Microsoft Azure Administrator (legacy) — Question 48

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
You need to view the error events from a table named Event.
Which query should you run in Workspace1?

Answer options

• A. Get-Event Event | where {$_.EventType ""eq "error"}
• B. Get-Event Event | where {$_.EventType == "error"}
• C. search in (Event) * | where EventType ""eq "error"
• D. search in (Event) "error"
• E. select *from Event where EventType == "error"
• F. Event | where EventType is "error"

Correct answer: D

Explanation

The correct answer is D because it uses the appropriate search syntax in Azure Log Analytics to filter for error events in the Event table. The other options either use incorrect syntax or commands that are not valid in this context, such as 'Get-Event' or incorrect comparison operators.