AZ-104 Monitor and Maintain Azure Resources Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SigninLogs | where ResultType == 0

  Why it's wrong here

  This query filters for ResultType equal to 0, which in the SigninLogs schema specifically denotes a successful sign-in attempt. As a result, it returns only the success records and excludes every failure, which is the opposite of what the support engineer needs. The correct approach is to look for any non-zero ResultType, since failed sign-ins are indicated by a variety of error codes.

  When this WOULD be correct

  If the question asked to find only successful sign-in records, then 'SigninLogs | where ResultType == 0' would be correct, as ResultType 0 typically represents success.

• ✓

  SigninLogs | where ResultType != 0

  Why this is correct

  This query correctly isolates failed sign-ins because in the SigninLogs table a ResultType value of 0 (or "0") indicates a successful authentication, while all non-zero values represent error codes such as 50126 (invalid credentials) or 50053 (account lockout). By applying a where clause that excludes zero, you return only the failed sign-in events. Note that the ResultType field may be stored as a string, so the comparison might need quotes in some query contexts, but the logical predicate is correct.

• ✗

  SigninLogs | summarize count()

  Why it's wrong here

  The summarize count() operator performs a full-table aggregation, collapsing every row in SigninLogs into a single count of records, and it applies no filter on ResultType whatsoever. This means the output tells you how many sign-in logs exist, but it does not differentiate successful events from failed ones. To identify failures you would first need a where clause to narrow the dataset, and then you could summarize—but the summarized count alone is useless for this task.

  When this WOULD be correct

  A question asks: 'Which KQL query returns the total number of sign-in records in the Log Analytics workspace?' Then SigninLogs | summarize count() would be correct.

• ✗

  SigninLogs | project UserPrincipalName

  Why it's wrong here

  The project operator is used to limit the output to a single column, UserPrincipalName, which merely changes the result set's shape by removing other fields from view. It performs no row-level filtering, so all sign-in records, both successful and failed, remain in the results. To find failed sign-ins, you need a where predicate that checks the ResultType column, not a projection of user names.

  When this WOULD be correct

  If the question asked: 'Which KQL query returns only the user principal names from sign-in logs?' then this option would be correct because it selects a single column.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question