Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel →easyMultiple ChoiceObjective-mapped
AZ-500 Time range filtering in Azure Workbooks Practice Question
Your company has a hybrid environment with Azure resources and on-premises servers. You have deployed Microsoft Sentinel and connected it to Azure AD, Azure Activity Logs, and Windows Security Events from on-premises servers via the Log Analytics gateway. You need to create a workbook that shows the number of sign-ins from each country over the last 24 hours. The data source is the SigninLogs table. However, the workbook does not display any data. You verify that the Log Analytics workspace is receiving sign-in logs from Azure AD. Which of the following is the most likely reason the workbook shows no data?
⚠ Common exam trap
The most common trap is assuming that if logs are flowing into the Log Analytics workspace, the workbook will automatically show data. However, workbook queries often have their own time filters that must align with the dashboard's time range. Misconfigured time parameters are a frequent hidden issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The workbook's time range filter is set to 'Last 7 days' but the query uses a 24-hour filter incorrectly.
The workbook likely has a time range filter set to 'Last 7 days', but the underlying KQL query uses a hardcoded 24-hour filter. This mismatch causes the query to return data only for the last 24 hours, but the dashboard filter may interfere or the query may be incorrectly referencing the time parameter. As a result, no data is displayed. Option A is incorrect because workbooks rely on KQL queries regardless of visualization type. Option B is incorrect because the Log Analytics gateway is used for on-premises data, not for Azure AD sign-in logs which stream directly to the workspace. Option D is incorrect because the problem statement confirms sign-in logs are being received.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The workbook uses a different visualization type that requires KQL.
Why it's wrong here
This option is incorrect because Azure Workbooks rely on Kusto Query Language (KQL) for all visualization types, including tables, charts, and tiles. Changing the visualization type does not alter the language requirement or the data returned by the query; the query itself is what determines the dataset. A visualization type only specifies how results are rendered, so it cannot be the cause of no data appearing. The issue must be in the query's logic—such as an incorrect time filter—not in the visualization mode.
- ✗
The Log Analytics gateway is blocking the sign-in logs.
Why it's wrong here
This is incorrect. The Log Analytics gateway is used to collect data from on-premises servers. Azure AD sign-in logs are sent directly to Log Analytics via the diagnostic settings, not through the gateway, so the gateway cannot block them.
- ✓
The workbook's time range filter is set to 'Last 7 days' but the query uses a 24-hour filter incorrectly.
Why this is correct
This is correct. The workbook's time range filter might be set to a broader range (e.g., last 7 days) while the query uses a 24-hour filter. If the query does not correctly use the time parameter, it may return no results when the dashboard filter is applied.
- ✗
The Log Analytics workspace is not receiving sign-in logs from Azure AD.
Why it's wrong here
This option is incorrect because the scenario explicitly states that sign-in logs from Azure AD are being received in the Log Analytics workspace. If the workspace were not receiving these logs, you would first verify the diagnostic settings for Azure AD, the workspace's data collection rules, and agent connectivity. Since ingestion is confirmed, the absence of data in the workbook cannot be attributed to a failure at the collection layer. The root cause therefore lies in how the workbook query filters or parameterizes the time range relative to the underlying data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.