Skip to content
Cheat sheets

AZ-400 · Domain 5: Implement an instrumentation strategy · 7% of the exam

Task 5.2: Analyze metrics from instrumentation

Reading CPU, memory, disk and network indicators, usage and application performance, distributed traces in Application Insights, and basic KQL queries over logs.

Study it

Sample questions

Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.

Question 1 · choose 1

You need a chart of failed requests per 5-minute interval over the last 24 hours from the Application Insights requests table, where failed requests have success equal to false. Which query produces the counts for that chart?

  1. Arequests | where success == false | take 288
  2. Brequests | where timestamp > ago(24h) and success == false | summarize count() by bin(timestamp, 5m)
  3. Crequests | summarize count() by success | where timestamp > ago(24h)
  4. Drequests | where timestamp > ago(5m) and success == false | count
Show the answer and why

  • Arequests | where success == false | take 288

    Incorrect

    That returns rows, not a count per interval.

  • Brequests | where timestamp > ago(24h) and success == false | summarize count() by bin(timestamp, 5m)

    Correct

    It filters to the last day's failures, then counts rows in 5-minute bins.

  • Crequests | summarize count() by success | where timestamp > ago(24h)

    Incorrect

    After summarize, timestamp no longer exists, and nothing is binned by time.

  • Drequests | where timestamp > ago(5m) and success == false | count

    Incorrect

    That counts failures in the last five minutes only.

where filters rows, ago() gives a time relative to now, and summarize count() by bin(timestamp, 5m) groups rows into 5-minute buckets and counts them.

Microsoft documentation

Task 5.2Report a problem with this question

Question 2 · choose 1

Checkout requests sometimes fail after passing through a front-end API, an orders service and a payments service, each sending telemetry to Application Insights. You need to see, for one failed request, every call it made across the services and which dependency failed. What should you use?

  1. AThe end-to-end transaction details from the Failures view
  2. BUsage funnels for the checkout steps
  3. CThe VM performance charts of the hosts
  4. DLive metrics, watched while waiting for the next failure to happen
Show the answer and why

  • AThe end-to-end transaction details from the Failures view

    Correct

    Transaction diagnostics shows the correlated calls of one operation across components, with dependencies and exceptions.

  • BUsage funnels for the checkout steps

    Incorrect

    Funnels show where users drop off, not the calls in one request.

  • CThe VM performance charts of the hosts

    Incorrect

    Host charts show resource load, not one request's path.

  • DLive metrics, watched while waiting for the next failure to happen

    Incorrect

    It doesn't show the call tree of a request that already failed.

Application Insights correlates telemetry for an operation across components. From the Failures or Performance views you can drill into end-to-end transaction details, which show dependencies and exceptions for the operation, to find the root cause.

Microsoft documentation

Task 5.2Report a problem with this question

Question 3 · choose 1

A chart of errors per hour skips hours with no errors, so the line jumps between gaps. Which operator builds a series with a value for every hour, using 0 where there were no rows?

  1. Amake-series
  2. Btake
  3. Cproject-away
  4. Dparse
Show the answer and why

  • Amake-series

    Correct

    make-series assigns a default value, 0 unless set, to bins with no rows.

  • Btake

    Incorrect

    take returns rows; it doesn't build a series.

  • Cproject-away

    Incorrect

    project-away removes columns.

  • Dparse

    Incorrect

    parse extracts values from strings.

make-series creates a series of aggregated values along an axis such as time; where there's no row for a bin, the array gets the default value, which is 0 unless you set another.

Microsoft documentation

Task 5.2Report a problem with this question

Question 4 · choose 1

A query returns one row per hour, with a timestamp column and a request count column. Which line turns the result into a line chart over time?

  1. A| project timechart
  2. B| render timechart
  3. C| extend chart = 1
  4. D| sort by timestamp
Show the answer and why

  • A| project timechart

    Incorrect

    project selects columns.

  • B| render timechart

    Correct

    render with timechart draws the series over time.

  • C| extend chart = 1

    Incorrect

    extend adds a column.

  • D| sort by timestamp

    Incorrect

    Sorting orders rows; it doesn't draw a chart.

render tells the client how to visualize results, for example as a timechart for time series.

Microsoft documentation

Task 5.2Report a problem with this question

Question 5 · choose 1

A new engineer needs a picture of which services call which, with failure rates and latency on each call, from Application Insights. What should she open?

  1. AApplication map
  2. BUsage cohorts
  3. CAvailability tests
  4. DSmart detection
Show the answer and why

  • AApplication map

    Correct

    It shows components and dependencies with performance and failure data.

  • BUsage cohorts

    Incorrect

    Cohorts group users.

  • CAvailability tests

    Incorrect

    These probe endpoints from outside.

  • DSmart detection

    Incorrect

    That reports anomalies.

Application map shows the components of a distributed application and their dependencies, helping you spot performance bottlenecks and failure hotspots across components.

Microsoft documentation

Task 5.2Report a problem with this question

Question 6 · choose 1

You need the number of distinct users per day from pageViews over the last week. Which aggregation fits?

  1. Acount() by bin(timestamp, 1d)
  2. Bdcount(user_Id) by bin(timestamp, 1d)
  3. Ccountif(user_Id != "") by bin(timestamp, 1d)
  4. Dmax(user_Id)
Show the answer and why

  • Acount() by bin(timestamp, 1d)

    Incorrect

    count() counts page views, not distinct users.

  • Bdcount(user_Id) by bin(timestamp, 1d)

    Correct

    dcount estimates the number of distinct values per group.

  • Ccountif(user_Id != "") by bin(timestamp, 1d)

    Incorrect

    countif counts matching rows, not distinct users.

  • Dmax(user_Id)

    Incorrect

    max returns one value, not a count.

dcount() estimates the number of distinct values in a group, such as unique users per day; count() counts rows and countif() counts rows that match a condition.

Microsoft documentation

Task 5.2Report a problem with this question

Practise domain 5 →Practise all domains →