nerdexam
Microsoft

AZ-400 · Question #374

Drag and Drop Question You have an app named App1. You have a Log Analytics workspace named Workspace1 that contains a table named AppEvents. App1 writes logs to Workspace1. You need to query the AppE

The correct answer is AppEvents; | where Name startswith "Clicked Create New Ticket"; | summarize NumberOfClicks = count() by bin(timeGenerated, 1d), userId; | where NumberOfClicks > 3; | top 10 by NumberOfClicks desc. The correct order follows the logical flow of a KQL (Kusto Query Language) query: start with the table name (AppEvents), filter rows early to reduce data processed (where Name startswith), then aggregate to calculate daily clicks per user (summarize with bin), filter out users wi

Submitted by suresh_in· Mar 6, 2026Monitor and maintain Azure resources - specifically querying Log Analytics workspaces using KQL in Azure Monitor (AZ-104 / AZ-700 / SC-200 depending on certification context)

Question

Drag and Drop Question You have an app named App1. You have a Log Analytics workspace named Workspace1 that contains a table named AppEvents. App1 writes logs to Workspace1. You need to query the AppEvents table. The solution must meet the following requirements: - Only query rows for a column named Name that starts with the following text: "Clicked Create New Ticket." - Calculate the number of daily clicks per user. - Return the top 10 users based on their number of clicks for any day. - Sort the results based on the highest number of clicks. - Ignore any users who have less than three daily clicks. In which order should you arrange the query statements? To answer, move all statements from the list of statements to the answer area and arrange them in the correct order. Answer:

Exhibit

AZ-400 question #374 exhibit

Answer Area

Drag items

| summarize NumberOfClicks = count() by bin(timeGenerated, 1d), userIdAppEvents| top 10 by NumberOfClicks desc| where NumberOfClicks > 3| where Name startswith "Clicked Create New Ticket"

Correct arrangement

  • AppEvents
  • | where Name startswith "Clicked Create New Ticket"
  • | summarize NumberOfClicks = count() by bin(timeGenerated, 1d), userId
  • | where NumberOfClicks > 3
  • | top 10 by NumberOfClicks desc

Explanation

The correct order follows the logical flow of a KQL (Kusto Query Language) query: start with the table name (AppEvents), filter rows early to reduce data processed (where Name startswith), then aggregate to calculate daily clicks per user (summarize with bin), filter out users with fewer than 3 clicks after aggregation (where NumberOfClicks > 3 - note this should be >=3 per requirements but the option given uses >3), and finally return the top 10 by highest clicks (top 10 by NumberOfClicks desc). The 'where' filter on Name must come before 'summarize' because the Name column only exists before aggregation, and the 'where NumberOfClicks > 3' must come after 'summarize' because NumberOfClicks is a computed column that doesn't exist until aggregation runs. The 'top' operator replaces the need for a separate sort since it implicitly sorts descending.

Topics

#KQL#Log Analytics#Azure Monitor#Kusto Query Language

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-400 Practice