AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
AzureActivity sample rows: TimeGenerated OperationName ActivityStatusValue Caller 2026-04-26T08:00:00Z Start Virtual Machine Succeeded alice@contoso.com 2026-04-26T08:05:00Z Stop Virtual Machine Failed bob@contoso.com 2026-04-26T08:07:00Z Restart Virtual Machine Failed carol@contoso.com
Based on the exhibit, you need to return only the failed operations from the log entries. Which KQL query should you use?
⚠ Common exam trap
Watch out — candidates often confuse the `ActivityStatusValue` field with other status fields like `Status` or `ResultType`, or mistakenly choose an aggregation query (Option B) that summarizes data without filtering, failing to meet the precise requirement to return only failed operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AzureActivity | where ActivityStatusValue == "Failed" | project TimeGenerated, OperationName, Caller
The KQL query filters the AzureActivity table using the `where` clause to return only rows where `ActivityStatusValue` equals 'Failed', then projects the relevant columns `TimeGenerated`, `OperationName`, and `Caller`. This directly meets the requirement to return only failed operations from the log entries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AzureActivity | where ActivityStatusValue == "Failed" | project TimeGenerated, OperationName, Caller
Why this is correct
This query first applies a row-level filter on the AzureActivity table for entries where ActivityStatusValue equals 'Failed', then projects only TimeGenerated, OperationName, and Caller. It directly satisfies the requirement to return only failed operations and trims the result set to the columns needed for triage, making it both correct and efficient.
- ✗
AzureActivity | summarize count() by Caller
Why it's wrong here
The summarize count() by Caller operator aggregates the AzureActivity table and returns one row per unique caller with the total number of entries, discarding per-operation details such as status and timestamp. This produces a breakdown of activity volume by principal, but it neither filters for failed operations nor returns the failed records themselves.
When this WOULD be correct
This query would be correct if the question asked: 'You need to determine which users initiated the most operations in the log entries. Which KQL query should you use?'
- ✗
AzureActivity | top 10 by TimeGenerated
Why it's wrong here
Using top 10 by TimeGenerated fetches the ten most recently generated audit entries regardless of their ActivityStatusValue, which may include Succeeded, Started, or other statuses. It imposes no condition on failure state, so it cannot guarantee that any failed operations appear, let alone only those that failed.
When this WOULD be correct
This option would be correct if the question asked: 'You need to display the 10 most recent Azure Activity log entries. Which KQL query should you use?'
- ✗
AzureActivity | where ActivityStatusValue == "Succeeded"
Why it's wrong here
Filtering on ActivityStatusValue == 'Succeeded' explicitly keeps successful operations and removes failed and canceled entries from the result set. This is the exact inverse of the stated requirement, so it would omit every failed operation that the user needs to review.
When this WOULD be correct
If the question asked to return only successful operations from the log entries, this query would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓AzureActivity | where ActivityStatusValue == "Failed" | project TimeGenerated, OperationName, CallerCorrect answer▾
Why this is correct
This query first applies a row-level filter on the AzureActivity table for entries where ActivityStatusValue equals 'Failed', then projects only TimeGenerated, OperationName, and Caller. It directly satisfies the requirement to return only failed operations and trims the result set to the columns needed for triage, making it both correct and efficient.
✗AzureActivity | summarize count() by CallerWrong answer — click to see why▾
Why this is wrong here
This query summarizes the count of operations by Caller, but does not filter for failed operations, so it does not meet the requirement to return only failed operations.
★ When this WOULD be the correct answer
This query would be correct if the question asked: 'You need to determine which users initiated the most operations in the log entries. Which KQL query should you use?'
Why candidates choose this
Candidates might think summarizing by Caller is a way to identify failed operations, or they may overlook the requirement to filter for failures and focus on grouping data.
✗AzureActivity | top 10 by TimeGeneratedWrong answer — click to see why▾
Why this is wrong here
This query returns the 10 most recent log entries by TimeGenerated, not filtering for failed operations. The question specifically requires returning only failed operations, which this query does not address.
★ When this WOULD be the correct answer
This option would be correct if the question asked: 'You need to display the 10 most recent Azure Activity log entries. Which KQL query should you use?'
Why candidates choose this
Candidates may think 'top 10' is a common way to sample data and overlook the specific requirement to filter by failure status, or they may confuse 'top' with a filtering operation.
✗AzureActivity | where ActivityStatusValue == "Succeeded"Wrong answer — click to see why▾
Why this is wrong here
This query filters for successful operations, but the question requires returning only failed operations, so it returns the opposite of what is needed.
★ When this WOULD be the correct answer
If the question asked to return only successful operations from the log entries, this query would be correct.
Why candidates choose this
Candidates might misread the question or confuse 'failed' with 'succeeded', especially under time pressure, leading them to choose the filter that seems familiar but is opposite.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.