A support engineer is investigating a failed Azure VM backup job in Log Analytics. Match each KQL operator to the result it produces.
Drag a concept onto its matching description — or click a concept then click the description.
Keeps only rows that meet the filter condition.
Returns only selected columns and can rename them.
Aggregates rows into totals, counts, or grouped results.
Orders the output by one or more columns.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
where: Filters rows based on a predicate
These are common KQL operators. 'where' filters, 'project' selects columns, 'extend' adds columns, 'summarize' aggregates, 'join' merges tables, and 'order by' sorts results.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
where: Filters rows based on a predicate
Why this is correct
In Kusto Query Language (KQL), the `where` operator filters rows by evaluating a predicate or boolean expression against each record, keeping only rows where that expression returns `true`. It operates strictly at the row level, making it the direct equivalent of SQL's `WHERE` clause. In an Azure VM backup failure investigation, `where` is typically the first operator used to narrow diagnostic logs to a specific VM name, backup job ID, time window, or error code.
project: Selects a subset of columns
Why this is correct
The `project` operator selects a subset of columns from the input table and can also rename or reorder them, producing an output table with only the specified fields. It does not evaluate row-level conditions or change the number of rows; it changes the shape of the schema. For analyzing backup failures, `project` is useful after filtering to keep only essential columns such as VM name, operation name, status, and timestamp, making the result set compact and easier to inspect.
extend: Adds new calculated columns
Why this is correct
The `extend` operator adds one or more new calculated columns to the result set, deriving values from existing columns, constant expressions, or function calls. It preserves all original rows and columns, simply appending the new fields to the right side of the table schema. In a backup failure investigation, `extend` might be used to convert UTC timestamps to local time, parse a substring from an error message, or compute a new severity classification for each backup event.
summarize: Aggregates groups of rows
Why this is correct
The `summarize` operator groups rows according to one or more grouping keys and applies aggregation functions, such as `count()`, `sum()`, `avg()`, or `max()`, to produce one output row per distinct combination of keys. This operator reduces the volume of data by consolidating details into statistical totals or counts. For backup failures, `summarize` is commonly used to count the number of failures per VM, per error code, or per day, revealing patterns that are hard to spot in raw logs.
where: Selects a subset of columns
Why it's wrong here
This statement is incorrect because `where` does not select a subset of columns; it filters a subset of rows based on a condition. Selecting, renaming, or reordering columns in KQL is accomplished with the `project` operator (or `project-away` to remove columns). Confusing row filtering with column selection is a fundamental schema-versus-record error, because `where` never alters the column structure and cannot reduce the number of fields returned.
extend: Aggregates groups of rows
Why it's wrong here
This statement is incorrect because `extend` does not aggregate or group rows; it performs a row-wise transformation that adds new columns while leaving all existing rows intact. Aggregating rows into groups and computing summary values is the job of `summarize`. The operators have opposite effects: `extend` increases the columns in each row, while `summarize` decreases the number of rows by grouping, so describing `extend` as an aggregation tool is a clear mischaracterization.
Go deeper
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.