nerdexam
Microsoft

AZ-400 · Question #386

Drag and Drop Question You have a web app named App1 that uses Application Insights in Azure Monitor to store log data. App1 has users in multiple locations. You need to query App1 requests from Londo

The correct answer is requests; | where timestamp >= ago(1hr); | where resultCode == "404" and (client_City == "London" or client_City == "Paris"); | project timestamp, url, resultCode, duration. The correct query starts with the 'requests' table (the built-in Application Insights table for HTTP request telemetry), then filters by 'timestamp >= ago(1hr)' to limit results to the last hour using the correct KQL syntax with '>=' and 'ago(1hr)'. The '| where resultCode == "40

Submitted by sofia.br· Mar 6, 2026Monitor and maintain Azure resources - specifically querying Application Insights telemetry data using KQL within Azure Monitor (AZ-104 / AZ-305 monitoring domain)

Question

Drag and Drop Question You have a web app named App1 that uses Application Insights in Azure Monitor to store log data. App1 has users in multiple locations. You need to query App1 requests from London and Paris that return a 404 error. The solution must meet the following requirements: - Return the timestamp url, resultCode, and duration fields - Only show requests made during the last hour. How should you complete the query? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. Answer:

Exhibits

AZ-400 question #386 exhibit 1
AZ-400 question #386 exhibit 2

Answer Area

Drag items

extendselecttimestamp -gt ago(1hr)projectrequests| wheretimestamp >= ago(1hr)| where resultCode == "404" and (client_City == "London" or client_City == "Paris")timestamp, url, resultCode, duration

Correct arrangement

  • requests
  • | where timestamp >= ago(1hr)
  • | where resultCode == "404" and (client_City == "London" or client_City == "Paris")
  • | project timestamp, url, resultCode, duration

Explanation

The correct query starts with the 'requests' table (the built-in Application Insights table for HTTP request telemetry), then filters by 'timestamp >= ago(1hr)' to limit results to the last hour using the correct KQL syntax with '>=' and 'ago(1hr)'. The '| where resultCode == "404"' clause with city conditions filters for 404 errors from London or Paris, and '| project timestamp, url, resultCode, duration' returns only the specified fields - 'project' is the correct KQL operator for selecting and returning specific columns.

Topics

#Kusto Query Language (KQL)#Application Insights#Azure Monitor#Log Analytics

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-400 Practice