AZ-900 Describe Azure management and governance Practice Question
A cloud operations team manages Azure resources across several resource groups. Leadership wants to know which user made a specific configuration change to a virtual network three weeks ago so they can determine whether the change was authorized. The team needs to find this information using a built-in Azure capability without deploying additional monitoring agents. What should they use?
⚠ Common exam trap
The trap here is assuming that Azure Monitor metrics or Advisor maintain an audit trail of administrative actions, when only the Activity log records who performed control-plane changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Activity log
The Azure Activity log captures control-plane operations at the subscription level, including the identity of the caller, the operation performed, the target resource, and the timestamp. A virtual network configuration change is exactly this kind of administrative action, so the log can answer who changed it and when. It is available by default without installing agents, which matches the stated constraint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Service Health
Why it's wrong here
Azure Service Health reports on outages, planned maintenance, health advisories, and security advisories affecting the Azure platform and the services you use. It communicates platform-side events, not customer-initiated configuration changes. It cannot reveal which user modified a virtual network or when that modification happened, so it does not address the investigation the team needs to perform.
- ✗
Azure Monitor metrics
Why it's wrong here
Azure Monitor metrics store numeric time-series data such as CPU percentage, available memory, and network throughput. They are designed for performance analysis and alerting, not for capturing control-plane operations or the identity of the person who changed a resource. Since the team needs the actor and time of a virtual network configuration change, metrics contain no such audit records and cannot answer the question.
- ✗
Azure Advisor
Why it's wrong here
Azure Advisor evaluates deployed resources and produces personalized recommendations in categories such as cost, reliability, security, operational excellence, and performance. It does not record who performed a configuration change or when. Because the scenario requires historical audit data about a specific modify operation on a virtual network, Advisor cannot supply the identity or timestamp, so it does not satisfy the requirement.
- ✓
Azure Activity log
Why this is correct
The Azure Activity log records subscription-level control-plane events, including who performed create, update, and delete operations on resources, along with the timestamp and status. A virtual network configuration change is a control-plane operation, so the log preserves the caller identity and the time it occurred. It is built in and needs no agents, directly meeting the requirement to identify the user behind the change.
Go deeper
Related to this question
Learn chapter
Azure Cloud Shell
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 983 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.