Microsoft AZ-104 Exam Dumps, Practice Test Questions

The project operator selects only the named columns, so naming TenantId and SourceSystem would display exactly the fields the report must exclude. It would also omit needed event details such as EventID and TimeGenerated.

Summarize aggregates events into groups and changes row cardinality, violating the requirement to preserve one event row per original record. Aggregation is unnecessary for a column-level projection.

Extend adds or overwrites column expressions but keeps those fields present in the result, even if their values are blank. It does not remove their schema fields and may mislead consumers into thinking the original columns were never collected.

Project selects columns but does not count events or identify most frequent values.

Take 3 on raw rows is arbitrary sampling and cannot determine which code occurred most frequently across all matching records.

Distinct removes duplicates but does not compute occurrence frequency, so the resulting three codes need not be the most common failures.

Removing or selecting columns cannot compute seconds from milliseconds. The analyst must introduce a calculated column without dropping existing columns.

Aggregation groups rows and alters the returned schema rather than preserving all original events and creating a per-row converted duration.

Project can calculate the requested value but without enumerating the other columns it drops them. The requirement explicitly retains all existing fields.

Summarize collapses multiple event rows per host into an aggregate, losing the individual timestamps the analysts require.

Distinct would return unique host names and discard the per-event timestamp rows needed for chronology.

Ordering changes sequence but retains all original columns and does not produce the specified two-field output.

A global take 1 returns one row total, not the latest event for every VM.

A count gives frequency of status records but loses the values of the newest status event for each VM.

Distinct emits one host identifier per computer but does not retain the last status row or its timestamp and fields.

The extend operator creates a per-row Boolean flag; by itself it does not produce a count of matching rows alongside the total. Use countif(IsServerError) or an equivalent conditional aggregation within summarize by Application.

Filtering to 5xx before summarize removes non-error rows from the input, so a count of all responses can no longer be produced from that filtered group. Use countif on the 5xx condition alongside total count() in the same summarize.

Counting every response a second time doesn't isolate HTTP 500–599 server failures. countif(StatusCode >= 500 and StatusCode < 600) within the summarize produces the separate grouped 5xx count.

Aggregating rows first can discard the individual Payload fields needed to parse and filter each event.

A substring match might find the same word in a different JSON property. It does not reliably enforce the nested response.status condition.

Projecting the original string only selects a column and does not provide the nested status property for a typed predicate.

A corrected condition changes when an alert fires, but a firing alert without an associated notification recipient still does not email the on-call team.

Suppressing notifications would move the system further from the stated email requirement, while leaving the missing receiver unconfigured.

A dashboard supports manual observation but does not send on-call email when a rule fires. The delivery channel must be defined as an alert action.

A single high sample can reflect a brief periodic job. It does not prove the sustained average threshold that the team wants to detect.

Maximum highlights the highest sample in a window; a short spike could trigger the alert even when average use is well below 85 percent.

Restart events concern VM lifecycle, not sustained processor utilization. The query would miss the required high-average-CPU periods.

Email is a notification channel but does not directly make the specified HTTPS POST to the integration endpoint without another bridge.

A Logic Apps action receiver can invoke an existing integration workflow; it is not by itself an arbitrary HTTPS POST mapping to an external service. Without a configured workflow that forwards the alert payload, the integration requirement is unmet. A webhook or secure webhook action provides the direct HTTP POST receiver specified by the scenario.

An Event Hubs receiver delivers alert payloads to an event hub for downstream processing, not directly to an arbitrary HTTPS endpoint. Without an added consumer or forwarding integration, it cannot perform the required incident-service POST. A webhook or secure webhook receiver provides that direct delivery.

A dimension filter selects a metric time series, but does not lengthen the lookback or require sustained CPU elevation. Configure the appropriate aggregation and evaluation window for the CPU condition.

A threshold changes the measured level that must be exceeded, not the length of time the condition must persist. A momentary spike might still cross a higher threshold. Tune aggregation/window settings to capture sustained high usage.

More frequent evaluation checks the same condition more often and does not by itself filter one-minute spikes. Use a suitable longer window and aggregation strategy rather than confusing polling frequency with sustained-duration evaluation.