nerdexam
Microsoft

AZ-400 · Question #239

Drag and Drop Question You have several Azure virtual machines that run Windows Server 2019. You need to identify the distinct event IDs of each virtual machine as shown in the following table. How sh

The correct answer is makelist(EventID); makeset(EventID); mv-expand; summarize; makelist(EventID). The correct query uses makelist(EventID) to collect all EventIDs into a list per computer, makeset(EventID) to get only distinct/unique EventIDs, mv-expand to expand the set into individual rows for processing, summarize to aggregate results by Computer, and makelist(EventID) aga

Submitted by andres_qro· Mar 6, 2026Monitor and maintain Azure resources - specifically writing KQL queries in Azure Monitor Log Analytics to analyze virtual machine event data (Maps to AZ-104 or AZ-140 Monitor and Backup domain)

Question

Drag and Drop Question You have several Azure virtual machines that run Windows Server 2019. You need to identify the distinct event IDs of each virtual machine as shown in the following table. How should you complete the Azure Monitor query? To answer, drag the appropriate values to the correct locations. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibit

AZ-400 question #239 exhibit

Answer Area

Drag items

count()makelist(EventID)makeset(EventID)mv-expandprojectrendersummarize

Correct arrangement

  • makelist(EventID)
  • makeset(EventID)
  • mv-expand
  • summarize
  • makelist(EventID)

Explanation

The correct query uses makelist(EventID) to collect all EventIDs into a list per computer, makeset(EventID) to get only distinct/unique EventIDs, mv-expand to expand the set into individual rows for processing, summarize to aggregate results by Computer, and makelist(EventID) again to present the final grouped list. makeset() is the key function that returns only distinct values (no duplicates), which directly satisfies the requirement to identify 'distinct event IDs' per virtual machine.

Topics

#Azure Monitor#Kusto Query Language (KQL)#Log Analytics#Windows Event Logs

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-400 Practice