Microsoft Azure Administrator Associate AZ-104 Practice Question
You are an Azure administrator at a company that uses Azure Monitor Logs to collect and analyze logs from various Azure resources. You need to find all the error-level events generated in the last day by a virtual machine named AppServer1. Which query should you run in Log Analytics?
Syslog | where Host == "AppServer1" and SeverityLevel == "Error" and TimeGenerated >= now() - 24h
AzureDiagnostics | where Resource == "AppServer1" and Level == "Warning" and TimeGenerated >= ago(1d)
Event | where Computer == "AppServer1" and LevelName == "Error" and TimeGenerated >= ago(1d)
Heartbeat | where Computer == "AppServer1" and TimeGenerated >= ago(1d)
The correct query is Event | where Computer == "AppServer1" and LevelName == "Error" and TimeGenerated >= ago(1d). This query searches the Event table for entries where the Computer field matches "AppServer1", the LevelName is "Error", and the TimeGenerated is within the last day. The Event table is the correct table for collecting Windows event logs with the legacy Log Analytics agent.
A query on the AzureDiagnostics table is incorrect. While this table is used for some Azure resource logs, it is not the standard table for VM guest OS event logs. Furthermore, the distractor query filters for a Level of "Warning", not the required "Error".
The query on the Syslog table is incorrect because this table is used to store logs from Linux systems. The scenario implies a Windows VM by using the Event table, so its logs would not be in Syslog.
Querying the Heartbeat table is incorrect because this table contains agent availability data, not event logs. It is used to verify that the monitoring agent on a computer is running and connected.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is the Event table in Azure Monitor Logs?
Open an interactive chat with Bash
What is the difference between the Event and Syslog tables in Log Analytics?
Open an interactive chat with Bash
What does the 'TimeGenerated >= ago(1d)' filter do in a query?
Open an interactive chat with Bash
Microsoft Azure Administrator Associate AZ-104
Monitor and maintain Azure resources
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
Pass with Confidence.
IT & Cybersecurity Package
You have hit the limits of our free tier, become a Premium Member today for unlimited access.
Military, Healthcare worker, Gov. employee or Teacher? See if you qualify for a Community Discount.
Monthly
$19.99
$19.99/mo
Billed monthly, Cancel any time.
3 Month Pass
$44.99
$14.99/mo
One time purchase of $44.99, Does not auto-renew.
MOST POPULAR
Annual Pass
$119.99
$9.99/mo
One time purchase of $119.99, Does not auto-renew.
BEST DEAL
Lifetime Pass
$189.99
One time purchase, Good for life.
What You Get
All IT & Cybersecurity Package plans include the following perks and exams .