Describe core data concepts →easyMultiple ChoiceObjective-mapped

DP-900 Describe core data concepts Practice Question

Exhibit

Refer to the exhibit.
```kusto
StormEvents
| where StartTime > datetime(2024-01-01)
| summarize TotalDamage = sum(DamageProperty) by State
| top 5 by TotalDamage desc
```

The exhibit shows a KQL query in Azure Data Explorer. What is the output of this query?

⚠ Common exam trap

Test-takers frequently confuse `top` with `take` or `limit`, forgetting that `top` implicitly sorts in descending order unless `asc` is specified, leading them to think it returns the bottom values or all rows.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Top 5 states by total property damage

The KQL query uses `summarize` to aggregate total property damage by state, then `top 5 by total_property_damage` to return the five states with the highest total damage. The `desc` argument (default) orders the results in descending order, making option B correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Bottom 5 states by total property damage
Why it's wrong here
The `top 5 by DamageProperty desc` operator sorts the summarized state totals in descending order and keeps the first five rows, which are the five largest values. 'Desc' explicitly means descending, so the result is the top 5 highest damage states, not the bottom 5. To get the lowest five, you would need `top 5 by DamageProperty asc` or an equivalent ascending sort.
✓
Top 5 states by total property damage
Why this is correct
This query filters storm events to those on or after 2024-01-01, groups the remaining rows by State using `summarize`, and computes the sum of DamageProperty for each state. The subsequent `top 5 by DamageProperty desc` operator sorts these state-level sums in descending order and returns the first five rows, which are exactly the five states with the highest total property damage. The result is a ranked list of the top 5 states by total damage.
✗
All states with total property damage
Why it's wrong here
Although the `summarize` operator computes a total property damage value for every state that appears in the filtered dataset, the `top 5 by DamageProperty desc` operator that follows limits the final output to only five rows. States ranked sixth and below are discarded, so the result does not contain all states. To return every state's total damage, the query would need to remove the `top` operator and optionally use `order by` for sorting.
✗
All storm events after 2024-01-01
Why it's wrong here
This query starts by filtering the source table to storm events dated on or after 2024-01-01, but then `summarize` immediately collapses those event-level rows into per-state totals using `sum(DamageProperty)`. Therefore, the output rows represent aggregated state summaries, not individual storm events. Additionally, the `top 5` operator further reduces the result to only five states, so it cannot be interpreted as a list of all storm events after the given date.

Go deeper

DP-900 Describe core data concepts Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question