AZ-204 Practice Question: Monitor, troubleshoot, and optimize Azure solutions
Exhibit
requests | where timestamp > ago(1h) | summarize count() by bin(timestamp, 5m), resultCode | render timechart
Refer to the exhibit. You run this KQL query in Azure Monitor Logs. What does the timechart display?
⚠ Common exam trap
The trap here is that candidates often overlook the `by ResultCode` clause and assume the query simply counts all requests over time, leading them to choose a single-line option (B or C) instead of recognizing that each distinct result code generates its own series.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multiple lines, one for each result code, showing request count over time
The KQL query uses `summarize count() by ResultCode, bin(TimeGenerated, 5m)` which groups requests by both `ResultCode` and 5-minute time bins. When rendered with `render timechart`, each distinct `ResultCode` value produces a separate series (line) on the chart, showing the request count over time for that result code. This is why multiple lines appear, one per result code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Multiple lines, one for each result code, showing request count over time
Why this is correct
The `summarize count() by bin(timestamp, 5m), resultCode` clause explicitly groups the request counts by both 5-minute time intervals and distinct `resultCode` values. Consequently, the `render timechart` operator will generate a separate line for each unique `resultCode` encountered within the dataset, plotting its count over the binned time periods. This provides a clear visualization of how the volume of requests for each specific result code changes over time.
- ✗
A single line of total requests over time
Why it's wrong here
The KQL query includes `resultCode` in its `summarize by` clause, which instructs the aggregation to create distinct groups for each unique `resultCode` value. If the intent was a single line of total requests, the `resultCode` would need to be omitted from the `by` clause, or a subsequent `summarize` operation would be required to sum across all `resultCode` values for each time bin. Therefore, the `render timechart` will display multiple lines, not a single aggregate line.
- ✗
Total requests per 5 minutes
Why it's wrong here
While the query does bin requests into 5-minute intervals using `bin(timestamp, 5m)`, the `summarize` operator also includes `resultCode` in its grouping criteria. This means the count is not just for *total* requests within each 5-minute bin, but rather the count of requests *per resultCode* within each 5-minute bin. To get only total requests per 5 minutes, `resultCode` would need to be excluded from the `by` clause.
- ✗
Requests grouped by result code only
Why it's wrong here
The query explicitly uses `bin(timestamp, 5m)` as the primary grouping mechanism, which creates discrete 5-minute time intervals. While `resultCode` is also part of the `summarize by` clause, it acts as a secondary grouping within each time bin. Therefore, the results are not solely grouped by `resultCode`; they are fundamentally structured as a time series, with `resultCode` providing further segmentation within each time segment.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.