AZ-104 Monitor and Maintain Azure Resources Practice Question
A support engineer is narrowing a Log Analytics query to only failed backup jobs and wants to show only the needed columns. Which two KQL operators should they use? Select two.
⚠ Common exam trap
A common mix-up: candidates confuse `project` with `extend` (thinking both are for column manipulation) or incorrectly assume `summarize` can filter rows, when in fact `summarize` aggregates and loses row-level detail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
project
The `where` operator filters rows based on a condition, so it is used to narrow results to only failed backup jobs (e.g., `where Status == "Failed"`). The `project` operator selects a subset of columns, allowing the engineer to display only the needed columns (e.g., `project JobName, Status, StartTime`). Together, they achieve both row filtering and column selection in a Kusto Query Language (KQL) query.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
extend
Why it's wrong here
The extend operator adds a new calculated column to every row, deriving its value from expressions on existing columns. This increases the width of the result set rather than narrowing it, and it does not filter rows or remove columns. For a query meant to reduce output to only failure entries, extend would not achieve that goal; it only transforms the data.
When this WOULD be correct
A question asks: 'You need to add a new column that calculates the duration of each backup job in hours based on existing start and end time columns. Which KQL operator should you use?' In that scenario, 'extend' is correct because it creates a calculated column without removing other columns.
- ✗
join
Why it's wrong here
The join operator combines columns from two different tables by matching a specified key, which is unnecessary when searching a single table for failed jobs. Introducing a join here would add complexity and could produce duplicate columns or require key selection, making the query slower without improving the failure search. Since the data is already within one table, join is not the right tool for this task.
When this WOULD be correct
A question that asks: 'You need to combine backup job logs from two different Azure regions into a single result set based on job ID. Which KQL operator should you use?' In that scenario, 'join' would be correct.
- ✓
project
Why this is correct
The project operator narrows the query output by retaining only the specified columns and discarding all others. This is useful when a table has many fields but you only need a few, such as timestamp and status. It is the correct column-level reduction operator for trimming the result set to only the required data.
- ✗
summarize
Why it's wrong here
The summarize operator groups rows by one or more key columns and computes aggregate functions like count() or sum(), producing a summary table rather than listing individual rows. If applied to failed backup jobs, it would compress them into aggregated counts or grouped statistics, eliminating the per-job detail needed for a list. Therefore, it is not suitable for simply narrowing the query to show each failed job.
When this WOULD be correct
A question asks: 'You need to count the number of failed backup jobs per day. Which KQL operator should you use?' In that scenario, 'summarize' with count() and bin() would be correct.
- ✓
where
Why this is correct
The where operator filters the result set at the row level based on a Boolean expression, such as Status == 'Failed'. It includes only rows that meet the predicate, thereby excluding healthy backups and returning only the failure events. This is the correct row-filtering operator when narrowing to a specific failure status.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓projectCorrect answer▾
Why this is correct
The project operator narrows the query output by retaining only the specified columns and discarding all others. This is useful when a table has many fields but you only need a few, such as timestamp and status. It is the correct column-level reduction operator for trimming the result set to only the required data.
✗extendWrong answer — click to see why▾
Why this is wrong here
The 'extend' operator adds a new calculated column to the result set, but it does not filter rows or remove existing columns. The question requires narrowing to only failed backup jobs (filtering) and showing only needed columns (projection), which is achieved by 'where' and 'project', not 'extend'.
★ When this WOULD be the correct answer
A question asks: 'You need to add a new column that calculates the duration of each backup job in hours based on existing start and end time columns. Which KQL operator should you use?' In that scenario, 'extend' is correct because it creates a calculated column without removing other columns.
Why candidates choose this
Candidates may think 'extend' can both add columns and limit output, confusing it with 'project'. They might also believe that extending the query to include only certain columns is possible, but 'extend' always retains all original columns.
✗joinWrong answer — click to see why▾
Why this is wrong here
The 'join' operator is used to combine rows from two tables based on a matching key, not to filter rows or select columns. The question asks for narrowing results to only failed backup jobs (filtering) and showing only needed columns (projection), which require 'where' and 'project'.
★ When this WOULD be the correct answer
A question that asks: 'You need to combine backup job logs from two different Azure regions into a single result set based on job ID. Which KQL operator should you use?' In that scenario, 'join' would be correct.
Why candidates choose this
Candidates may confuse 'join' with 'project' because both can reshape the result set, or they might think joining multiple tables is necessary to get the required columns, even though the question only involves a single table.
✗summarizeWrong answer — click to see why▾
Why this is wrong here
The 'summarize' operator aggregates data into groups, but the question requires filtering rows (failed jobs) and selecting columns, not aggregation. It does not filter or project columns.
★ When this WOULD be the correct answer
A question asks: 'You need to count the number of failed backup jobs per day. Which KQL operator should you use?' In that scenario, 'summarize' with count() and bin() would be correct.
Why candidates choose this
Candidates may think 'summarize' can reduce columns by grouping, but they overlook that it changes the row structure and doesn't simply select columns like 'project' does.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Monitor and Log Analytics
Key term
Kusto Query Language
Kusto Query Language (KQL) is a read-only, high-performance query language used to analyze large datasets, especially for log monitoring, security investigations, and operational analytics in Microsoft Azure.
Key term
KQL
Kusto Query Language is a powerful read-only query language used to explore, analyze, and visualize large datasets, most notably in Azure Data Explorer and Microsoft Sentinel.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.