Exam AZ-104 topic 6 question 55 discussion

Microsoft: We will find that 1 sentence in our entire Doc which mentioned a language which wasn't mentioned in any our courses and we'll 100% ask everybody about it, because...of reasons..

The correct answer is B. Whilst you can use KQL to filter for events with ID 101, this implies that the Data Collection Rule ingests all events into the Log Analytics Workspace, thus driving up costs. This question specifically asks for the data source configuration as part of creating Rule1. If you are only interested in Event ID 1001 you should filter it from the start, when configuring the Data Collection Rule. To do that, you must use an XPath query. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal#filter-events-using-xpath-queries

XPath: Used for querying Windows event logs. KQL: Used for querying data in Azure Data Explorer and Log Analytics workspaces. Therefore, XPath is the correct choice for your data collection rule (DCR) to collect specific system events from Windows event logs.

B is correct XPath is the query language used to filter and collect specific events from Windows Event Logs, which are stored in an XML format. Since you only need to collect system events with an ID of 1001 from the Windows System event logs, you will use an XPath query to specify this condition. Example of an XPath query to collect events with ID 1001: <QueryList> <Query Id="0" Path="System"> <Select Path="System">*[System[(EventID=1001)]]</Select> </Query> </QueryList>

KQL is been used to query for the event id.

How does this help me to become Azure Architect?

B is correct. Note - SQL is used for querying relational databases and is not applicable for querying Windows Event Logs.

C is correct

To consume events, you can consume all events or you can specify an XPath expression that identifies the events that you want to consume. https://learn.microsoft.com/en-us/windows/win32/wes/consuming-events

XPath is a query language used to select nodes from an XML document. The Azure Monitor Agent uses XPath queries to filter events from Windows System event logs. To collect only system events that have an ID of 1001, you would use the following XPath query: //*[System/@EventID=1001] This query will select all nodes in the XML document where the System element has an EventID attribute equal to 1001. SQL and KQL are not supported for filtering events from Windows System event logs.

KQL is the correct

To collect specific events from Windows System event logs, such as those with an Event ID of 1001, you should use an XPath query. XPath is a query language that can be used to filter XML data, which is the format used by Windows Event Logs. In Azure Monitor, when configuring data collection rules for collecting Windows event log data, XPath queries are used to specify the criteria for the events you want to collect. So, the correct answer is: B. XPath

B..Correct https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal

KQL: For the log query, you'll need to use a custom Kusto Query Language (KQL) query. In this case, you want to collect System events with an ID of 1001.

To specify more filters, use custom configuration and specify an XPath that filters out the events you don't need. XPath entries are written in the form LogName!XPathQuery. For example, you might want to return only events from the Application event log with an event ID of 1035. The XPathQuery for these events would be *[System[EventID=1035]]. Because you want to retrieve the events from the Application event log, the XPath is Application!*[System[EventID=1035]] https://learn.microsoft.com/th-th/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal#filter-events-using-xpath-queries

Custom data source in Azure Portal says: "Use XPath queries to filter event logs and limit data collection"

When you are at 'Add data source' during DCR creation, under Custom, you are faced with: "Use XPath queries to filter event logs and limit data collection."