In Log Analytics, you want an alert that fires if VM01 has not sent a Heartbeat record in the last 15 minutes. Which query should be used as the alert condition?

Heartbeat | where Computer == "VM01" | summarize LastHeartbeat = max(TimeGenerated) | where LastHeartbeat > ago(15m)

This query finds a recent heartbeat, which means the VM is healthy rather than missing data.

Heartbeat | where Computer == "VM01" and TimeGenerated > ago(15m) | summarize count() by Computer

This query only counts recent heartbeat records, so it does not surface the condition where the VM has stopped sending them.

Heartbeat | where Computer == "VM01" | summarize count() by bin(TimeGenerated, 15m)

This query groups rows into time buckets, but it does not evaluate whether the latest heartbeat is stale or missing.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Heartbeat | where Computer == "VM01" | summarize LastHeartbeat = max(TimeGenerated) | where LastHeartbeat < ago(15m) — The correct logic is to identify the latest heartbeat for VM01 and then compare that timestamp to the required freshness window. If the newest record is older than 15 minutes, the VM has stopped reporting and the query returns a condition suitable for alerting. This is a common pattern for operational health checks in Log Analytics because it measures data freshness rather than raw event counts. Why others are wrong: Option A checks for recent heartbeats, which is the opposite of the problem. Option C only counts rows within the window and would not clearly indicate a stale or missing heartbeat. Option D groups data into bins, but that does not directly answer whether the most recent heartbeat is too old.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.