AZ-900 Describe Azure management and governance Practice Question
An Azure administrator needs to review all changes made to Azure resources over the past 90 days, including who made each change and when. Which Azure service provides this information?
⚠ Common exam trap
A common mix-up: candidates confuse the Activity Log with Azure Monitor Metrics, thinking that metrics also track user actions, but metrics are purely performance counters and do not capture identity or operation details.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Activity Log
The Azure Activity Log is a platform log in Azure that provides insight into subscription-level events. It records all control-plane operations (e.g., creating, modifying, or deleting resources) and includes details such as who initiated the operation, what the operation was, and when it occurred. The log retains this data for 90 days by default, making it the correct service for reviewing changes over that period.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Monitor Metrics
Why it's wrong here
Azure Monitor Metrics is a telemetry service that collects numeric time-series data from resources, such as CPU utilization, memory usage, and disk I/O. It does not capture identity information about the user who performed an action, nor does it log the specific control-plane operation like a resource creation or deletion. While metrics can trigger alerts on performance degradation, they are not designed to serve as an audit trail of configuration changes for determining accountability.
- ✓
Azure Activity Log
Why this is correct
Azure Activity Log is a subscription-level platform log that records all control-plane operations performed on Azure resources. Each entry includes the principal (who initiated the action), the timestamp (when it occurred), the operation name (e.g., write, delete), and the resource affected, along with the request details and status. This makes it the authoritative source for answering questions about who made changes to a resource and when.
- ✗
Azure Resource Health
Why it's wrong here
Azure Resource Health provides information about the current and historical health of a resource, such as whether it is available or experiencing an outage, and includes details about service events or planned maintenance. It does not track user-initiated configuration changes or identity information about the person who modified a resource. Resource Health is concerned with operational uptime and platform issues, not with providing an audit log of administrative actions.
- ✗
Azure Policy compliance reports
Why it's wrong here
Azure Policy compliance reports evaluate whether resources are in alignment with defined policy rules, such as requiring specific tags or restricting allowed locations. These reports indicate a policy state (e.g., compliant or non-compliant) for a given resource at a point in time but do not log the history of who made changes or when those changes occurred. While policy compliance can reflect the outcome of changes, it is a governance checkpoint rather than a change-audit mechanism.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.