An administrator is reviewing a KQL query used to investigate failed operations in a Log Analytics workspace. Match each KQL operator to the effect it has on the query output.
Drag a concept onto its matching description — or click a concept then click the description.
Filters rows so only records that meet the condition remain in the result.
Returns only selected columns and can rename them for cleaner output.
Aggregates data, such as counting failures by hour or by status code.
Adds a calculated column based on existing fields in each row.
Sorts the result set, such as showing the newest records first.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
where: Filters results to rows matching a specified condition
These are standard KQL operators used in Log Analytics queries. 'where' filters, 'project' selects columns, 'extend' adds computed columns, 'summarize' aggregates, 'join' merges tables, and 'order by' sorts results.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
where: Filters results to rows matching a specified condition
Why this is correct
'where' filters rows based on a boolean expression, keeping only those rows for which the predicate evaluates to true. It operates row-by-row and supports standard comparison operators (=, !=, >, <), string operators (has, startswith), and logical combinations (and, or, not). This operator reduces the number of rows in the result set but does not alter columns or perform any aggregation, making it essential for scoping investigations to a specific time range or error code.
project: Selects a subset of columns
Why this is correct
'project' explicitly defines the shape of the output by selecting a subset of existing columns, optionally renaming them or creating new computed columns inline. It reduces the result set's column count and can also reorder columns, but it does not change the number of rows. In investigations, project is used to narrow down the fields of interest after filtering with where, so analysts can focus on relevant attributes without carrying unnecessary data.
summarize: Aggregates data by groups with aggregation functions
Why this is correct
'summarize' groups rows by one or more key columns and computes aggregate values (count, sum, avg, min, max, dcount, etc.) for each group. It collapses the input into a new table with one row per distinct combination of group keys, and you can apply multiple aggregation functions in a single summarize clause. Unlike where, it does not preserve individual rows; it transforms the data into statistical summaries, which is useful for quantifying failed operations by error type or resource.
extend: Filters results to rows matching a specified condition
Why it's wrong here
'extend' adds one or more new computed columns to the result set with expressions evaluated per row, keeping all existing rows and columns intact. It does not filter rows based on a condition; filtering is exclusively the role of the where operator, which evaluates a boolean predicate. Confusing extend with where would cause the query to produce the same row count but with extra columns, failing to narrow the data for investigation.
join: Adds computed columns to the result set
Why it's wrong here
'join' merges rows from two tabular inputs by matching values in specified key columns, producing a combined result set with columns from both sides. It does not add computed columns to an existing table; that operation belongs to extend, which calculates new fields row-by-row without combining tables. A join can change both row count and column count depending on the join type (inner, leftouter, etc.) and is typically used to enrich logs with metadata from external tables.
order by: Groups data and applies aggregation
Why it's wrong here
'order by' sorts the result set by one or more columns or expressions in ascending or descending order, affecting only the sequence of rows, not their contents or count. It neither groups data nor applies aggregation functions; grouping and aggregation are performed by summarize, which collapses multiple rows into summary rows. Placing order by before summarize would sort the raw rows but then summarize would discard that ordering when it groups the data, so order by is normally applied last in a query.
Go deeper
Learn chapter
Azure Monitor and Log Analytics
Key term
KQL
Kusto Query Language is a powerful read-only query language used to explore, analyze, and visualize large datasets, most notably in Azure Data Explorer and Microsoft Sentinel.
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.