's VNet subnet Set the subscription display name to the country Move the dashboard display to another region without changing workspace placement Select supported workspace regions and evaluate data movement and retention behavior Explanation Correct Answer D:Telemetry location and transfers may have legal and operational implications. Incorrect Answers A:A workspace is a separate Azure service with location settings. B:Names don't determine data location. C:Dashboard geography does not establish where collected log data is actually stored.
Question 980 A support engineer manually queries error logs and assumes stakeholders will automatically be notified of future matches. What extra configuration is needed? A VM image label indicating Error An Azure resource lock on the workspace A suitable Azure Monitor log alert rule and action group Create a saved log query but do not create an alert rule or action group Explanation Correct Answer C:Manual KQL queries do not create recurring alert notifications by themselves. Incorrect Answers A:Metadata can't send alert emails. B:Locks don't evaluate query results. D:Saved queries support investigation; notifications require separate alert evaluation and routing configuration.
