AI-200 practice: Write KQL queries to analyze logs and metrics

Question 1

You need to visualize how the count of exceptions, grouped by exception type, has changed over the last 24 hours in 1-hour buckets, using the exceptions table in Application Insights/Log Analytics.

Which KQL query structure achieves this?

Accepted Answer

exceptions | where timestamp > ago(24h) | summarize count() by type, bin(timestamp, 1h) | render timechart

Answer

exceptions | where timestamp > ago(24h) | summarize dcount(operation_Id) by cloud_RoleName, bin(timestamp, 1h) | render barchart

Answer

exceptions | where timestamp > ago(24h) | summarize avg(itemCount) by bin(timestamp, 1d) | render piechart

Answer

exceptions | where timestamp > ago(24h) | top 50 by timestamp desc | project type, outerMessage | render table

Question 2

Customers report slow responses from an AI service composed of an AKS-hosted API, an Azure Function, and Cosmos DB. You need to determine which specific hop in the chain contributes the most latency, and whether the slowdown correlates with a specific dependency (e.g., Cosmos DB throttling) rather than application code.

What is the most effective combination of tools/approach?

Accepted Answer

Use Application Map and end-to-end transactions to find the slow hop, then KQL-join dependency telemetry with Cosmos DB logs for HTTP 429 throttling correlation

Answer

Review only AKS pod CPU and memory metrics in Container Insights, assuming multi-hop latency is almost always caused by node resource exhaustion

Answer

Restart the AKS Deployment, the Function app, and the Cosmos DB account in sequence to see whether the latency complaint disappears after each restart

Answer

Collect customer-reported timestamps only and manually attribute each slow response to AKS, Functions, or Cosmos DB without distributed telemetry

Question 3

You are debugging an AKS application using Azure Monitor Container Insights and need to find all pods that were OOMKilled in the last 24 hours across the cluster.

Base query:
```kql
KubePodInventory
| where TimeGenerated > ago(24h)
```
Complete the query to filter for pods terminated due to out-of-memory conditions and show pod name, namespace, and last terminated time.

Accepted Answer

KubePodInventory | where TimeGenerated > ago(24h) | join kind=inner (KubeEvents | where TimeGenerated > ago(24h) | where Reason == "OOMKilling" or RawJsonDescription has "OOMKilled") on $left.PodUid == $right.ObjectUID | summarize LastTerminated = arg_max(TimeGenerated, *) by Name, Namespace | project Name, Namespace, LastTerminated

Answer

KubePodInventory | where TimeGenerated > ago(24h) | where ContainerStatus == "OOMKilled" | project Name, Namespace, TimeGenerated

Answer

ContainerInventory | where TimeGenerated > ago(24h) | where ContainerState == "OOMKilled" | project ContainerName, TimeGenerated

Answer

KubePodInventory | where TimeGenerated > ago(24h) | where PodStatus == "OOMKilled" | project Name, Namespace

Question 4

You write a KQL query against Application Insights to find, per API endpoint, the 95th-percentile response time over the last 24 hours, along with the count of requests, grouped into 1-hour buckets for a trend chart:
```kql
requests
| where timestamp > ago(24h)
| ???
```
Which completion correctly produces per-endpoint, per-hour p95 latency and request count?

Accepted Answer

| summarize p95 = percentile(duration, 95), count() by name, bin(timestamp, 1h)

Answer

| summarize p95 = avg(duration) * 0.95, count() by name, bin(timestamp, 1h)

Answer

| extend p95 = percentile(duration, 95) | summarize count() by name, bin(timestamp, 1h)

Answer

| summarize p95 = percentile(duration, 95), count() by name, timestamp

Question 5

You write a KQL query to find, for each cloud_RoleInstance, only the most recent exception event, using arg_max():
```kql
exceptions
| where timestamp > ago(7d)
| ???
```
Which completion correctly returns one row per cloud_RoleInstance representing its most recent exception, including all columns of that specific event?

Accepted Answer

| summarize arg_max(timestamp, *) by cloud_RoleInstance

Answer

| summarize max(timestamp) by cloud_RoleInstance

Answer

| top 1 by timestamp desc

Answer

| summarize arg_max(timestamp) by cloud_RoleInstance

Question 6

Which Azure CLI command retrieves logs for a specific Azure Function's recent executions, filtered to only error-level entries, via Log Analytics KQL?

Accepted Answer

az monitor log-analytics query --workspace <workspaceId> --analytics-query "FunctionAppLogs | where Level == 'Error' | take 50"

Answer

az functionapp log deployment show --name myFuncApp --resource-group myRG --slot production -o table

Answer

az webapp log download --name myFuncApp --resource-group myRG --log-file ./logs.zip --slot production

Answer

az monitor activity-log list --resource-group myRG --status Failed --offset 24h --max-events 50 -o table

Question 7

You need a KQL query in Log Analytics that finds all failed HTTP requests (5xx) to an App Service-hosted AI API in the last hour, sorted by most recent first. Which query is correct?

Accepted Answer

AppRequests | where TimeGenerated > ago(1h) and ResultCode startswith "5" | order by TimeGenerated desc

Answer

AppRequests | where TimeGenerated > ago(1h) and ResultCode == "200" | order by TimeGenerated asc

Answer

AppExceptions | where TimeGenerated > ago(1h) | summarize count() by bin(TimeGenerated, 1d)

Answer

AppRequests | where TimeGenerated > ago(1h) | take 10 | project TimeGenerated, ResultCode, Name

Question 8

Which KQL operator would you use to calculate the 95th percentile response time for AI API requests over the last 24 hours, grouped by operation name?

Accepted Answer

summarize percentile(duration, 95) by operation_Name

Answer

summarize avg(duration) by operation_Name only

Answer

project duration, operation_Name without summarize

Answer

where duration > 95 treating 95 as a hard threshold

Question 9

Which KQL command structure would you use to join telemetry from AppRequests with AppDependencies to see which downstream calls were made during slow requests?

Accepted Answer

AppRequests | where duration > 1000 | join kind=inner AppDependencies on operation_Id

Answer

AppRequests | union AppDependencies | project name, duration, operation_Id, timestamp

Answer

AppRequests | distinct operation_Id | project operation_Id without dependency rows

Answer

AppDependencies | summarize count() by type | order by count_ desc

Question 10

You are writing a KQL query to analyze the performance of an AI model's inference endpoint in Application Insights. You need to calculate the 95th percentile of the duration column grouped into 5-minute bins. Which KQL query is correct?

Accepted Answer

dependencies | summarize percentiles(duration, 95) by bin(timestamp, 5m)

Answer

dependencies | summarize percentile_95(duration) by bin(timestamp, 5m)

Answer

dependencies | summarize avg(duration), p95() by bin(timestamp, 5m)

Answer

dependencies | summarize percentiles(duration, 0.95) by bin(timestamp, 5m)

12 questions