AZ-900 Describe Azure management and governance Practice Question
A company needs to find all virtual machines that have the tag 'Environment:Production' and were created more than 6 months ago. They want to run a complex query across all subscriptions in their tenant. Which Azure tool should they use?
⚠ Common exam trap
Test-takers frequently confuse Azure Resource Graph with Azure CLI or PowerShell because all three can query resources, but only Resource Graph is purpose-built for complex, cross-subscription queries using KQL, while the others are imperative tools that require manual iteration and lack native query optimization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Resource Graph
Azure Resource Graph is the correct tool because it is designed to efficiently query across multiple subscriptions, resource groups, and resource types using the Kusto Query Language (KQL). It can filter virtual machines by the tag 'Environment:Production' and compare the 'createdTime' property to a date six months ago, all in a single, complex query that spans the entire tenant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Resource Graph
Why this is correct
Azure Resource Graph is the correct choice because it is a native Azure service that uses Kusto Query Language (KQL) to query resource metadata—including tags, SKUs, and creation timestamps—across all subscriptions in a tenant without needing to iterate per subscription. Its 'where' clauses allow exact filtering for the presence of an 'environment' tag, and it returns results quickly even at scale. Unlike PowerShell or CLI, it is purpose-built for cross-subscription, tenant-wide resource discovery and also integrates with Azure Policy and change tracking.
- ✗
Azure CLI
Why it's wrong here
Azure CLI is unsuitable for this scenario because it operates primarily within a single subscription context and lacks a native mechanism for executing complex, tenant-wide queries across *all* subscriptions simultaneously. While powerful for scripting and automating resource management, it would require extensive custom scripting to iterate through each subscription to gather the necessary data. Azure CLI is ideal for managing individual resources, configuring services, or performing targeted queries within a specific subscription, making it a strong choice for single-subscription automation tasks.
When this WOULD be correct
A question asks: 'An administrator needs to quickly delete all virtual machines with a specific tag from a single subscription using a script. Which tool should they use?' In that case, Azure CLI with a one-liner like `az vm delete` combined with `--query` would be efficient.
- ✗
Azure PowerShell
Why it's wrong here
Azure PowerShell (using the Az module) is not the best fit because cmdlets like Get-AzVM require you to set a specific subscription context (Get-AzSubscription, Set-AzContext) and then enumerate resources one subscription at a time. While you can write a loop to combine results, there is no native query engine for filtering on tags like 'environment' across the entire tenant, and the process becomes slow and unwieldy for large environments. Resource Graph provides a single query that automatically spans subscriptions, making it far more efficient for this kind of metadata discovery.
When this WOULD be correct
A company needs to automate the deletion of all virtual machines with tag 'Environment:Production' older than 6 months across multiple subscriptions. They want to write a script that iterates through subscriptions, filters VMs, and deletes them. Azure PowerShell would be correct because it can combine resource retrieval with deletion actions in a single script.
- ✗
Azure Cost Management
Why it's wrong here
Azure Cost Management is incorrect because it ingests cost and usage data from Azure billing, not live resource metadata such as the existence of a tag or the resource creation date. Although cost reports can include tags as part of cost allocation, they cannot be used to programmatically search for every virtual machine that has an 'environment' tag. Cost Management's primary purpose is monitoring spend, setting budgets, and analyzing cost trends; it is not a resource query or inventory tool.
When this WOULD be correct
A question asking for a tool to analyze historical cost trends, set budgets, or generate cost reports for resources across subscriptions would make Azure Cost Management the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Resource GraphCorrect answer▾
Why this is correct
Azure Resource Graph is the correct choice because it is a native Azure service that uses Kusto Query Language (KQL) to query resource metadata—including tags, SKUs, and creation timestamps—across all subscriptions in a tenant without needing to iterate per subscription. Its 'where' clauses allow exact filtering for the presence of an 'environment' tag, and it returns results quickly even at scale. Unlike PowerShell or CLI, it is purpose-built for cross-subscription, tenant-wide resource discovery and also integrates with Azure Policy and change tracking.
✗Azure CLIWrong answer — click to see why▾
Why this is wrong here
Azure CLI is a command-line tool for managing Azure resources, but it cannot run complex queries across multiple subscriptions in a single command. It requires scripting and manual iteration, unlike Azure Resource Graph which supports cross-subscription queries with KQL.
★ When this WOULD be the correct answer
A question asks: 'An administrator needs to quickly delete all virtual machines with a specific tag from a single subscription using a script. Which tool should they use?' In that case, Azure CLI with a one-liner like `az vm delete` combined with `--query` would be efficient.
Why candidates choose this
Candidates may think Azure CLI can query resources across subscriptions using `az resource list` with filters, but they overlook that it lacks native cross-subscription query capabilities and is less efficient for complex, multi-subscription queries compared to Azure Resource Graph.
✗Azure PowerShellWrong answer — click to see why▾
Why this is wrong here
Azure PowerShell is a scripting tool for managing Azure resources individually or in bulk, but it cannot run a complex query across all subscriptions in a tenant efficiently. The question requires a query service designed for multi-subscription resource exploration, which is Azure Resource Graph.
★ When this WOULD be the correct answer
A company needs to automate the deletion of all virtual machines with tag 'Environment:Production' older than 6 months across multiple subscriptions. They want to write a script that iterates through subscriptions, filters VMs, and deletes them. Azure PowerShell would be correct because it can combine resource retrieval with deletion actions in a single script.
Why candidates choose this
Candidates may think Azure PowerShell can handle any Azure management task, including complex queries, because it is a powerful scripting tool. They overlook that Azure Resource Graph is specifically optimized for cross-subscription queries with advanced filtering.
✗Azure Cost ManagementWrong answer — click to see why▾
Why this is wrong here
Azure Cost Management focuses on cost analysis and budgeting, not on querying resource metadata like tags and creation dates across subscriptions. It cannot run complex queries to find VMs based on tag and age.
★ When this WOULD be the correct answer
A question asking for a tool to analyze historical cost trends, set budgets, or generate cost reports for resources across subscriptions would make Azure Cost Management the correct answer.
Why candidates choose this
Candidates may think Cost Management can track resource metadata because it deals with resource usage, but it lacks the querying capabilities for non-cost attributes like tags and creation dates.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Query
A query is a request for information from a database, asking a specific question to retrieve, update, or manipulate data.
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.