Implement an instrumentation strategy →hardMultiple ChoiceObjective-mapped

AZ-400 Implement an instrumentation strategy Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "apiVersion": "microsoft.insights/v1",
  "location": "eastus",
  "properties": {
    "dataFlows": [
      {
        "destinations": ["la-workspace"],
        "streams": ["Microsoft-InsightsMetrics"]
      }
    ],
    "dataSources": {
      "performanceCounters": [
        {
          "name": "cpuCounter",
          "counterSpecifiers": [
            "\\Processor(_Total)\\% Processor Time"
          ],
          "samplingFrequencyInSeconds": 60
        }
      ]
    },
    "destinations": {
      "logAnalytics": [
        {
          "workspaceResourceId": "/subscriptions/sub-id/resourceGroups/rg/providers/Microsoft.OperationalInsights/workspaces/myworkspace"
        }
      ]
    }
  }
}
```

You are reviewing a Data Collection Rule (DCR) for an Azure virtual machine. The DCR is assigned to the VM, and the Azure Monitor Agent is installed. After one hour, no performance data appears in the Log Analytics workspace. What is the most likely cause?

⚠ Common exam trap

The trap here is that candidates focus on the counter specifier format or sampling frequency, overlooking the critical data flow stream property which is the actual pipeline that enables data ingestion.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The data flow streams property does not include 'Microsoft-Perf'.

The most likely cause is that the data flow streams property in the DCR does not include 'Microsoft-Perf'. The Azure Monitor Agent uses DCRs to define which data to collect and where to send it. Without the 'Microsoft-Perf' stream specified in the dataFlows section, performance counters are not collected, even if the counter specifiers are correctly defined. The workspace resource ID and counter format may be correct, but the missing stream prevents any performance data from being ingested.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The workspace resource ID is incorrectly formatted.
Why it's wrong here
The workspace resource ID is incorrectly formatted. The resource ID is actually well-formed because it follows the standard Azure Resource Manager format '/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.OperationalInsights/workspaces/<workspace-name>', with a valid subscription ID, resource group, and workspace name, so this is not the cause of the collection failure.
✓
The data flow streams property does not include 'Microsoft-Perf'.
Why this is correct
The data flow streams property does not include 'Microsoft-Perf'. For Windows performance counters to be collected in an Azure Monitor DCR, the 'dataFlows' section must map the 'Microsoft-Perf' stream to the destination workspace; without this stream explicitly listed, the DCR lacks the required linkage for performance data ingestion, and no counter data will flow.
✗
The counter specifier uses the wrong format for Windows performance counters.
Why it's wrong here
The counter specifier uses the wrong format for Windows performance counters. The specifier '\\Processor(_Total)\\% Processor Time' is the standard and correct WMI/Logman format for Windows performance counters, where the object, instance, and counter are separated by backslashes and parentheses, so the format is valid and not a contributing factor.
✗
The sampling frequency of 60 seconds is too low and data is being throttled.
Why it's wrong here
The sampling frequency of 60 seconds is too low and data is being throttled. In Azure Monitor DCRs, performance counter collection supports a 'scheduledTransferPeriod' or sampling interval in seconds, and 60 seconds is a valid, typical interval for Windows performance counters; it does not cause throttling because throttling is based on data volume and rate limits, not a 60-second sample frequency.

Go deeper

AZ-400 Implement an instrumentation strategy Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question