AZ-900 Describe Azure management and governance Practice Question
Which Azure feature creates an audit trail showing who performed what actions on Azure resources and when?
⚠ Common exam trap
Test-takers frequently confuse Azure AD Sign-in logs (which track authentication) with the Activity Log (which tracks resource management actions), because both involve 'who' and 'when', but they serve entirely different scopes—one is identity-focused, the other is resource-focused.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Activity Log
The Azure Activity Log is a platform log in Azure that provides insight into subscription-level events, recording all control-plane operations (e.g., creating a VM, deleting a resource group) with details on who performed the action (via Azure AD principal), what the action was, and when it occurred. This makes it the correct feature for creating an audit trail of resource management actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Monitor Metrics
Why it's wrong here
Azure Monitor Metrics captures numeric performance and health data from Azure resources, such as CPU usage, memory consumption, and request latency. These metric values are collected automatically at regular intervals and are primarily used for real-time monitoring, alerting, and trend analysis. They do not record who performed a management operation or when a configuration change occurred, so they cannot provide the required audit trail.
- ✓
Azure Activity Log
Why this is correct
The Azure Activity Log is turned on automatically and records all subscription-level management events, including operations such as creating, modifying, or deleting resources. Each entry contains crucial audit details: the resource ID, the operation name, the event initiator, the timestamp, and the final status of the operation. This rich, queryable log is precisely what is needed to answer questions about 'who, what, when, and where' for management activities.
- ✗
Azure AD Sign-in logs
Why it's wrong here
Azure AD Sign-in logs track authentication events, capturing details such as the user who signed in, the application used, the IP address, and whether authentication succeeded or failed. They are focused on identity and access, not on backend resource management operations like creating a virtual machine or updating an Azure policy. Because the question concerns management activities rather than user logins, sign-in logs are the wrong source.
- ✗
Azure Network Watcher packet captures
Why it's wrong here
Network Watcher packet captures continuously collect live network traffic at a network interface, recording raw IP packets for diagnostics such as dropped packets, latency, or unusual traffic patterns. This data consists of binary network frames, not structured records of management operations performed by users. It does not include any information about who initiated a change or when a resource was altered, making it completely unsuitable for auditing control-plane activities.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.