Microsoft
AZ-104 · Question #694
You have an Azure subscription. The subscription contains virtual machines that run Windows Server. You have a data collection rule (DCR) named Rule1. You plan to use the Azure Monitor Agent to…
The correct answer is C. KQL. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-structure
Submitted by neha2k· Mar 4, 2026Monitor and back up Azure resources
Question
You have an Azure subscription. The subscription contains virtual machines that run Windows Server. You have a data collection rule (DCR) named Rule1. You plan to use the Azure Monitor Agent to collect events from Windows System event logs. You only need to collect system events that have an ID of 1001. Which type of query should you use for the data source in Rule1?
Options
- ASQL
- BXPath
- CKQL
How the community answered
(35 responses)- A6% (2)
- B3% (1)
- C91% (32)
Explanation
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-structure
Community Discussion
No community discussion yet for this question.