When collecting Windows Event Logs using the Azure Monitor Agent (AMA) with a Data Collection Rule (DCR), filtering is done at the source using XPath queries. XPath is specifically designed for querying XML- based event log entries, including filtering by Event ID, Event Level, and Event Source.
According to Azure Monitor documentation, Windows Event Log data sources require XPath expressions, not SQL or KQL. KQL is used after ingestion for querying data in Log Analytics, while XPath determines which events are collected in the first place.
Since the requirement is to collect only system events with Event ID 1001, the correct query type for the DCR data source is XPath.
Final Answer: C. XPath

AKS clusters can scale in one of two ways: - The cluster autoscaler watches for pods that can't be scheduled on nodes because of resource constraints. The cluster then automatically increases the number of nodes. - The horizontal pod autoscaler uses the Metrics Server in a Kubernetes cluster to monitor the resource demand of pods. If an application needs more resources, the number of pods is automatically increased to meet the demand. Reference: https://docs.microsoft.com/en-us/azure/aks/cluster-autoscaler

https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts Session persistence: Client IP and protocol - Traffic from the same client IP and protocol is routed to the same backend instance Azure Load Balancer distributes incoming network traffic among healthy backend pool instances. By default, the load balancer uses a hash-based distribution algorithm based on parameters such as source IP, destination IP, and port. This means that different requests from the same client might be directed to different backend servers.
To ensure that a client is consistently served by the same backend VM (web server) for the duration of its session, Session Persistence (also known as client affinity) must be configured.
As per the Azure Load Balancer official documentation:
"Session persistence specifies how traffic from a client should be handled by the load balancer. When you set session persistence to Client IP or Client IP and Protocol, requests from the same client IP address (and optionally protocol) are directed to the same backend instance." In web server scenarios where session state is maintained in-memory (not in a distributed cache), enabling Client IP and Protocol ensures that users remain connected to the same backend node, preventing issues like session drops or inconsistent experience.
Other options do not meet the requirement:
Floating IP (direct server return): Used for SQL Always On or NVA scenarios, not session affinity.
Idle timeout: Defines TCP connection time-out, not persistence.
UDP protocol: Not relevant for HTTP-based traffic.
Hence, the correct and Microsoft-documented answer is Session persistence = Client IP and Protocol.

1. View template from deployment history
Go to the resource group for your new resource group. Notice that the portal shows the result of the last deployment. Select this link.

2. You see a history of deployments for the group. In your case, the portal probably lists only one deployment.
Select this deployment.

The portal displays a summary of the deployment. The summary includes the status of the deployment and its operations and the values that you provided for parameters. To see the template that you used for the deployment, select View template.

References: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export- template

Explanation: