This post is a part of the DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric Exam Prep Hub.
This topic falls under these sections:
Ingest and transform data (30–35%)
   --> Ingest and transform streaming data
      --> Create windowing functions

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Overview

Windowing functions are a fundamental concept in stream processing and real-time analytics. In Microsoft Fabric, windowing functions enable you to group continuous streams of events into logical segments called windows, allowing aggregations and calculations to be performed on streaming data as it arrives. Windowing is heavily used in Eventstreams, Real-Time Intelligence, KQL queries, and stream processing scenarios. (Reitse’s blog)

Unlike batch processing, where all data is available before processing begins, streaming systems deal with potentially infinite streams of incoming events. Windowing functions provide a mechanism to divide this endless stream into manageable chunks for analysis. (MindMesh Academy)

For the DP-700 exam, you should understand:

• Why windowing functions are required
• The different window types
• When each window type should be used
• How windowing applies in Eventstreams and KQL
• The differences between tumbling, hopping, sliding, session, and snapshot windows
• Common real-world scenarios

Why Windowing Functions Are Needed

Imagine a sensor generating thousands of temperature readings every second.

Without windows:

• Data arrives continuously.
• Aggregations never complete.
• Calculating averages, counts, or sums becomes difficult.

Windowing functions solve this problem by grouping events into defined time intervals where calculations can be performed. (MindMesh Academy)

Examples include:

• Count website visits every 5 minutes
• Calculate average temperature every minute
• Measure sales totals every hour
• Detect unusual activity within a rolling 10-minute period
• Analyze user sessions based on inactivity

Windowing in Microsoft Fabric

Windowing is primarily encountered in:

• Eventstreams
• Real-Time Intelligence
• Eventhouse queries
• KQL transformations
• Streaming analytics solutions

Fabric supports several window types, each designed for different business requirements. (Reitse’s blog)

Tumbling Windows

Definition

A tumbling window divides a stream into fixed, non-overlapping time intervals. Each event belongs to exactly one window. (MindMesh Academy)

Example

Five-minute windows:

Events are assigned to one and only one window.

Characteristics

• Fixed size
• No overlap
• Continuous
• Predictable results

Use Cases

Website Traffic

Count visitors every five minutes.

Sensor Monitoring

Calculate average temperature every minute.

Sales Reporting

Generate hourly revenue summaries.

Exam Tip

If a question mentions:

• Fixed intervals
• Non-overlapping periods
• Each event belongs to one window

The answer is almost always Tumbling Window.

Hopping Windows

Definition

A hopping window uses fixed-length windows that overlap. New windows start at specified intervals called the hop size. (Reitse’s blog)

Example

Window Size = 10 minutes

Hop Interval = 5 minutes

Windows:

An event may appear in multiple windows.

Characteristics

• Fixed size
• Overlapping
• Events can belong to multiple windows

Use Cases

Rolling Analytics

Monitor sales over the previous 10 minutes every 5 minutes.

Performance Monitoring

Analyze server utilization trends.

Operational Dashboards

Create smoother trend analysis.

Exam Tip

If a question describes:

• Overlapping windows
• Fixed intervals
• Repeated calculations over rolling periods

Choose Hopping Window.

Sliding Windows

Definition

Sliding windows continuously evaluate data over a moving time range. Unlike tumbling windows, calculations are updated whenever new events arrive. (Reitse’s blog)

Example

Monitor failed logins within the previous 10 minutes.

As each new event arrives:

• Old events leave the window
• New events enter the window
• Results update continuously

Characteristics

• Continuous evaluation
• Overlapping by nature
• Event-driven processing

Use Cases

Fraud Detection

Detect suspicious transaction patterns.

Security Monitoring

Identify repeated failed logins.

IoT Alerts

Trigger warnings when sensor thresholds are exceeded.

Exam Tip

If the question mentions:

• Real-time rolling calculations
• Continuous updates
• Last X minutes of activity

The correct answer is usually Sliding Window.

Session Windows

Definition

A session window groups events based on periods of activity separated by inactivity gaps. (Reitse’s blog)

Instead of fixed times, session windows are defined by user behavior.

Example

User activity:

If timeout = 10 minutes:

Session 1:

• 10:00
• 10:03
• 10:05

Session 2:

• 10:25

The 20-minute gap creates a new session.

Characteristics

• Activity-based
• Dynamic duration
• Defined by inactivity timeout

Use Cases

Website User Sessions

Track user visits.

Application Usage

Measure active engagement periods.

Customer Behavior Analytics

Group interactions into sessions.

Exam Tip

Look for keywords:

• User sessions
• Inactivity timeout
• Activity periods

These indicate Session Window.

Snapshot Windows

Definition

A snapshot window captures data at a specific point in time rather than over a duration. (TechTacoFriday)

Think of it as taking a picture of the stream at a particular instant.

Use Cases

Point-in-Time Metrics

Current active users.

Device Status Monitoring

Current state of equipment.

Operational Dashboards

Real-time snapshots of system health.

Comparing Window Types

Windowing in Eventstreams

In Microsoft Fabric Eventstreams, windowing is commonly implemented using the Group By transformation. After selecting a window type, you can apply aggregations such as:

• Count
• Sum
• Average
• Minimum
• Maximum

These aggregations help convert raw event streams into meaningful business metrics. (Reitse’s blog)

Windowing in KQL

KQL supports time-based aggregations using functions such as:

SalesEvents
| summarize TotalSales=sum(Amount)
    by bin(Timestamp, 5m)

The bin() function creates fixed time buckets similar to tumbling windows. (A Guide to Cloud & AI)

Common KQL windowing scenarios include:

• Time-series analytics
• Streaming dashboards
• Real-time monitoring
• Trend analysis

Windowing and Streaming Analytics

Windowing is critical because streaming data never stops arriving.

Without windows:

• Aggregations would never complete.
• Metrics could not be calculated efficiently.
• Real-time dashboards would be difficult to build.

Windows provide structure and enable:

• Aggregation
• Alerting
• Trend detection
• Session analysis
• Operational monitoring

DP-700 Exam Tips

Know the Window Types

Microsoft frequently tests differences between:

• Tumbling
• Hopping
• Sliding
• Session

Remember Tumbling

If:

• Windows are fixed
• Windows do not overlap
• Events belong to exactly one window

Choose Tumbling.

Remember Session

If:

• User behavior is involved
• There is an inactivity timeout
• Windows vary in length

Choose Session.

Remember Hopping

If:

• Windows overlap
• Windows have fixed sizes
• Events can appear multiple times

Choose Hopping.

Remember Sliding

If:

• Continuous recalculation occurs
• Rolling analysis is needed
• Alerts depend on recent activity

Choose Sliding.

Practice Exam Questions

Question 1

A streaming solution must calculate the average temperature every minute. Each reading should belong to exactly one aggregation period.

What should you use?

A. Sliding window

B. Session window

C. Tumbling window

D. Hopping window

Answer: C

Explanation: Tumbling windows use fixed, non-overlapping intervals and each event belongs to only one window. (Scribd)

Question 2

You need to analyze sales from the previous 10 minutes every 5 minutes.

Which window type should you use?

A. Hopping window

B. Session window

C. Snapshot window

D. Tumbling window

Answer: A

Explanation: Hopping windows overlap and allow repeated analysis over rolling periods.

Question 3

A website analytics solution must group user activity until no activity occurs for 15 minutes.

Which window type is most appropriate?

A. Tumbling window

B. Snapshot window

C. Sliding window

D. Session window

Answer: D

Explanation: Session windows are based on inactivity periods and user behavior.

Question 4

You need a fraud detection solution that continuously evaluates transactions from the last five minutes whenever a new transaction arrives.

Which window type should be used?

A. Snapshot window

B. Session window

C. Tumbling window

D. Sliding window

Answer: D

Explanation: Sliding windows continuously recalculate results as new events arrive.

Question 5

Which window type allows an event to appear in multiple windows?

A. Tumbling window

B. Snapshot window

C. Hopping window

D. Session window

Answer: C

Explanation: Hopping windows overlap, allowing events to participate in multiple aggregations.

Question 6

What is the primary purpose of windowing functions in streaming systems?

A. Encrypt streaming data

B. Divide continuous streams into manageable groups for processing

C. Compress incoming events

D. Eliminate duplicate records

Answer: B

Explanation: Windowing organizes continuous streams into finite chunks that can be aggregated and analyzed. (MindMesh Academy)

Question 7

Which window type is most suitable for calculating hourly sales totals where no overlap is desired?

A. Sliding window

B. Hopping window

C. Session window

D. Tumbling window

Answer: D

Explanation: Tumbling windows create fixed, non-overlapping intervals.

Question 8

A streaming query groups events whenever there is activity and closes the group after ten minutes of inactivity.

What is being used?

A. Snapshot window

B. Hopping window

C. Session window

D. Tumbling window

Answer: C

Explanation: Session windows are based on inactivity timeouts.

Question 9

Which statement accurately describes a sliding window?

A. Events belong to only one interval

B. Results are calculated only after the window closes

C. Windows are based on inactivity gaps

D. Results are continuously updated as events arrive

Answer: D

Explanation: Sliding windows continuously recalculate as new events enter and old events leave the window.

Question 10

In Microsoft Fabric Eventstreams, windowing is commonly configured through which transformation?

A. Group By

B. Expand

C. Join

D. Union

Answer: A

Explanation: Eventstreams typically implement windowing through the Group By transformation, where window type and aggregations are defined. (Reitse’s blog)

Go to the DP-700 Exam Prep Hub main page.