AZ-104 Question 254
Single answerYou are the Azure Administrator for an application that sends all HTTP request logs to Azure Monitor. The app team reports several recent request failures and wants to see those failed requests for the last hour, sorted by the most recent occurrence, and limited to 10 results. Which Kusto Query Language (KQL) query meets this requirement?
- A
requests | where success == false | where timestamp >= ago(1d) | order by timestamp asc | limit 10
- B
requests | where success == false | where timestamp >= ago(1h) | order by timestamp asc | limit 10
- C
requests | where success == false | where timestamp >= ago(1h) | order by timestamp desc | limit 10
- D
requests | where success == false | where timestamp >= now() | order by timestamp desc | limit 10
Show answer and explanation
Correct answer: C
Explanation
Only the third query meets all specified criteria: limiting results to failures that occurred within the past hour, sorting them by the most recent occurrence first, and showing only the top 10 entries.
- A. Incorrect.
Uses a 1-day range instead of 1 hour and sorts in ascending order, which doesn't meet the requirement to show the most recent requests first within the last hour.
- B. Incorrect.
Correctly uses a 1-hour range but sorts in ascending order, not displaying the most recent failures first.
- C. Correct.
Correctly filters failures within the last hour, sorts by the latest timestamp first (descending), and limits results to 10, matching all the requirements.
- D. Incorrect.
Filters starting from the current time (now), which does not capture the past hour and would omit older requests from the requested 1-hour window.