Connect to and consume Azure services and third-party services →hardMultiple ChoiceObjective-mapped

AZ-204 Practice Question: Connect to and consume Azure services and third-party services

Exhibit

Refer to the exhibit.
```sql
SELECT 
  bin(TimeGenerated, 1h) AS TimeHour,
  ResourceProvider,
  AVG(Value) AS AvgValue
FROM metrics
WHERE TimeGenerated > ago(1d)
GROUP BY bin(TimeGenerated, 1h), ResourceProvider
| order by TimeHour asc
```

You are querying Azure Monitor metrics using Kusto Query Language (KQL). The query is supposed to return average metric values per hour per resource provider, but it returns no results. What is the most likely issue?

⚠ Common exam trap

Many candidates assume the table is simply named 'metrics' based on general database conventions, but Azure Monitor specifically uses 'AzureMetrics' as the table name for metric data.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The table name should be 'AzureMetrics' instead of 'metrics'.

C is correct because the Azure Monitor metrics table is named 'AzureMetrics', not 'metrics'. When querying Azure Monitor metrics using KQL, referencing the wrong table name will result in no results being returned, as the query engine cannot find the specified table.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The ORDER BY clause should be before GROUP BY.
Why it's wrong here
In Kusto Query Language (KQL), the logical processing order dictates that data aggregation, typically performed by the 'summarize' operator which implicitly uses 'GROUP BY', occurs before any sorting operations. Therefore, an 'ORDER BY' clause must always follow 'summarize' or any other aggregation, as it sorts the *results* of the aggregation, not the raw input data. Placing 'ORDER BY' before 'GROUP BY' would result in a syntax error or incorrect query logic.
✗
The 'bin' function is used incorrectly; it should be 'bin(TimeGenerated, 1h)' without the alias.
Why it's wrong here
The 'bin' function in KQL is correctly used with an alias in 'bin(TimeGenerated, 1h) as TimeBucket'. Aliasing the resulting column, such as 'TimeBucket', is a standard and often preferred practice for enhancing query readability and clarity. This allows for straightforward referencing of the binned time column in subsequent clauses like 'GROUP BY' or 'project', and it does not constitute incorrect syntax or functionality.
✓
The table name should be 'AzureMetrics' instead of 'metrics'.
Why this is correct
Azure Monitor resource metrics, when ingested into a Log Analytics workspace, are specifically stored in the 'AzureMetrics' table. The table name 'metrics' is not a standard or recognized table for this type of data within a Log Analytics workspace. Therefore, any KQL query attempting to retrieve Azure Monitor metrics must explicitly reference 'AzureMetrics' to access the relevant time-series data and associated dimensions.
✗
The GROUP BY clause cannot include a computed column like 'bin'.
Why it's wrong here
In Kusto Query Language, the 'GROUP BY' clause is highly flexible and can indeed include computed columns. A column derived from a function like 'bin(TimeGenerated, 1h)' is evaluated before the aggregation step. This means the computed 'TimeBucket' column is fully available and valid to be used as a grouping key within the 'summarize' operator, allowing for aggregation based on these dynamically generated time intervals.

Go deeper

AZ-204 Practice Question: Connect to and consume Azure services and third-party services

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question