nerdexam
Microsoft

AZ-400 · Question #520

Hotspot Question You are interrogating logs by using KQL. You execute the query shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based

The correct answer is Six columns will be returned in the query output. = Yes; The data type of the Duration column is timespan. = Yes. The KQL query uses 'extend' to add a computed column (Duration) to the existing columns in the table, and 'project' or the base table would return all original columns plus the new one - resulting in six total columns returned. The Duration column is calculated using the 'datetim

Submitted by yaw92· Mar 6, 2026Configure and manage Microsoft Sentinel / Azure Monitor - specifically querying and analyzing log data using KQL, including understanding query operators like 'extend' and KQL data types such as timespan and datetime.

Question

Hotspot Question You are interrogating logs by using KQL. You execute the query shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-400 question #520 exhibit 1
AZ-400 question #520 exhibit 2

Answer Area

  • Six columns will be returned in the query output.Yes
  • The data type of the Duration column is timespan.Yes

Explanation

The KQL query uses 'extend' to add a computed column (Duration) to the existing columns in the table, and 'project' or the base table would return all original columns plus the new one - resulting in six total columns returned. The Duration column is calculated using the 'datetime_diff' or subtraction of two datetime values, which in KQL produces a 'timespan' data type, confirming both statements are correct with 'Yes'.

Topics

#KQL (Kusto Query Language)#Azure Monitor Logs#Data Types in KQL#Log Analytics Queries

Community Discussion

No community discussion yet for this question.

Full AZ-400 Practice