AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Your organization uses Azure Monitor Logs to analyze application performance. You need to create a custom log query that calculates the 95th percentile of response times for a web app over the last 24 hours. Which THREE KQL functions should you use? (Choose three.)
⚠ Common exam trap
Candidates often confuse `project` or `sort` with filtering or aggregation functions, mistakenly thinking they can help narrow the data or compute percentiles, when in fact only `where`, `summarize`, and `percentile` perform the required operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
percentile
Option A, percentile, is correct because it is the KQL aggregation function that computes the 95th percentile value of a numeric column such as response time. Option B, summarize, is correct because percentile must be invoked inside a summarize operator to group and aggregate the data over the desired window. Option E, where, is correct because it filters the dataset to the last 24 hours (for example, where TimeGenerated > ago(24h)) before aggregation. Option C, project, is not required since it only selects or renames columns and does not perform percentile calculation. Option D, sort, is not required because ordering rows does not contribute to computing a percentile aggregate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
percentile
Why this is correct
The percentile function computes the 95th percentile of a numeric column, such as response time, over the queried set. Combined with a time filter and a summarise operator, it satisfies the requirement to calculate p95 response times across the last 24 hours.
- ✓
summarize
Why this is correct
The `summarize` operator groups log records into 24-hour buckets and computes aggregations such as `percentile()`, satisfying the requirement to calculate the 95th percentile of response times. Without it, no aggregation across the dataset is possible, so it is essential alongside `percentile()` and a time-filtering function.
- ✗
project
Why it's wrong here
project selects and renames columns, so it cannot compute a percentile; the query needs summarize with percentile() over the response-time column. It is tempting because project is genuinely required to shape output columns, and would be correct when trimming a result set rather than aggregating.
- ✗
sort
Why it's wrong here
sort orders rows but does not aggregate, so it cannot yield a 95th percentile value; summarize with percentile() performs that calculation. It is tempting because sorting is genuinely needed to inspect top response times, and would be correct when ranking slowest requests rather than computing a percentile.
- ✓
where
Why this is correct
The `where` operator filters records to the last 24 hours and the specific web app, satisfying the scoping constraint before aggregation. Percentile calculations require a reduced dataset; without this time and resource filter, the `percentile()` function would compute across irrelevant rows, producing inaccurate 95th percentile response times.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.