AZ-204 Practice Question: Monitor, troubleshoot, and optimize Azure solutions
You are using Azure Monitor to collect logs from multiple Azure resources. You need to query logs to find all error events from the last 24 hours. Which query language should you use?
⚠ Common exam trap
Many exam-takers confuse Azure Monitor's query language with SQL-like syntax (T-SQL) due to familiarity, but KQL is the only language natively supported for log queries in Azure Monitor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Kusto Query Language (KQL)
Azure Monitor uses Kusto Query Language (KQL) as its native query language for log analytics. KQL is specifically designed for querying large volumes of structured and semi-structured data in Azure Data Explorer and Log Analytics workspaces, making it the correct choice for retrieving error events from the last 24 hours.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transact-SQL (T-SQL)
Why it's wrong here
Transact-SQL (T-SQL) is a proprietary extension to SQL, primarily used for querying and manipulating relational data within Microsoft SQL Server and Azure SQL Database. Azure Monitor Logs, however, store semi-structured, time-series log data in a specialized data store that is not a traditional relational database. Therefore, T-SQL is incompatible with the underlying data model and query engine used by Azure Monitor Logs.
- ✗
PromQL
Why it's wrong here
PromQL (Prometheus Query Language) is a functional query language specifically designed for querying Prometheus's time-series database and its unique data model. While both Prometheus and Azure Monitor deal with monitoring data, their architectures and data storage mechanisms are distinct. Azure Monitor Logs do not natively support PromQL for querying the ingested log data, as they utilize a different query engine and data schema.
- ✗
PowerShell
Why it's wrong here
PowerShell is a powerful cross-platform task automation and configuration management framework, encompassing a command-line shell and a scripting language. While PowerShell cmdlets can be used to programmatically interact with Azure Monitor, such as retrieving log data or managing Log Analytics workspaces, it is not a dedicated query language for performing analytical queries directly against the log data store itself. It orchestrates actions rather than directly querying the data.
- ✓
Kusto Query Language (KQL)
Why this is correct
Kusto Query Language (KQL) is the powerful, read-only query language used to query and analyze data in Azure Data Explorer, Azure Monitor Logs (Log Analytics), and Azure Sentinel. It is specifically designed for querying large volumes of structured, semi-structured, and unstructured data, making it ideal for log and telemetry analysis. KQL provides rich capabilities for filtering, aggregating, joining, and visualizing data from various sources within Azure Monitor, making it the native and most efficient way to interact with log data.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.