Courseiva
← DP-900
Full test
Describe core data concepts →hardMultiple ChoiceObjective-mapped

DP-900 Describe core data concepts Practice Question

Exhibit

Refer to the exhibit.
```kusto
StormEvents
| where State == "TEXAS"
| summarize TotalDamage = sum(DamageProperty) by EventType
| top 5 by TotalDamage desc
```

The exhibit shows a Kusto Query Language (KQL) query run in Azure Data Explorer. What is the output of this query?

⚠ Common exam trap

It's easy for candidates to confuse 'top 5 property damage amounts' (raw values) with 'top 5 event types by total property damage' (aggregated categories), or they think the query lists individual events rather than summarized groups.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The top 5 event types in Texas by total property damage

The query uses `summarize sum(PropertyDamage) by EventType` to aggregate total property damage per event type, then `top 5 by TotalPropertyDamage` to return the five event types with the highest totals. The `where State == 'TEXAS'` filter ensures only Texas storms are considered. This directly yields the top 5 event types in Texas by total property damage.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    All storm events in Texas with property damage

    Why it's wrong here

    This choice describes a row-level filter: it would use a where clause to find storms with property damage and then list each event. The query instead uses the summarize operator to aggregate damage by EventType, collapsing many rows into per-type totals. Because it also applies top 5 by the summed damage, only five aggregated groups are returned, not all qualifying storm events.

  • ✗

    The total property damage for all event types in Texas

    Why it's wrong here

    The phrase 'total property damage for all event types' implies a single grand total computed with a sum() over the whole filtered dataset, with no separate grouping. In the query, the by EventType clause causes a separate sum(PropertyDamage) to be calculated for each distinct event type, producing multiple rows. The top 5 restriction then discards all but the five largest type totals, so the result cannot represent an overall combined damage figure.

  • ✓

    The top 5 event types in Texas by total property damage

    Why this is correct

    This is exactly what the query does: summarize by EventType groups the Texas storm records by event category, sum(PropertyDamage) totals the damage within each group, and the top operator (or order by + take) selects the five highest groups. Each output row pairs an EventType with its aggregated damage, which is the standard KQL pattern for a ranked breakdown. The result therefore identifies which event types had the most total property damage in Texas.

  • ✗

    A list of the top 5 property damage amounts in Texas

    Why it's wrong here

    A list of the top 5 property damage amounts would be a simple projection of the five largest individual damage values, likely from a sorted column. The query, however, includes the EventType column alongside the computed total, because the grouping by EventType changes the grain of the result. Additionally, sum(PropertyDamage) aggregates many storm records into one value per type, so the amounts shown are per-type totals rather than standalone property damage amounts.

About these practice questions

One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on DP-900

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. The exhibit shows a KQL query in Azure Data Explorer. What is the output of this query?

easy
  • A.Bottom 5 states by total property damage
  • ✓ B.Top 5 states by total property damage
  • C.All states with total property damage
  • D.All storm events after 2024-01-01

Why B: The KQL query uses `summarize` to aggregate total property damage by state, then `top 5 by total_property_damage` to return the five states with the highest total damage. The `desc` argument (default) orders the results in descending order, making option B correct.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.