AZ-104 Monitor and Maintain Azure Resources Practice Question
A help desk engineer needs a Log Analytics query that returns each computer whose most recent heartbeat is older than 20 minutes. Which query should they use?
⚠ Common exam trap
The trap here is that candidates often filter by time first (as in Option A) thinking it will find old heartbeats, but they forget that summarizing after filtering can include computers with recent heartbeats if any old heartbeat exists, whereas the correct approach is to summarize the latest heartbeat per computer first, then filter for staleness.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Heartbeat | summarize LastSeen = max(TimeGenerated) by Computer | where LastSeen < ago(20m)
It first summarizes the most recent heartbeat timestamp for each computer using `max(TimeGenerated)`, then filters for computers where that latest heartbeat is older than 20 minutes with `where LastSeen < ago(20m)`. This ensures only computers that have not sent a heartbeat in the last 20 minutes are returned, which is the exact requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Heartbeat | where TimeGenerated < ago(20m) | summarize LastSeen = max(TimeGenerated) by Computer
Why it's wrong here
This query filters in the wrong order: it first discards every heartbeat newer than 20 minutes, leaving only older records for the aggregation. When summarize calculates max(TimeGenerated) over that remnant, a computer that sent a heartbeat a moment ago will still show an old LastSeen value because its newest record was removed before the max was computed. Consequently, the result contains false positives—active machines appear stale—and fails to reliably identify computers that are truly silent.
When this WOULD be correct
This query would be correct if the question asked: 'Which computers have had at least one heartbeat older than 20 minutes?' or 'Find computers with any heartbeat recorded more than 20 minutes ago.'
- ✓
Heartbeat | summarize LastSeen = max(TimeGenerated) by Computer | where LastSeen < ago(20m)
Why this is correct
This query first finds the latest heartbeat per computer and then filters for machines whose latest timestamp is older than 20 minutes. That matches the operational requirement exactly and avoids false positives caused by filtering before summarization.
- ✗
Heartbeat | summarize count() by Computer | where count_ < 20
Why it's wrong here
This query counts the number of heartbeat records per computer without examining when the most recent record was generated. A computer that just started sending heartbeats or is configured with a low heartbeat frequency could have a count below 20 yet still have a heartbeat within the last 20 minutes, while a silent computer could accumulate many historical heartbeats and exceed the threshold. Counting events therefore cannot distinguish between a machine that is currently active and one that has gone offline.
When this WOULD be correct
If the question asked for 'computers that have sent fewer than 20 heartbeats in total' (e.g., to identify rarely reporting machines), this query would be correct.
- ✗
Heartbeat | where TimeGenerated > ago(20m) | summarize LastSeen = max(TimeGenerated) by Computer
Why it's wrong here
Applying the time filter before the aggregation limits the input to only those heartbeats that arrived during the most recent 20-minute window. The subsequent summarize computes the maximum TimeGenerated from this already recent subset, so every computer returned by the query demonstrably has a heartbeat within the required period. This is the inverse of the intended result: rather than finding machines with no recent heartbeat, it selects machines with at least one recent heartbeat, completely omitting the silent computers that should appear.
When this WOULD be correct
If the question asked for 'computers that have sent a heartbeat in the last 20 minutes', this query would be correct because it filters to recent heartbeats and then summarizes the latest per computer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Heartbeat | summarize LastSeen = max(TimeGenerated) by Computer | where LastSeen < ago(20m)Correct answer▾
Why this is correct
This query first finds the latest heartbeat per computer and then filters for machines whose latest timestamp is older than 20 minutes. That matches the operational requirement exactly and avoids false positives caused by filtering before summarization.
✗Heartbeat | where TimeGenerated < ago(20m) | summarize LastSeen = max(TimeGenerated) by ComputerWrong answer — click to see why▾
Why this is wrong here
This query filters heartbeats older than 20 minutes first, then summarizes by computer. It returns computers that have any heartbeat older than 20 minutes, even if they also have a recent heartbeat, so it does not correctly identify computers whose most recent heartbeat is older than 20 minutes.
★ When this WOULD be the correct answer
This query would be correct if the question asked: 'Which computers have had at least one heartbeat older than 20 minutes?' or 'Find computers with any heartbeat recorded more than 20 minutes ago.'
Why candidates choose this
Candidates may think filtering first and then summarizing is logically equivalent, but they overlook that the filter removes recent heartbeats, causing the summary to only consider old data, which can incorrectly include computers with recent activity.
✗Heartbeat | summarize count() by Computer | where count_ < 20Wrong answer — click to see why▾
Why this is wrong here
This query counts heartbeats per computer and filters those with fewer than 20 heartbeats, not those whose most recent heartbeat is older than 20 minutes. It does not consider the time of the last heartbeat.
★ When this WOULD be the correct answer
If the question asked for 'computers that have sent fewer than 20 heartbeats in total' (e.g., to identify rarely reporting machines), this query would be correct.
Why candidates choose this
Candidates may misinterpret 'older than 20 minutes' as 'fewer than 20 heartbeats' or mistakenly think counting events over time is equivalent to checking recency.
✗Heartbeat | where TimeGenerated > ago(20m) | summarize LastSeen = max(TimeGenerated) by ComputerWrong answer — click to see why▾
Why this is wrong here
This query filters heartbeats from the last 20 minutes and then summarizes the latest heartbeat per computer, which returns computers with heartbeats within the last 20 minutes, not those whose most recent heartbeat is older than 20 minutes.
★ When this WOULD be the correct answer
If the question asked for 'computers that have sent a heartbeat in the last 20 minutes', this query would be correct because it filters to recent heartbeats and then summarizes the latest per computer.
Why candidates choose this
Candidates may mistakenly think that filtering for recent heartbeats and then summarizing will show computers that are missing, but they overlook that the filter removes older data, so the result only includes computers with recent activity.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A help desk analyst needs a KQL query that identifies each VM's most recent heartbeat so computers can be flagged if their last check-in is older than 20 minutes. Which two KQL elements should be used? Select two.
medium- ✓ A.Query the Heartbeat table, because it stores the heartbeat records for Azure VMs.
- ✓ B.Summarize max(TimeGenerated) by Computer to get the most recent heartbeat per VM.
- C.Join the results to AzureActivity to calculate service health.
- D.Filter where TimeGenerated is older than 20 minutes before summarizing.
- E.Use the Perf table because it stores heartbeat timestamps.
Why A: The Heartbeat table in Azure Monitor Logs (Log Analytics) is specifically designed to store heartbeat records from Azure Monitor Agent (AMA) or the legacy Log Analytics agent. Each heartbeat record contains a TimeGenerated timestamp, making it the authoritative source for determining when a VM last reported its health status.
Variation 2. A VM named VM01 stopped sending Heartbeat records to Log Analytics 15 minutes ago. Which KQL query should you run to confirm the VM's recent heartbeat entries?
easy- ✓ A.Heartbeat | where Computer == "VM01" and TimeGenerated > ago(15m)
- B.AzureActivity | where ResourceProviderValue == "Microsoft.Compute/virtualMachines"
- C.Heartbeat | summarize count() by Computer
- D.Perf | where CounterName == "% Processor Time"
Why A: The Heartbeat table in Log Analytics stores records sent by the Azure Monitor Agent (AMA) or Log Analytics agent every 5 minutes by default. Querying Heartbeat with a filter for Computer == 'VM01' and TimeGenerated > ago(15m) directly checks if any heartbeat records were generated in the last 15 minutes, confirming whether the VM is still reporting. This is the correct approach because Heartbeat is the dedicated table for agent health, and the time filter matches the 15-minute window specified in the question.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.