Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Centralized Log Analysis with Log Analytics Workspace
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization wants to centralize operational logging across multiple Azure services and custom applications. The cloud team needs a dedicated repository to store the aggregated log data and require an interactive analysis tool that supports Kusto Query Language (KQL) to evaluate trends, troubleshoot failures, and create visualizations.
Which Azure Monitor component should the team configure to meet these requirements?
Explanations
Data Collection Rules (DCR)
Data Collection Rules (DCR)
What Data Collection Rules are
Data Collection Rules (DCR) define the ingestion pipeline in Azure Monitor by specifying what telemetry data should be gathered, how that data should be transformed or filtered in transit, and where it should be routed.
Why it doesn't meet the requirement
- A Data Collection Rule is a routing and ETL configuration object, not an analytical data store where logs are stored or interactively queried using KQL.
- A DCR sends incoming data to a destination such as a Log Analytics workspace, which is still required to host and analyze the data.
Key characteristics and limitations
- Pipeline Definition: Specifies inputs, in-flight transformations, and destinations for incoming telemetry streams.
- Ingestion Filtering: Allows organizations to filter sensitive columns or reduce ingestion volume before data lands in storage.
- No Built-in Storage or Query Editor: Does not hold data or offer an interactive query interface for end users.
This answer would be correct if
The primary goal was to filter out sensitive attributes or reduce telemetry volume before sending log streams into a destination workspace.
Log Analytics workspace
Log Analytics workspace
What a Log Analytics Workspace is
A Log Analytics workspace is a dedicated environment and central data store in Azure Monitor used to collect, retain, and analyze log data from Azure resources, virtual machines, applications, and external environments.
How it meets the requirements
- Centralized Data Aggregation: Monitored Azure resources can route their diagnostic and operational logs directly to a designated Log Analytics workspace using diagnostic settings.
- Kusto Query Language (KQL) Engine: Data stored in the workspace is indexed and queried using Kusto Query Language (KQL), enabling complex data manipulations, filtering, aggregations, and joins.
- Interactive Analysis and Visualizations: The built-in Log Analytics interface within the Azure portal lets administrators run queries interactively, review tabular output, and render visual charts.
Key advantages and capabilities
- Unified Observability: Consolidates telemetry from disparate sources into unified tables for cross-resource analysis.
- Advanced Analytics: Supports rich data operators including time-series analysis, statistical aggregations, and custom transformations.
- Visualization and Alert Integration: Query results can be saved to query packs, pinned to Azure dashboards, or used as logic to fire proactive Azure Monitor alerts.
- Configurable Retention: Workspace and table-level policies allow granular management of data retention periods and archival pricing plans.
Why this is optimal
A Log Analytics workspace provides the foundational storage backend alongside the powerful analytical query engine required for deep log inspection across Azure resources.
Azure Monitor Metrics Explorer
Azure Monitor Metrics Explorer
What Azure Monitor Metrics Explorer does
Azure Monitor Metrics Explorer is an interactive UI tool within the Azure portal used to visualize, filter, and correlate numerical platform metrics generated by Azure resources in near real-time.
Why it doesn't meet the requirement
- Metrics Explorer focuses solely on lightweight numerical performance data (such as CPU percentage or network egress) rather than detailed textual or structured log data.
- It does not serve as a data storage workspace and does not utilize Kusto Query Language (KQL) for running custom multi-table queries.
Key characteristics and limitations
- Numerical Focus: Plots time-series metric data rather than deep transactional diagnostic logs.
- Predefined Dimensions: Aggregations are limited to standard mathematical operations (average, min, max, sum) and dimension splitting.
- Short-Term Retention: Standard platform metric storage is transient compared to long-term configurable log data retention.
This answer would be correct if
The requirement were to quickly plot a visual line chart comparing the real-time processor utilization of virtual machines without writing code or queries.
Azure Workbooks
Azure Workbooks
What Azure Workbooks is
Azure Workbooks provides a flexible canvas for data analysis, reporting, and creating interactive dashboards directly inside the Azure portal by combining text, visual components, and query results.
Why it doesn't meet the requirement
- While workbooks can execute and visualize KQL queries, they do not act as the actual underlying storage repository for ingested resource logs.
- Workbooks rely on an underlying data store—such as a Log Analytics workspace—to pull and display log information.
Key characteristics and limitations
- Presentation Layer: Acts as an interactive reporting layer rather than a log ingestion and storage system.
- Multi-Source Integration: Capable of combining telemetry from Azure Monitor Logs, Metrics, and Azure Resource Graph into one unified visual document.
- No Native Ingestion: Cannot directly receive diagnostic streams from resources without routing through a log storage workspace.
This answer would be correct if
The team required a shareable, interactive visual document combining textual guidance, parameters, and multiple chart widgets for operational reporting.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor Application Insights APM
Describe Azure Monitor, including Log Analytics, Azure Monitor alerts, and Azure Monitor Application Insights
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Workbooks
Describe Azure Monitor, including Log Analytics, Azure Monitor alerts, and Azure Monitor Application Insights
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor
Describe Azure Monitor, including Log Analytics, Azure Monitor alerts, and Azure Monitor Application Insights
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor Action Groups
Describe Azure Monitor, including Log Analytics, Azure Monitor alerts, and Azure Monitor Application Insights
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Defense-in-Depth
Describe the purpose of the defense-in-depth model
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
GitHub Branch Protection Rules and SAML SSO
Design and implement permissions and roles in GitHub
Last updated Validated