Exam AZ-104 Topic 3 Question 649 Discussion

Actual exam question for Microsoft's AZ-104 exam
Question #: 649
Topic #: 3
You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
You need to view the error from a table named Event.
Which query should you run in Workspace1?

Suggested Answer: B Vote an answer

To search a term in a specific table, add the table-name just after the search operator.
Note:
There are several versions of this question in the exam. The question has two possible correct answers:
1. Event | search "error"
2. Event | where EventType == "error"
3. search in (Event) "error"
Other incorrect answer options you may see on the exam include the following:
1. Get-Event Event | where {$_.EventTye =="eq "error"}
2. Event | where EventType is "error"
3. search in (Event) * | where EventType =="eq "error"
4. select * from Event where EventType is "error"
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal
https://docs.microsoft.com/en-us/azure/data-
explorer/kusto/query/searchoperator?pivots=azuredataexplorer

by Leonard at Jul 11, 2026, 10:30 AM

Limited Time Offer

15%

Off

Get Premium AZ-104 Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10