PL-900 Practice Exam 60 — 20 Questions

Question 1

Your organization has a Power Apps portal that allows external users to submit support tickets. You need to ensure that only authenticated external users from specific domains can access the portal. What should you configure?

Accepted Answer

Configure the portal to use Microsoft Entra ID authentication and set up domain restrictions.. Option D is correct because Power Apps portals can be configured to use Microsoft Entra ID (formerly Azure AD) as the identity provider, and within the portal settings you can restrict sign-in to users from specific domains. This ensures that only authenticated external users whose email domain matches the allowed list can access the portal, meeting the requirement without relying on IP filtering or obscurity.

Answer

Create a data loss prevention (DLP) policy that blocks external users.

Answer

Restrict access to the portal by IP address using a web application firewall.

Answer

Share the portal URL only with users from the allowed domains.

Question 2

Refer to the exhibit. You run the Azure CLI command to create a DLP policy. The command fails with an error that the resource type is invalid. What is the most likely cause?

Accepted Answer

The resource type should be 'Microsoft.PowerPlatform/dlpPolicies'.. The Azure CLI command for creating a DLP policy in Power Platform requires the correct resource type identifier. The error 'resource type is invalid' indicates that the resource type specified in the command does not match the expected Azure Resource Manager (ARM) resource type. The correct resource type for Power Platform DLP policies is 'Microsoft.PowerPlatform/dlpPolicies', not a generic or incorrect type like 'Microsoft.PowerPlatform/dlpPolicies' (note the exact casing and spelling). Option C correctly identifies this as the most likely cause.

Answer

The --location parameter should be 'global' instead of 'eastus'.

Answer

The --name parameter is missing the policy prefix.

Answer

The --properties parameter should reference a URL instead of a file.

Question 3

An administrator needs to prevent users from creating Power Apps outside of the approved environment (Production). The company has a Development and a Production environment. Users should only be able to create apps in Development. Which configuration should the administrator use?

Accepted Answer

Assign the Environment Maker role to users only in the Development environment. The Environment Maker role grants permission to create apps within a specific environment. By assigning this role only to the Development environment, users can create apps there but are blocked from creating them in Production, where they lack the role. This directly enforces the requirement without affecting other permissions.

Answer

Assign the Environment Maker role to users in both environments

Answer

Create a DLP policy that blocks app creation in Production

Answer

Remove the Environment Maker role from all users in all environments

Question 4

A Power Platform administrator notices that a production environment has exceeded its storage quota. The administrator needs to free up storage without impacting active solutions. Which action should the administrator take first?

Accepted Answer

Analyze storage by entity and delete unused custom tables. Option A is correct because analyzing storage by entity allows the administrator to identify which custom tables consume the most space, and deleting unused custom tables directly frees up storage without affecting active solutions. This is the recommended first step in the Power Platform admin center, as it targets the root cause of storage overage while preserving production functionality.

Answer

Increase the storage quota

Answer

Remove the environment and create a new one

Answer

Delete all audit logs older than 30 days

Question 5

The exhibit shows a JSON snippet from a Power Platform environment configuration. What can be inferred from this snippet?

Accepted Answer

The environment has blocked connectors for Twitter and Facebook. The JSON snippet includes a 'blockedConnectors' array containing 'Twitter' and 'Facebook', which explicitly indicates that these connectors are prohibited in the environment. This is a tenant-level or environment-level policy setting used to restrict data movement to or from these services, directly supporting option A as correct.

Answer

The environment has used 1024 MB of storage

Answer

The environment is named 'Production'

Answer

The environment has a storage limit of 512 MB

Question 6

Refer to the exhibit. The environment 'Contoso Production' was created on January 15, 2023. You need to restore this environment to a state from January 20, 2023. What is the first step you must take?

Accepted Answer

Check if a backup from January 20, 2023, exists in the environment's backup list.. Option B is correct because the first step in restoring a Power Platform environment to a specific past date is to verify that a backup exists for that date. Microsoft Power Platform automatically creates daily backups for production environments, but you must check the backup list to confirm that a backup from January 20, 2023, is available before proceeding with the restore operation.

Answer

Enable point-in-time restore in the environment settings.

Answer

Convert the environment to a sandbox environment.

Answer

Copy the environment to a new environment using the date parameter.

Question 7

A company has a Power Platform environment that contains several unmanaged solutions. The administrator wants to promote a solution to production. Which action should the administrator take to ensure the solution can be deployed to other environments?

Accepted Answer

Export the solution as a managed solution. Exporting a solution as a managed solution is the correct action because managed solutions are designed for deployment to production and other non-development environments. They prevent direct customization of components, enforce solution layering, and allow for proper lifecycle management, including upgrades and patching. Unmanaged solutions, by contrast, are intended for development and cannot be reliably deployed to production without breaking the component ownership model.

Answer

Use the 'Backup' feature in the admin center

Answer

Apply a solution patch and export it

Answer

Clone the solution and export as unmanaged

Question 8

Refer to the exhibit. An administrator runs this PowerShell command against a Power Platform environment. What can the administrator conclude?

Accepted Answer

The environment is accessible only to members of the ContosoUsers security group. The PowerShell command `Get-AdminPowerAppEnvironment` returns the environment details, including the `SecurityGroupId` property. If this property is populated with a GUID, it indicates a security group is assigned to the environment, restricting access to its members. Since the exhibit shows a non-null `SecurityGroupId` for the ContosoUsers group, the environment is accessible only to members of that security group.

Answer

The environment creation failed

Answer

The environment has no security group assigned

Answer

The environment is a personal productivity environment

Question 9

A company has a Power Platform environment used for development. The development team needs to deploy a solution to a test environment. What is the recommended approach?

Accepted Answer

Export a managed solution from the development environment and import it into the test environment. Option D is correct because managed solutions are the recommended approach for deploying to non-development environments (e.g., test, UAT, production). A managed solution locks components to prevent direct editing in the target environment, supports lifecycle management (upgrades, patches, and removal), and ensures that only the intended customizations are deployed. Exporting an unmanaged solution (Option A) would leave components editable in the test environment, breaking the managed lifecycle pattern.

Answer

Export an unmanaged solution from the development environment and import it into the test environment

Answer

Manually recreate all components in the test environment

Answer

Copy the entire development environment to the test environment

Question 10

An organization wants to allow external partners to access specific Power Apps and data without granting them full access to the tenant. What should they configure?

Accepted Answer

Invite partners as guest users in Microsoft Entra ID and assign them appropriate security roles in the Power Platform environment.. Option C is correct because inviting external partners as guest users in Microsoft Entra ID (formerly Azure AD) and assigning them appropriate security roles in the Power Platform environment is the standard method for providing controlled, least-privilege access to specific Power Apps and their underlying data sources. This approach leverages Microsoft Entra B2B collaboration to create guest identities, which can then be granted access to specific environments and resources without giving them full tenant-level permissions.

Answer

Use Microsoft Intune to manage partner devices.

Answer

Create a data loss prevention (DLP) policy that allows external sharing.

Answer

Share the app URL with the partners and ask them to sign in with their own accounts.

Question 11

An organization uses Microsoft Power Platform and wants to enforce data loss prevention (DLP) policies across all environments. They need to block the use of a specific third-party connector in all environments. What should the administrator do?

Accepted Answer

Create a tenant-level DLP policy that blocks the connector. Option D is correct because DLP policies in Microsoft Power Platform can be configured at the tenant level to apply across all environments. By creating a tenant-level DLP policy and blocking the specific third-party connector, the administrator ensures consistent enforcement without needing to manage individual environment policies. This approach centralizes control and prevents the connector from being used in any environment.

Answer

Create a DLP policy for each environment and block the connector

Answer

Create a custom connector with the same name and block it

Answer

Remove the connector from the default solution

Question 12

An administrator reviews the JSON output from a Power Platform environment. What should the administrator be concerned about based on the data?

Accepted Answer

The API rate limit is approaching its maximum. Option C is correct because the JSON output shows the 'RateLimitRemaining' field approaching zero, indicating that the API rate limit is nearly exhausted. Power Platform enforces per-tenant and per-user API limits to ensure fair resource usage, and hitting the limit will throttle or block further API calls, disrupting integrations and automated workflows.

Answer

The Dataverse URL is incorrect

Answer

The admin email is not configured

Answer

The environment is out of storage

Question 13

Refer to the exhibit. A Power Platform administrator is reviewing a JSON export of an environment configuration. Which statement is true based on the exhibit?

Accepted Answer

Security groups are assigned to the environment. Option C is correct because the JSON export includes a 'securityGroups' property with an array of group IDs, indicating that one or more Microsoft Entra ID (formerly Azure AD) security groups are explicitly linked to the environment. This configuration restricts environment access to members of those security groups, which is a common practice for controlling access in production or shared environments.

Answer

The environment was created from a trial

Answer

The environment uses French language

Answer

The environment is a sandbox environment

Question 14

A company is deploying Power Virtual Agents (now Copilot Studio) chatbots across multiple departments. Each department needs its own environment to manage chatbots independently. However, the company wants to share a common set of entities and workflows across all environments. Which approach should the administrator take?

Accepted Answer

Create a separate environment per department and deploy managed solutions containing the common components. Option D is correct because managed solutions allow you to package common components (entities, workflows) and deploy them to multiple environments, ensuring consistency while maintaining departmental isolation. Each department gets its own environment for independent chatbot management, and the shared components are installed via managed solutions that cannot be modified, preserving the common baseline.

Answer

Create a single environment for all departments and use security roles to isolate chatbots

Answer

Use Power Apps component library to share components across environments

Answer

Create a shared environment for common components and link each department environment to it

Question 15

Which TWO actions can a Power Platform administrator perform in the Power Platform admin center?

Accepted Answer

Create and delete environments. Option C is correct because the Power Platform admin center provides administrators with the ability to create and delete environments, which are isolated containers for managing apps, flows, and data. This is a core administrative function that directly controls the lifecycle of Power Platform resources.

Answer

Manage SharePoint Online site collections

Answer

Manage Exchange Online mailboxes

Answer

Manage Microsoft Entra ID roles

Question 16

Refer to the exhibit. A Power Platform administrator creates a DLP policy as shown. What is the effect of this policy?

Accepted Answer

Facebook, Twitter, and LinkedIn connectors are blocked tenant-wide. The exhibit shows a Data Loss Prevention (DLP) policy configured with the 'Social media' category set to 'Blocked' for all environments. This means the Facebook, Twitter, and LinkedIn connectors are explicitly blocked tenant-wide, preventing their use in any environment (production, sandbox, or default). Option C correctly identifies this outcome.

Answer

Facebook, Twitter, and LinkedIn connectors are allowed in all environments

Answer

All social media connectors are blocked in all environments

Answer

The policy only applies to production environments

Question 17

A Power Platform administrator is configuring data loss prevention (DLP) policies. The company uses Power Automate flows that connect to Microsoft SharePoint and Microsoft Teams. The security team wants to block any flow from sending data from SharePoint to unsanctioned third-party services. Which DLP policy configuration should the administrator apply?

Accepted Answer

Classify SharePoint as Business and all third-party services as Blocked. Option B is correct because DLP policies in Power Platform allow administrators to classify connectors into Business, Non-Business, and Blocked categories. By classifying SharePoint as Business and all third-party services as Blocked, the administrator ensures that no flow can send data from SharePoint to unsanctioned third-party connectors, as blocked connectors cannot be used in any flow that also uses a Business connector. This directly enforces the security team's requirement to prevent data exfiltration to unsanctioned services.

Answer

Create a policy that only applies to non-production environments

Answer

Classify SharePoint as Business and all third-party services as Non-Business

Answer

Classify all connectors as Blocked

Question 18

Refer to the exhibit. The JSON shows Power Platform tenant settings. A user tries to create a new environment with a capacity of 8 GB. What will happen?

Accepted Answer

The environment will be created successfully with 8 GB capacity.. The JSON shows that the tenant settings have 'DisableEnvironmentCreationByNonAdminUsers' set to false, meaning non-admin users can create environments, and 'EnvironmentCapacityAllocationMode' is set to 'UserAllocation', which allows users to allocate capacity from their own user license. Since the user is trying to create an environment with 8 GB, and the default per-user capacity for a Power Apps license is 10 GB (not 5 GB), the creation succeeds because 8 GB is within that limit.

Answer

The environment creation will fail because 8 GB exceeds the default environment capacity of 5 GB.

Answer

The environment will be created but the user must have a Power Apps license assigned.

Answer

The environment creation will fail because UserAllocation mode requires at least 15 GB.

Question 19

Refer to the exhibit. The JSON shows a Power Platform environment's properties in an ARM template. Based on the exhibit, which statement about this environment is true?

Accepted Answer

This environment is a Production environment linked to a Sandbox environment.. The exhibit shows an ARM template with properties including 'environmentType': 'Production' and 'linkedEnvironmentId' referencing a Sandbox environment. This indicates the Production environment is linked to a Sandbox environment for data synchronization or development purposes, which is a common configuration in Power Platform for lifecycle management. The presence of a linked environment ID confirms it is not standalone, and the environment type is Production, not Sandbox.

Answer

This environment is a Standalone environment without any linked environments.

Answer

This environment is a Sandbox environment linked to a Dynamics 365 instance.

Answer

This environment is a Production environment with no data storage.

Question 20

A Power Platform administrator needs to restrict data loss prevention (DLP) policies to prevent sensitive data from being shared with non-approved connectors. Which scope should the administrator apply?

Accepted Answer

Environment-level. Environment-level DLP policies allow administrators to apply data loss prevention rules to specific environments, ensuring that sensitive data is not shared with non-approved connectors within that environment. This granular control is necessary when different environments have different compliance requirements, such as separating development from production data flows.

Answer

Group-level

Answer

Tenant-level

Answer

User-level