AZ-900 Describe Azure management and governance Practice Question
A company's security team needs to audit all virtual machines (VMs) that have a public IP address directly attached, across more than 50 Azure subscriptions organized under several management groups. The team wants to run a single query to get a list of these VMs along with the subscription and resource group details. The solution must provide fast results without the need to write custom scripts or iterate through each subscription individually. Which Azure service should the team use?
⚠ Common exam trap
Candidates often confuse Azure Policy's compliance evaluation capabilities with the ability to perform ad-hoc, cross-subscription queries, not realizing that Policy is for rule enforcement and reporting on non-compliant resources, not for flexible, query-based resource discovery like Azure Resource Graph provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Resource Graph
Azure Resource Graph (ARG) is the correct choice because it provides a powerful, queryable interface (using Kusto Query Language, KQL) that can search across all Azure subscriptions, management groups, and resource groups in a single query. It can quickly return a list of VMs with public IPs attached, along with their subscription and resource group metadata, without requiring custom scripts or iterative loops. This directly meets the requirement for fast, cross-subscription auditing with minimal overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Resource Graph
Why this is correct
Azure Resource Graph is a query service that uses Kusto Query Language (KQL) to explore and discover Azure resources across subscriptions and management groups. It enables a security team to build a single cross-subscription query that returns VM inventory, metadata, and configuration details like public IP assignments or OS settings. This makes it purpose-built for the audit task described, as it federates resource metadata without requiring per-resource API calls or telemetry collection.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance service that enforces organizational rules by evaluating resources against policy definitions, such as requiring specific VM SKUs or tagging conventions. It can report compliance status and deny or remediate non-compliant resources, but it is not designed for ad-hoc querying of resource metadata across subscriptions. While Policy can audit whether VMs meet certain conditions, it does not provide the flexible, multi-property search capability that Azure Resource Graph offers for discovering all VMs.
When this WOULD be correct
An exam scenario where Azure Policy would be correct: 'A company needs to automatically identify and flag all VMs with a public IP address attached, and optionally enforce a policy to deny such configurations in the future.'
- ✗
Azure Monitor
Why it's wrong here
Azure Monitor collects and analyzes telemetry data (metrics, logs) from resources, but it is not optimized for querying resource metadata such as public IP assignments across many subscriptions. Resource Graph is the appropriate tool for inventory and discovery queries.
When this WOULD be correct
If the question asked for a solution to monitor performance metrics or collect logs from VMs across subscriptions and set up alerts based on conditions, Azure Monitor would be the correct answer.
- ✗
Azure Resource Manager
Why it's wrong here
Azure Resource Manager is the deployment and management service for Azure resources. It does not provide a built-in query engine for searching resources across multiple subscriptions efficiently; that is the purpose of Azure Resource Graph.
When this WOULD be correct
A company needs to deploy a standardized set of resources (e.g., VMs, storage accounts) across multiple subscriptions using Infrastructure as Code. Azure Resource Manager templates (ARM templates) would be the correct service to define and deploy the resources consistently.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Resource GraphCorrect answer▾
Why this is correct
Azure Resource Graph is a query service that uses Kusto Query Language (KQL) to explore and discover Azure resources across subscriptions and management groups. It enables a security team to build a single cross-subscription query that returns VM inventory, metadata, and configuration details like public IP assignments or OS settings. This makes it purpose-built for the audit task described, as it federates resource metadata without requiring per-resource API calls or telemetry collection.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce compliance rules and evaluate resource configurations, not to run ad-hoc queries across subscriptions for specific resource properties like public IP attachment.
★ When this WOULD be the correct answer
An exam scenario where Azure Policy would be correct: 'A company needs to automatically identify and flag all VMs with a public IP address attached, and optionally enforce a policy to deny such configurations in the future.'
Why candidates choose this
Candidates may confuse Azure Policy's compliance evaluation capabilities with the ability to query and list resources, or think that policy can be used to generate reports on resource configurations.
✗Azure MonitorWrong answer — click to see why▾
Why this is wrong here
Azure Monitor is designed for collecting and analyzing telemetry data (metrics, logs) from resources, not for querying resource configurations across subscriptions. It cannot directly list VMs with public IPs across multiple subscriptions in a single query.
★ When this WOULD be the correct answer
If the question asked for a solution to monitor performance metrics or collect logs from VMs across subscriptions and set up alerts based on conditions, Azure Monitor would be the correct answer.
Why candidates choose this
Candidates may confuse Azure Monitor's ability to collect data across resources with the need to query resource properties, or they may think 'audit' implies monitoring rather than inventory/configuration querying.
✗Azure Resource ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager (ARM) is the deployment and management service for Azure resources, not a query tool. It cannot run a single query across multiple subscriptions to list VMs with public IPs; that requires Azure Resource Graph's cross-subscription querying capability.
★ When this WOULD be the correct answer
A company needs to deploy a standardized set of resources (e.g., VMs, storage accounts) across multiple subscriptions using Infrastructure as Code. Azure Resource Manager templates (ARM templates) would be the correct service to define and deploy the resources consistently.
Why candidates choose this
Candidates may confuse Azure Resource Manager with Azure Resource Graph due to similar names, or think that ARM's management capabilities include querying resources across subscriptions.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.