Implement an instrumentation strategy →hardMultiple ChoiceObjective-mapped

AZ-400 Implement an instrumentation strategy Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspaceName": {
      "type": "string"
    },
    "location": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces",
      "apiVersion": "2022-10-01",
      "name": "[parameters('workspaceName')]",
      "location": "[parameters('location')]",
      "properties": {}
    },
    {
      "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
      "apiVersion": "2020-08-01",
      "name": "[concat(parameters('workspaceName'), '/PipelineFailures')]",
      "dependsOn": [
        "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]"
      ],
      "properties": {
        "category": "Azure Pipelines",
        "displayName": "Pipeline Failures in Last 24 Hours",
        "query": "AzureDevOpsPipelineEvents_CL | where TimeGenerated > ago(24h) and Result_s == 'Failed'"
      }
    }
  ]
}
```

Refer to the exhibit. You deploy this ARM template to create a Log Analytics workspace and a saved search. After deployment, you notice that the saved search returns no results even though there are failed pipeline runs. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The custom table 'AzureDevOpsPipelineEvents_CL' does not exist in the workspace.

The query uses a custom log table 'AzureDevOpsPipelineEvents_CL' which requires a custom table or data connector to be created first. Option A is wrong because the savedSearch API version is valid. Option B is wrong because the workspace API version is valid. Option D is wrong because the category is just a label.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The savedSearch API version is not supported.
Why it's wrong here
The savedSearch API version specified in the ARM template (e.g., 2020-08-01) is a valid, fully supported version for Microsoft.OperationalInsights/workspaces/savedSearches, so an unsupported API version is not the cause of the deployment failure.
✗
The Log Analytics workspace API version is incorrect.
Why it's wrong here
The Log Analytics workspace resource uses API version 2019-04-01, which is a current and valid version for Microsoft.OperationalInsights/workspaces; an incorrect API version would trigger a validation error, but this one is correct.
✓
The custom table 'AzureDevOpsPipelineEvents_CL' does not exist in the workspace.
Why this is correct
The ARM template deployment fails because the saved search references the custom log table 'AzureDevOpsPipelineEvents_CL', but that table does not exist in the workspace. Custom tables with the _CL suffix must be created beforehand (or data must be ingested to auto-create them); ARM templates do not implicitly create custom tables just because a saved search queries them.
✗
The category 'Azure Pipelines' is misspelled.
Why it's wrong here
The category property in a saved search is a free-form, user-defined label used for organization in the Azure portal; it is not checked against a fixed list or used in resource validation, so a misspelling of 'Azure Pipelines' would not cause a deployment error.

Go deeper

AZ-400 Implement an instrumentation strategy Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question