AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
AzureDiagnostics sample rows TimeGenerated OperationName Status VaultName 2026-04-26T01:03:12Z BackupJob Failed Vault-Prod 2026-04-26T01:04:10Z BackupJob Succeeded Vault-Prod Query draft: AzureDiagnostics | where TimeGenerated > ago(24h) | where Status == "Failed" | ____ TimeGenerated, VaultName, OperationName
Based on the exhibit, which KQL operator should replace the blank to return only those columns?
⚠ Common exam trap
Many exam-takers confuse row-filtering operators (like `where`) with column-selection operators (like `project`), leading candidates to choose `where` because they think it controls visible columns, when in fact it only filters rows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
project, because it returns only the named columns in the result.
The `project` operator in Kusto Query Language (KQL) is specifically designed to select a subset of columns from the input table, returning only the named columns in the result set. This matches the requirement to 'return only those columns,' making option C correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
where, because it filters rows and also selects the visible columns.
Why it's wrong here
The where operator is strictly a row filter; it evaluates a Boolean predicate for each row and retains only rows for which the predicate evaluates to true. It does not modify the output schema at all—every column present in the input record remains present in the filtered result. Saying it 'selects visible columns' confuses row filtering with column projection; to hide columns you need a separate operator like project, not where.
When this WOULD be correct
In a KQL question asking to filter records where the status is 'Failed' and return all columns, 'where' would be correct. For example: 'Which operator filters rows where Status == "Failed"?'
- ✗
summarize, because it groups the failed records into a smaller result set.
Why it's wrong here
The summarize operator groups rows by one or more key expressions and computes aggregate values over each group, outputting exactly one row per group (plus the grouping columns). It does not perform arbitrary column selection: for example, a summarize that counts failed records would lose the individual TimeGenerated and VaultName values unless they are used as grouping keys. Because the query needs original per-record values, not grouped aggregations, summarize is not the operator that should replace the placeholder.
When this WOULD be correct
A question asks: 'Which KQL operator should be used to count the number of failed requests per hour?' In that case, 'summarize' is correct because it groups by time and counts failures.
- ✓
project, because it returns only the named columns in the result.
Why this is correct
The project operator is a column selection and reshaping operator: it returns only the columns explicitly listed in its arguments, in the order specified, and drops all other columns from the input tabular schema. In this query, using project TimeGenerated, VaultName, OperationName gives a concise, readable result set that keeps only the fields relevant to the failed recovery vault entries. All other columns, such as ResourceId or SubscriptionId, are discarded from the output even though they may exist in the underlying log data.
- ✗
extend, because it creates new output columns for the selected fields.
Why it's wrong here
The extend operator appends one or more new calculated columns to the existing row schema, leaving every original column untouched. If you attempt to 'select' OperationName with extend, you would only be adding or overwriting a column while all other fields still appear in the output. To reduce the visible result to a specific set of columns, extend must be followed by a project or project-away, so extend alone is not sufficient for column selection.
When this WOULD be correct
In a scenario where you need to add a new calculated column (e.g., 'TotalPrice = Quantity * UnitPrice') while keeping all existing columns in the result, 'extend' would be the correct operator to use.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓project, because it returns only the named columns in the result.Correct answer▾
Why this is correct
The project operator is a column selection and reshaping operator: it returns only the columns explicitly listed in its arguments, in the order specified, and drops all other columns from the input tabular schema. In this query, using project TimeGenerated, VaultName, OperationName gives a concise, readable result set that keeps only the fields relevant to the failed recovery vault entries. All other columns, such as ResourceId or SubscriptionId, are discarded from the output even though they may exist in the underlying log data.
✗where, because it filters rows and also selects the visible columns.Wrong answer — click to see why▾
Why this is wrong here
The 'where' operator filters rows based on a condition, but it does not select or limit the columns returned; it returns all columns from the input table.
★ When this WOULD be the correct answer
In a KQL question asking to filter records where the status is 'Failed' and return all columns, 'where' would be correct. For example: 'Which operator filters rows where Status == "Failed"?'
Why candidates choose this
Candidates may confuse filtering rows with selecting columns, or think 'where' can also project columns because in SQL, SELECT can combine filtering and column selection.
✗summarize, because it groups the failed records into a smaller result set.Wrong answer — click to see why▾
Why this is wrong here
The question asks for an operator that returns only specific columns. 'summarize' groups rows and produces aggregation results, but it does not control which columns are returned; it can include additional columns from the group-by clause, not just the named ones.
★ When this WOULD be the correct answer
A question asks: 'Which KQL operator should be used to count the number of failed requests per hour?' In that case, 'summarize' is correct because it groups by time and counts failures.
Why candidates choose this
Candidates may think 'summarize' reduces the result set to only relevant columns, confusing aggregation with column selection, or they may misinterpret 'return only those columns' as a reduction in data volume.
✗extend, because it creates new output columns for the selected fields.Wrong answer — click to see why▾
Why this is wrong here
The 'extend' operator creates new columns based on existing ones, but it does not remove other columns from the output. The question requires returning only specific columns, which 'project' does by selecting a subset of columns and discarding the rest.
★ When this WOULD be the correct answer
In a scenario where you need to add a new calculated column (e.g., 'TotalPrice = Quantity * UnitPrice') while keeping all existing columns in the result, 'extend' would be the correct operator to use.
Why candidates choose this
Candidates may confuse 'extend' with 'project' because both can manipulate columns, but 'extend' adds columns without removing others, whereas 'project' selects only specified columns.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Named Locations and Conditional Access Policies
Key term
Kusto Query Language
Kusto Query Language (KQL) is a read-only, high-performance query language used to analyze large datasets, especially for log monitoring, security investigations, and operational analytics in Microsoft Azure.
Key term
KQL
Kusto Query Language is a powerful read-only query language used to explore, analyze, and visualize large datasets, most notably in Azure Data Explorer and Microsoft Sentinel.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.