Microsoft
AZ-500 · Question #337
You have a sneaking suspicion that there are users trying to sign in to resources which are inaccessible to them. You decide to create an Azure Log Analytics query to confirm your suspicions. The…
The correct answer is C. The EventID and Count() parameters. https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/examples
Submitted by takeshi77· Mar 6, 2026Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Question
You have a sneaking suspicion that there are users trying to sign in to resources which are inaccessible to them. You decide to create an Azure Log Analytics query to confirm your suspicions. The query will detect unsuccessful user sign-in attempts from the last few days. You want to make sure that the results only show users who had failed to sign-in more than five times. Which of the following should be included in your query?
Options
- AThe EventID and CountIf() parameters.
- BThe ActivityID and CountIf() parameters.
- CThe EventID and Count() parameters.
- DThe ActivityID and Count() parameters.
How the community answered
(51 responses)- A16% (8)
- B4% (2)
- C71% (36)
- D10% (5)
Explanation
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/examples
Community Discussion
No community discussion yet for this question.