AZ-900 Practice Question 78: Log Analytics Workspace KQL
Microsoft Azure Fundamentals (AZ-900) · Test 8 · question 8 of 10
An administrator turns on Azure Monitor for a subscription and needs to know two things: where the collected log data actually lands, and what she uses to query it for a custom report. Which pair is correct?
Show answer and explanation
Answer:
A Log Analytics workspace is a data store into which you collect log data from Azure and non-Azure resources, and Azure Monitor Logs is built on Azure Data Explorer, so that data is queried with Kusto Query Language (KQL), the same language used across the Log Analytics experience in the Azure portal, log search alert rules, and workbooks.
Option A, Cost Management, tracks and reports on spending; it neither stores telemetry logs nor uses SQL as a query surface. Option B, a blob container, is a raw file store, and AzCopy is a data-movement tool, not a query language, nothing about this pairing lets you run an analytic query over structured log records. Option C, Purview, is Microsoft's data governance and cataloging service; it doesn't store Azure Monitor's telemetry, and regular expressions aren't how Log Analytics data is queried.
Reference: Log Analytics workspace overview