Kusto Query Language (KQL) basics in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What is the output count of this KQL query?

Given the table Logs with 5 rows, what is the output count of this query?

Logs | where Level == 'Error' | count

Azure

Logs | where Level == 'Error' | count

A 0

B 3

C 5

D 1

💡 Hint

Count returns the number of rows after filtering.

The query filters rows where Level is 'Error'. If 3 rows match, count returns 3.

🧠 Conceptual

intermediate

Which operator filters rows in KQL?

You want to select only rows where the column Status equals 'Success'. Which operator do you use?

A where

B project

C summarize

D extend

💡 Hint

Filtering means choosing rows based on a condition.

The where operator filters rows by a condition.

❓ Configuration

advanced

What is the output of this KQL query with summarize?

Given the table Sales with columns Region and Amount, what does this query output?

Sales | summarize TotalAmount = sum(Amount) by Region

Azure

Sales | summarize TotalAmount = sum(Amount) by Region

A A single value with the sum of all Amounts

B A table with all rows and a new column TotalAmount with sum of all Amounts

C A table with each Region and the sum of Amount for that Region

D An error because summarize needs a where clause

💡 Hint

Summarize groups rows by the column after 'by'.

The query groups rows by Region and sums Amount per group.

❓ security

advanced

Which KQL query prevents exposing sensitive data by masking?

You want to show user data but mask the Email column except the domain part. Which query achieves this?

A Users | extend EmailMasked = substring(Email, 0, 3) | project EmailMasked

B Users | project Email = '***@domain.com'

C Users | where Email contains '@' | project Email

D Users | extend EmailMasked = strcat('***@', extract('@(.+)$', 1, Email)) | project-away Email

💡 Hint

Masking means hiding part of the data but keeping some visible.

Option D keeps the domain visible and masks the user part with ***.

❓ Architecture

expert

What is the effect of this KQL query on data ingestion time?

Given a large streaming table Events, what does this query do?

Events | where Timestamp > ago(1h) | summarize Count = count() by bin(Timestamp, 5m)

Azure

Events | where Timestamp > ago(1h) | summarize Count = count() by bin(Timestamp, 5m)

A Returns counts of events in 5-minute intervals for the last hour, efficient for recent data

B Returns counts for all data ignoring the time filter, causing slow queries

C Returns a single count of all events in the last hour without grouping

D Causes an error because bin cannot be used with Timestamp

💡 Hint

The ago(1h) filters recent data, bin groups time.

The query efficiently summarizes recent events in 5-minute buckets.