A help desk analyst needs a KQL query that identifies each VM's most recent heartbeat so computers can be flagged if their last check-in is older than 20 minutes. Which two KQL elements should be used? Select two.

Join the results to AzureActivity to calculate service health.

AzureActivity tracks control-plane operations, not VM heartbeat timestamps, so it is not needed here.

Filter where TimeGenerated is older than 20 minutes before summarizing.

Filtering rows first can drop newer heartbeat records and prevent the query from finding the latest check-in correctly.

Use the Perf table because it stores heartbeat timestamps.

Perf contains performance counters, not the heartbeat records that show whether a VM has checked in recently.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Query the Heartbeat table, because it stores the heartbeat records for Azure VMs. — A correct heartbeat query must start with the Heartbeat table and then aggregate by computer to determine the latest timestamp for each VM. Using `summarize max(TimeGenerated) by Computer` gives a last-seen value that can then be compared with an age threshold such as 20 minutes. This pattern is common in Log Analytics because it turns many event rows into one current-status row per computer, which is easier to alert on and troubleshoot. Why others are wrong: AzureActivity is about management-plane events, not guest health heartbeats. Filtering on old timestamps before summarizing can produce misleading results because it removes recent rows that prove the VM is still connected. The Perf table is useful for counters like CPU and memory, but it does not hold heartbeat records. Those distractors look plausible, yet they do not produce a reliable last-seen view per VM.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.