Describe an analytics workload on Azure →hardMultiple ChoiceObjective-mapped

DP-900 Describe an analytics workload on Azure Practice Question

Exhibit

Refer to the exhibit.

```kusto
let startTime = datetime(2025-01-01T00:00:00Z);
let endTime = datetime(2025-01-02T00:00:00Z);
AzureDiagnostics
| where ResourceType == "AZURESQLDB"
| where TimeGenerated between (startTime .. endTime)
| where OperationName == "QueryThrottled"
| summarize Count = count() by DatabaseName, bin(TimeGenerated, 1h)
| render timechart
```

Refer to the exhibit. A database administrator runs this KQL query in Azure Monitor Log Analytics. The query returns no results. What is the most likely reason?

⚠ Common exam trap

Microsoft often tests the candidate's understanding that KQL filters are case-sensitive and that resource type values must exactly match the Azure Resource Manager format, leading candidates to overlook a simple typo or casing error.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The ResourceType filter is incorrect

The KQL query filters on `ResourceType` with a value that does not match any actual Azure resource type (e.g., a typo or incorrect casing). Since Azure Monitor Log Analytics stores resource types in a specific format (e.g., 'microsoft.compute/virtualmachines'), an incorrect filter will return zero results even if data exists. The query syntax, render command, and time range are all valid, so the filter is the most likely cause.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The summarize operator syntax is wrong
Why it's wrong here
The summarize operator syntax in this KQL query is valid and follows correct KQL grammar: `summarize count() by ResourceType, bin(timeGenerated, 1h)` is a standard aggregation pattern that groups rows by ResourceType and hourly buckets of timeGenerated. The problem is not that the operator is malformed; rather, the preceding `where` clause filters out all rows, so the summarize operator will simply return an empty table. There is no syntax error in the summarize statement itself—it is the interaction with an over-restrictive filter that makes the query return no meaningful results.
✓
The ResourceType filter is incorrect
Why this is correct
The ResourceType filter is the root cause of the failure because Azure SQL Database diagnostic logs are written to the AzureDiagnostics table with a resource type value of `MICROSOFT.SQL/SERVERS/DATABASES`, not the friendly name `AZURESQLDB`. When the query filters on `ResourceType == "AZURESQLDB"`, it matches zero rows because the actual value stored in the ResourceType column is the full ARM resource type path. To correctly filter Azure SQL Database diagnostics, the query should use `ResourceType == "MICROSOFT.SQL/SERVERS/DATABASES"` or omit the filter to see all diagnostic data. This is a common mistake because the Azure portal may display friendly names, but the underlying KQL data uses the canonical resource type string.
✗
The render command is not supported
Why it's wrong here
The render command in this KQL query is fully supported in both Log Analytics and Azure Data Explorer. `render timechart` is a valid and widely used command that visualizes the results of an aggregation query as a time-series chart, and it is not the source of the problem. The query would execute and render a chart if the summarize operator returned any data, but because the ResourceType filter excludes all rows, the render command has no data to display. Thus, the render command itself is not unsupported—it simply has nothing to plot due to the earlier filtering issue.
✗
The time range is incorrect
Why it's wrong here
The time range specified in the query is not incorrect; it is a valid and reasonable time range that covers a full 24-hour period, which is sufficient for diagnosing database activity. The query does not use a time filter like `where TimeGenerated > ago(24h)`, but even if it did, the time range would not be the reason for the empty result. The absence of data is caused entirely by the ResourceType filter matching no rows, not by any limitation or error in the time range specification. A correct query with the proper resource type filter would succeed within this same time range.

Go deeper

DP-900 Describe an analytics workload on Azure Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question