AZ-400 Questions 61-70: Monitoring, Application Insights, and KQL

Once code reaches production, the DevOps loop depends on feedback: is the app healthy, where is it slow, and what changed right before it broke? The AZ-400 instrumentation domain is small (5-10%), but its questions are very practical — pick the right Azure Monitor tool, read a basic KQL query, or wire an alert to the right people. This set covers Azure Monitor, Log Analytics, Application Insights, VM insights, Container insights, alerts, GitHub insights, and KQL.

This is the seventh post in our AZ-400 series (Questions 61-70). The previous set, AZ-400 Questions 51-60: Security, Secrets, and Compliance Scanning, covers identities, secrets, and scanning. Every question here is an original practice scenario, not a copy of a real exam item.

Question 61: Following One Request Across Services

Contoso’s checkout request passes through a web front end, an API, and a payment service. Users report occasional slow checkouts. The team wants to see one slow request end to end, with the time spent in each service and each dependency call. Which Application Insights capability should they use?

A) Availability tests

B) Live Metrics

C) End-to-end transaction details (distributed tracing)

D) Usage funnels

👁 Reveal Answer

Correct Answer: C

Explanation: Application Insights correlates telemetry across services with a shared operation ID, so the end-to-end transaction view shows a single request as it moves through each component, with timings for every dependency call. That is distributed tracing, and it pinpoints which hop is slow. A checks whether an endpoint is reachable from outside, not where time is spent inside. B streams near-real-time metrics, useful during an incident but not for tracing one past request. D analyzes how users move through pages, not service performance. The Application Map is a useful companion view: it shows all components and their dependencies with failure rates and call times.

Question 62: Is the Site Up from Outside?

Fabrikam wants to know within minutes if its public website stops responding from users’ regions, even when nobody is visiting it at night. What should it configure?

A) An Application Insights availability test that runs from several locations, with an alert

B) A Log Analytics query run manually each morning

C) A pipeline that deploys the site every hour

D) VM insights on the web server

👁 Reveal Answer

Correct Answer: A

Explanation: Availability tests send synthetic requests to a URL at regular intervals from multiple Azure locations, so they detect outages even when there is no real traffic. Attaching an alert rule notifies the team when several locations fail. B finds problems hours too late. C changes the site but never checks that it responds. D reports server performance from the inside, which can look healthy while DNS, certificates, or networking break the site for users.

Question 63: Monitoring an AKS Cluster

Northwind Traders runs its services on Azure Kubernetes Service. The operations team needs node and pod CPU and memory usage, container logs, and restart counts in one place. Which feature should they enable?

A) VM insights on each node

B) Container insights for the AKS cluster

C) Storage insights

D) An Application Insights availability test

👁 Reveal Answer

Correct Answer: B

Explanation: Container insights is built for Kubernetes: it collects performance data for nodes, controllers, pods, and containers, plus container logs and events, into a Log Analytics workspace with ready-made views. It is commonly paired with Azure Monitor managed service for Prometheus for metrics. A focuses on virtual machines and their dependencies, not Kubernetes objects. C covers storage accounts. D only checks whether an endpoint responds.

Question 64: Filtering Logs with KQL

You are querying a Log Analytics workspace. You want only rows from the last 24 hours where the Computer column equals web01. Which query is correct?

A) Perf | summarize Computer == "web01" by ago(24h)

B) Perf | project TimeGenerated > ago(24h)

C) Perf | render Computer == "web01"

D) Perf | where TimeGenerated > ago(24h) and Computer == "web01"

👁 Reveal Answer

Correct Answer: D

Explanation: In Kusto Query Language, where filters rows, and ago(24h) returns the time 24 hours before now, so the query keeps recent rows for web01. A misuses summarize, which aggregates data (for example, summarize avg(CounterValue) by Computer). B misuses project, which selects or renames columns. C misuses render, which draws a chart from results. Learn these four operators — where, project, summarize, and render — for the exam’s basic KQL questions.

Question 65: Charting Errors Over Time

An engineer wants a line chart showing the number of failed requests in 5-minute buckets over the last six hours. Which query fits best?

A) requests | where success == false | count

B) requests | where timestamp > ago(6h) and success == false | summarize count() by bin(timestamp, 5m) | render timechart

C) requests | take 100 | render piechart

D) requests | project timestamp, name | sort by name

👁 Reveal Answer

Correct Answer: B

Explanation: The query filters to failed requests in the last six hours, counts them per 5-minute bucket with bin(), and draws the result with render timechart. A returns a single total with no time breakdown. C takes an arbitrary sample and draws a pie chart, which cannot show trends. D lists columns but aggregates nothing. In workspace-based Application Insights queried from Log Analytics, the same data appears in the AppRequests table with TimeGenerated instead of timestamp.

Question 66: Getting Alerted When CPU Stays High

Woodgrove Bank wants the on-call engineer to get an SMS and a Teams message when average CPU on a VM scale set stays above 85% for 15 minutes. What should you create?

A) A metric alert rule with an action group that contains SMS and Teams (webhook or Logic App) actions

B) A workbook pinned to a dashboard

C) A diagnostic setting that sends logs to storage

D) An autoscale rule only

👁 Reveal Answer

Correct Answer: A

Explanation: An Azure Monitor metric alert rule evaluates the CPU metric over a window (here, 15 minutes above 85%) and fires an action group. Action groups define who is notified and how — SMS, email, voice, push, webhooks, Logic Apps, or automation — and can be reused across many alert rules. B shows data but only if someone looks at it. C archives logs without alerting anyone. D may add capacity, but it does not tell anyone that something is wrong.

Question 67: Seeing Server Dependencies

Before migrating a group of VMs, Adventure Works needs CPU, memory, disk, and network trends for each VM, plus a map of which processes connect to which other servers and ports. What should it enable?

A) Container insights

B) Application Insights Live Metrics

C) VM insights, including its Map feature

D) Azure Advisor

👁 Reveal Answer

Correct Answer: C

Explanation: VM insights collects guest performance data — CPU, memory, disk, and network — and its Map feature discovers running processes and their inbound and outbound connections, which is exactly what you need to plan a migration. A is for Kubernetes clusters. B shows live application telemetry from instrumented code, not server-level dependencies. D gives recommendations on cost, security, and reliability but no performance trends or dependency map.

Question 68: Knowing When a Pipeline Breaks

Tailspin Toys uses Azure Pipelines. Each team wants an email only when a build for its pipelines fails on main, not for every run. What is the simplest way to set this up?

A) An Azure Monitor alert on the Azure DevOps organization

B) A team notification subscription for failed builds, filtered to the team’s pipelines and branch

C) A scheduled query that counts failed builds once a day

D) A dashboard widget showing the latest build result

👁 Reveal Answer

Correct Answer: B

Explanation: Azure DevOps notifications support subscriptions for events such as “A build fails,” with filters for specific pipelines and branches, delivered to a team or individuals. That gives each team exactly the alerts it needs. A is not how Azure DevOps pipeline events are surfaced. C delays the alert by up to a day. D shows status but only when someone looks. In GitHub Actions, the equivalent is workflow-run notification settings or a step that runs on failure() and posts to a channel.

Question 69: Charts for a GitHub Project

Coho Winery tracks work in a GitHub project. The team lead wants a chart showing how many items are in each status and how that changes over time, without exporting data to another tool. What should she use?

A) Repository traffic graphs

B) GitHub Actions usage metrics

C) The Dependency graph

D) Insights for the GitHub project, with a custom chart

👁 Reveal Answer

Correct Answer: D

Explanation: GitHub Projects include insights where you can create and configure charts — for example, a historical chart grouped by the Status field — and filter them to the items you care about. This is the “enable insights and create charts” skill in the AZ-400 outline. A shows repository views and clones. B reports Actions minutes and job usage. C lists a repository’s dependencies for security purposes.

Question 70: Where Telemetry Should Land

Litware collects logs from App Service, AKS, VMs, and Azure Pipelines agents. The team wants to query all of them together with KQL and correlate events across services. Where should these logs be sent?

A) A shared Log Analytics workspace, through diagnostic settings and monitoring agents

B) Separate storage accounts for each service

C) Each team’s local log files

D) An Azure DevOps wiki page

👁 Reveal Answer

Correct Answer: A

Explanation: Azure Monitor Logs stores data in Log Analytics workspaces. Sending resource logs through diagnostic settings, guest data through the Azure Monitor Agent, and application telemetry through workspace-based Application Insights into a shared workspace lets you run one KQL query across all of them. B keeps the data, but you cannot query it together with KQL. C is scattered and lost when machines are rebuilt. D is documentation, not telemetry.

Study Tips for Instrumentation and KQL

• Match the insight to the resource. Application Insights for code, VM insights for servers, Container insights for AKS, and storage and network insights for those services.
• Know distributed tracing. End-to-end transaction details follow one request; the Application Map shows every component and dependency.
• Learn five KQL operators. where filters, project picks columns, summarize aggregates, bin() groups time, render charts.
• Alerts need action groups. The rule decides when to fire; the action group decides who hears about it and how.
• Use the right channel for pipeline alerts. Azure DevOps notification subscriptions or the Teams app for pipelines; GitHub notifications or failure() steps for Actions.

Keep Practicing for AZ-400

Continue with AZ-400 Questions 71-80: Repositories, Permissions, and DevOps Metrics. For KQL practice, Microsoft’s getting started with log queries tutorial pairs well with Questions 64 and 65.