DP-900 Describe an analytics workload on Azure Practice Question
Exhibit
Refer to the exhibit. Query: // KQL query executed in Azure Data Explorer StormEvents | where State == "TEXAS" | summarize Count = count() by EventType | top 5 by Count
Refer to the exhibit. An analyst runs this Kusto Query Language (KQL) query in Azure Data Explorer. What is the primary purpose of this query?
⚠ Common exam trap
Microsoft often tests the distinction between counting occurrences (using `count()` with `summarize`) versus summing numeric values (using `sum()`), leading candidates to confuse 'most common' with 'highest damage'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Find the top 5 most common event types in Texas
The query uses the `summarize` operator with `count()` to count events per `EventType`, then `top 5 by count_` to return the five event types with the highest counts, filtered to only rows where `State == 'TEXAS'`. This directly finds the top 5 most common event types in Texas.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Find the top 5 most common event types in Texas
Why this is correct
This query uses a `summarize` operator to group storm events in Texas by `EventType` and count the number of rows in each group, then a `top 5` operator ordering by that count descending. The result is exactly the five event-type categories with the highest frequency in the Texas dataset. Because it counts occurrences per category rather than measuring impact or listing raw records, it answers the 'most common' question precisely.
- ✗
Calculate total damage in Texas
Why it's wrong here
The query never references damage columns such as `DamageProperty` or `DamageCrops`, and no aggregation function like `sum()` is applied to any numeric damage field. `summarize Count = count() by EventType` only counts rows, and `top 5 by Count` sorts those frequency counts. Calculating total damage would require changing the aggregation to `summarize TotalDamage = sum(DamageProperty) + sum(DamageCrops)` (or equivalent), which is absent here.
- ✗
Identify events with the highest damage
Why it's wrong here
This query orders event types by the number of occurrences, not by financial impact. There is no `order by` on any damage value, no `top 5 by DamageProperty`, and no filter such as `where DamageProperty > 0`; the `top 5` applies to the count of events per type. Identifying highest-damage events would require an entirely different aggregation and sorting on damage fields, so the output cannot support that conclusion.
- ✗
List all storm events in Texas
Why it's wrong here
The `summarize ... by EventType` collapses all individual storm records into one row per event type with an aggregated `Count`, so the result set contains no raw event rows. Listing all storm events would require a projection with `project` or `project-away` after a simple `where State == 'TEXAS'`, preserving each row. Since this query groups and counts, it intentionally loses the per-event detail needed for a list.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DP-900 question from scratch — 820 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.