AZ-204 Practice Question: Monitor, troubleshoot, and optimize Azure solutions
You need to analyze all exceptions that occurred in the last 24 hours from an application monitored by Application Insights. You want to group them by exception type, and for each type show the URL where it occurred and the count. Which Log Analytics Kusto query should you use?
⚠ Common exam trap
Watch out — candidates often confuse `url` with `operation_Name` or `cloud_RoleInstance`, thinking those columns also represent the URL, but only `url` directly captures the request URL where the exception occurred.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
exceptions | where timestamp > ago(24h) | summarize count() by type, url
The query filters exceptions from the last 24 hours using `timestamp > ago(24h)`, groups them by `type` (exception type) and `url` (the URL where the exception occurred), and then counts occurrences per group with `summarize count()`. This directly matches the requirement to show, for each exception type, the URL and the count.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
exceptions | where timestamp > ago(24h) | summarize count() by type, cloud_RoleInstance
Why it's wrong here
This query correctly filters exceptions from the last 24 hours, but grouping by `cloud_RoleInstance` identifies the specific server or container instance where the exception occurred. While valuable for infrastructure-level debugging and identifying problematic hosts, it does not provide the specific application endpoint or URL that users interacted with to trigger the exception. Therefore, it fails to pinpoint the exact 'from' location within the application's accessible surface.
- ✓
exceptions | where timestamp > ago(24h) | summarize count() by type, url
Why this is correct
This query accurately filters all exceptions that occurred within the last 24 hours using the `ago(24h)` function. By grouping the results using `summarize count() by type, url`, it provides a precise breakdown of how many times each exception `type` occurred at each specific `url`. This directly addresses the requirement to analyze exceptions 'from' their originating application endpoint, offering clear insight into problematic URLs.
- ✗
exceptions | where timestamp > ago(24h) | summarize count() by type, operation_Name
Why it's wrong here
This query filters exceptions from the last 24 hours, but grouping by `operation_Name` provides the logical name of the executed operation, such as a controller action or API method. While closely related to the URL, `operation_Name` is a higher-level abstraction and might not uniquely map to a specific URL, especially with dynamic routing or query parameters. The question specifically asks to analyze exceptions 'from' a location, implying the direct, user-facing endpoint rather than an internal operation name.
- ✗
exceptions | where timestamp > ago(24h) | summarize count() by type
Why it's wrong here
This query correctly filters exceptions from the last 24 hours, but it only groups the results by `type`, providing a count for each distinct exception category. While this offers a high-level overview of the most common exception types, it completely omits the crucial information about *where* these exceptions are occurring within the application. It fails to provide the necessary granularity to identify specific URLs or endpoints that are experiencing issues, thus not fulfilling the requirement to analyze exceptions 'from' a particular location.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.