Question 233 of 1,031

Describe Azure management and governance →mediumMultiple ChoiceObjective-mapped

Quick Answer

Azure Resource Graph is the correct choice because it enables running a single cross-subscription query across more than 50 Azure subscriptions using Kusto Query Language (KQL), allowing the security team to instantly retrieve all virtual machines with public IPs along with their subscription and resource group details without custom scripts or iterative loops. This service works by indexing Azure resources into a normalized table that can be queried at the management group or tenant scope, making it ideal for fast, large-scale auditing scenarios. On the AZ-900 exam, this question tests your understanding of Azure Resource Graph’s role in governance and compliance at scale, often contrasting it with Azure Resource Manager (which operates per-subscription) or Azure Monitor (which focuses on metrics and logs). A common trap is confusing Azure Resource Graph with Azure Resource Manager—remember that Resource Graph is for *querying* resource metadata across boundaries, not for deploying or managing resources. Memory tip: think “Graph = cross-subscription search engine for resources.”

AZ-900 Describe Azure management and governance Practice Question

This AZ-900 practice question tests your understanding of describe azure management and governance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company's security team needs to audit all virtual machines (VMs) that have a public IP address directly attached, across more than 50 Azure subscriptions organized under several management groups. The team wants to run a single query to get a list of these VMs along with the subscription and resource group details. The solution must provide fast results without the need to write custom scripts or iterate through each subscription individually. Which Azure service should the team use?

Question 1mediummultiple choice

Full question →

A
Azure Resource Graph
Azure Resource Graph allows querying across all Azure subscriptions and management groups using a single query, making it the correct choice for this cross-subscription audit scenario.
B
Azure Policy
Why wrong: Azure Policy is used to enforce rules and effects on resources, not to query existing resource configurations across subscriptions. It can audit compliance but does not provide an ad-hoc query service like Resource Graph.
C
Azure Monitor
Why wrong: Azure Monitor collects and analyzes telemetry data (metrics, logs) from resources, but it is not optimized for querying resource metadata such as public IP assignments across many subscriptions. Resource Graph is the appropriate tool for inventory and discovery queries.
D
Azure Resource Manager
Why wrong: Azure Resource Manager is the deployment and management service for Azure resources. It does not provide a built-in query engine for searching resources across multiple subscriptions efficiently; that is the purpose of Azure Resource Graph.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Azure Resource Graph

Azure Resource Graph (ARG) is the correct choice because it provides a powerful, queryable interface (using Kusto Query Language, KQL) that can search across all Azure subscriptions, management groups, and resource groups in a single query. It can quickly return a list of VMs with public IPs attached, along with their subscription and resource group metadata, without requiring custom scripts or iterative loops. This directly meets the requirement for fast, cross-subscription auditing with minimal overhead.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Azure Resource Graph
Why this is correct
Azure Resource Graph allows querying across all Azure subscriptions and management groups using a single query, making it the correct choice for this cross-subscription audit scenario.
Related concept
Read the scenario before looking for a memorised answer.
✗
Azure Policy
Why it's wrong here
Azure Policy is used to enforce rules and effects on resources, not to query existing resource configurations across subscriptions. It can audit compliance but does not provide an ad-hoc query service like Resource Graph.
✗
Azure Monitor
Why it's wrong here
Azure Monitor collects and analyzes telemetry data (metrics, logs) from resources, but it is not optimized for querying resource metadata such as public IP assignments across many subscriptions. Resource Graph is the appropriate tool for inventory and discovery queries.
✗
Azure Resource Manager
Why it's wrong here
Azure Resource Manager is the deployment and management service for Azure resources. It does not provide a built-in query engine for searching resources across multiple subscriptions efficiently; that is the purpose of Azure Resource Graph.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse Azure Policy's compliance evaluation capabilities with the ability to perform ad-hoc, cross-subscription queries, not realizing that Policy is for rule enforcement and reporting on non-compliant resources, not for flexible, query-based resource discovery like Azure Resource Graph provides.

Detailed technical explanation

How to think about this question

Under the hood, Azure Resource Graph uses a distributed query engine that indexes resource properties (including network interfaces and public IP associations) across all subscriptions in a tenant, allowing KQL queries like `where type =~ 'microsoft.compute/virtualmachines' and properties.networkProfile.networkInterfaces[0].properties.ipConfigurations[0].properties.publicIPAddress != ''` to return results in seconds. A subtle behavior is that ARG queries are eventually consistent (typically within 5 minutes of a resource change), so for real-time auditing of recently modified VMs, a direct API call might be more accurate, but for most audit scenarios this delay is acceptable. In a real-world scenario, a security team could use ARG to generate a daily report of all VMs with public IPs, then feed that into a ticketing system for remediation, all without writing PowerShell loops.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related AZ-900 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Describe cloud concepts practice questions

Practise AZ-900 questions linked to Describe cloud concepts.

Describe Azure architecture and services practice questions

Practise AZ-900 questions linked to Describe Azure architecture and services.

Describe Azure management and governance practice questions

Practise AZ-900 questions linked to Describe Azure management and governance.

AZ-900 Azure services practice questions

Practise AZ-900 questions linked to AZ-900 Azure services.

AZ-900 pricing and support practice questions

Practise AZ-900 questions linked to AZ-900 pricing and support.

AZ-900 security and compliance practice questions

Practise AZ-900 questions linked to AZ-900 security and compliance.

AZ-900 governance practice questions

Practise AZ-900 questions linked to AZ-900 governance.

Practice this exam

Start a free AZ-900 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

AZ-900 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this AZ-900 question test?

Describe Azure management and governance — This question tests Describe Azure management and governance — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Azure Resource Graph — Azure Resource Graph (ARG) is the correct choice because it provides a powerful, queryable interface (using Kusto Query Language, KQL) that can search across all Azure subscriptions, management groups, and resource groups in a single query. It can quickly return a list of VMs with public IPs attached, along with their subscription and resource group metadata, without requiring custom scripts or iterative loops. This directly meets the requirement for fast, cross-subscription auditing with minimal overhead.

What should I do if I get this AZ-900 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.