SC-200 Certification Practice Question #158

Question

You have an Azure subscription that contains a Log Analytics workspace named Workspace1.

You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1.

You need to query Workspace1 to identify all the requests that failed due to insufficient authorization.

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The query body (`where ResponseStatusCode == 403 or ResponseStatusCode == __`) projects AppId, UserId, ServicePrincipalId, ResponseStatusCode, RequestUri and RequestMethod — exactly the schema of the MicrosoftGraphActivityLogs table, which is the only listed table that exposes a ResponseStatusCode column (AuditLogs and AzureActivity do not). MS Learn's "Access Microsoft Graph activity logs" page provides the canonical failed-authorization query that filters `ResponseStatusCode == 401 or ResponseStatusCode == 403` to find requests "failing due to authorization." Because 403 is already hard-coded in the visible query, the dropdown blank is 401 (Unauthorized). 402 is reserved/unused. The community's higher-quality, doc-backed comments (sapphire 9, f90c339 5, BtwIdonno 4) converge on MicrosoftGraphActivityLogs + 401; Mobollz's AzureActivity vote (8 👍) is discounted because that table cannot satisfy the query, so confidence is held at 86 rather than higher.

More SC-200 practice questions