AZ-400 exam questions on monitoring go beyond checking whether a service is alive — they test whether you understand how to find out why it behaves a certain way. The exam focuses on observability design using three pillars: metrics, logs, and traces. This post walks through how Azure Monitor, Application Insights, and Log Analytics each play a distinct role, and how KQL, SLO, and DORA metrics complete the picture.
Monitoring vs. Observability
Imagine the monitor screen at a hospital emergency room. When a patient's blood pressure drifts outside the normal range, an alarm fires. That is monitoring. Now imagine the attending physician asking, "How did this patient get to this state?" Answering that question requires cross-referencing 72 hours of medication records and blood test trends. That is observability.
Software systems work the same way. Monitoring detects known failure modes. Observability lets you reason about unknown failures from the internal state of the system. The foundation is three types of signals.
: Numeric summaries over time — CPU usage, request counts, latency. Fast to query, great for current-state alerting. : Records of what happened at a specific moment. Unstructured but context-rich. : The journey of a single request through multiple services. Answers "why did this request take 3 seconds?"
In Azure, the platform that unifies all three signals is Azure Monitor.
!Monitoring versus observability
Azure Monitor Architecture
Think of the dashboard in a modern car. Speed, fuel level, and warning lights all appear in one place — the driver does not open a separate app for each component. Azure Monitor plays exactly that role for Azure resources.
Metrics and Logs
Azure Monitor Metrics stores time-series data for 93 days. Platform metrics such as VM CPU, Storage Account transactions, and App Service HTTP request counts are collected automatically. You can visualize them in Metrics Explorer or wire them as signal sources for Alert rules.
Azure Monitor Logs stores data in a Log Analytics workspace. Enabling Diagnostic Settings on Azure resources routes logs to the workspace, where KQL (Kusto Query Language) lets you analyze them freely.
KQL resembles SQL but uses a pipe structure that makes stepwise transformations easy to read. Azure Workbooks combines KQL queries, metric charts, and text on a single interactive page — useful for SLA reports and post-incident reviews shared across the team.
Application Insights — Distributed Tracing
Picture an airport baggage tracking system. Every bag gets a barcode at check-in, and every scan along the way is recorded. If a bag goes missing, you find the last checkpoint immediately. Application Insights distributed tracing works the same way for HTTP requests.
Dependency Maps and Live Metrics
In a microservices architecture, a single HTTP request might travel API Gateway → Order Service → Inventory Service → Database. Application Insights assigns the same to every hop, linking the entire journey into one trace. The Application Map shows this as a visual graph with failure rates and response times for each service-to-service call, making it easy to spot where latency originates.
Logging every request on a high-traffic service drives costs up fast. Adaptive Sampling throttles collection to roughly 5 operations per second by default. When you need real-time diagnosis right after an incident, Live Metrics Stream shows the current state with near-zero latency.
Even without manually configured alerts, Smart Detection learns a performance baseline and surfaces anomalies — response-time spikes, failure-rate jumps, dependency degradation — automatically. No threshold configuration required.
Alert Rules and Action Groups
Think of an automated fire-reporting system. The smoke detector fires a signal, the panel routes it to the fire station, and trucks roll — no human in the loop between detection and response. Azure Monitor Alert rules combined with Action Groups build exactly this structure.
An Alert rule has three parts. selects what to watch: Metrics values, Log Analytics query results, or Activity Log events. defines when to fire: threshold exceeded, query row count, or state change. defines what happens: email, SMS, Azure Function invocation, Logic App trigger, or ITSM integration.
Traffic is high during business hours and low overnight. Fixed thresholds produce false-positive alerts at night or miss real anomalies at peak. Dynamic Thresholds learns historical patterns and adjusts the normal range per time-of-day automatically, cutting alert fatigue without losing sensitivity.
SLO, SLI, Error Budget, and DORA Metrics
If a team declares "our service guarantees 99.9% availability," how do they verify that promise is kept? Just as a sales team tracks weekly revenue against a quarterly target, engineering teams need to quantify service reliability.
An SLI (Service Level Indicator) is the measurement — "percentage of successful responses in the last 30 days." An SLO (Service Level Objective) is the target: "99.9% or above." You calculate SLIs directly in Log Analytics with KQL. An SLO of 99.9% permits roughly 43 minutes of downtime per month — that allowance is the Error Budget. When the budget is consumed, SRE practice calls for pausing new feature releases and focusing on reliability until the budget recovers.
DORA (DevOps Research and Assessment) metrics measure the health of the delivery process. Teams connect Log Analytics with Azure DevOps pipeline data to track four indicators: Deployment Frequency, Lead Time for Changes, Change Failure Rate, and MTTR (Mean Time to Restore).
Exam Key Takeaways
AZ-400 monitoring questions focus on which tool solves which problem.
"Trace a request across multiple services" -- Application Insights distributed tracing + Application Map "Store and visualize platform metric time-series" -- Azure Monitor Metrics + Metrics Explorer "Query logs to find error patterns" -- Log Analytics + KQL "Detect anomalies without setting thresholds" -- Application Insights Smart Detection "Invoke an Azure Function when an alert fires" -- Action Groups (Azure Function target) "Account for day/night traffic differences in alerts" -- Dynamic Thresholds "Calculate SLI and track Error Budget" -- Log Analytics KQL queries "DORA metric for recovery time" -- MTTR (Azure DevOps + Log Analytics integration) "Visualize latency between dependent services" -- Application Insights Application Map "Shareable interactive monitoring reports for the team" -- Azure Monitor Workbooks
Azure Monitor = hub for all platform metrics and logs, Application Insights = distributed tracing and Smart Detection, Log Analytics + KQL = query engine that ties all data together.