PL-900 Manage the Microsoft Power Platform environment — 100 Questions

Question 1

You are the Power Platform administrator for your organization. A user reports that they cannot create a new environment. What is the most likely cause?

Accepted Answer

The user does not have the appropriate license or role to create environments.. Option D is correct because creating environments in the Power Platform requires either a Power Apps, Power Automate, or Dynamics 365 license, and the user must be assigned the Environment Admin or Global Admin role. Without the appropriate license or role, the 'New environment' button is disabled, and the user cannot proceed with environment creation.

Answer

The environment creation feature is disabled in the tenant settings.

Answer

The user is trying to create a production environment without a valid default environment.

Answer

The tenant has reached its maximum number of environments.

Question 2

Your organization has a Power Platform environment that contains several canvas apps and flows. You need to ensure that only users from your Microsoft Entra ID tenant can access the environment. What should you configure?

Accepted Answer

Assign a security group to the environment in the Power Platform admin center.. Assigning a security group to the environment in the Power Platform admin center restricts access to only members of that group, who must be from your Microsoft Entra ID tenant. This ensures that only authenticated users within your tenant can access the environment, effectively blocking external users.

Answer

Change the environment URL to include the tenant name.

Answer

Modify the tenant-level environment creation settings.

Answer

Configure a data loss prevention (DLP) policy for the environment.

Question 3

Your organization uses Power Platform environments for development, test, and production. A developer accidentally deleted a managed solution from the production environment. You need to restore the solution without affecting other components. What should you do?

Accepted Answer

Restore the environment from a backup taken before the deletion.. The correct answer is C because restoring the environment to a previous point in time using backup/restore will bring back the solution and all other components as they were. Option A is incorrect because reimporting the solution may cause data loss or conflicts. Option B is incorrect because solutions cannot be recovered from the recycle bin. Option D is incorrect because solutions cannot be recovered from the source-controlled repository automatically; you would need to deploy again, which may cause issues.

Answer

Reimport the solution from the source-controlled repository using Azure DevOps.

Answer

Use the Power Platform admin center to recover the solution from the recycle bin.

Answer

Reimport the managed solution from a backup file.

Question 4

You are a Power Platform administrator. A user reports that they are unable to share a canvas app with external users. What is the most likely cause?

Accepted Answer

The environment is not enabled for external sharing.. The correct answer is B because sharing canvas apps with external users requires that the environment is enabled for external sharing and the user has the appropriate permissions. Option A is incorrect because DLP policies do not affect sharing. Option C is incorrect because external users do not need a Power Apps license if the app is shared with them and they have appropriate access. Option D is incorrect because the environment type does not determine sharing capabilities; sandbox and production environments both support external sharing if configured.

Answer

The environment is a sandbox environment, which does not support external sharing.

Answer

The environment has a data loss prevention (DLP) policy that blocks sharing.

Answer

External users must have a Power Apps license to access the app.

Question 5

Your organization uses Power Automate to automate business processes. A flow that runs daily fails intermittently with 'HTTP 429 - Too Many Requests' errors. What should you do to resolve this issue?

Accepted Answer

Configure retry policies with exponential backoff in the flow actions.. The correct answer is C because HTTP 429 errors indicate throttling. Implementing retry policies with exponential backoff allows the flow to retry after a delay, reducing the request rate. Option A is incorrect because increasing the flow run frequency would increase the number of requests, worsening the issue. Option B is incorrect because changing the trigger type does not address throttling. Option D is incorrect because using an on-premises data gateway does not affect throttling limits.

Answer

Increase the frequency of the flow to run more often.

Answer

Change the flow trigger from a schedule to an instant trigger.

Answer

Set up an on-premises data gateway to bypass the throttling limits.

Question 6

Your organization has a Power Apps portal that allows external users to submit support tickets. You need to ensure that only authenticated external users from specific domains can access the portal. What should you configure?

Accepted Answer

Configure the portal to use Microsoft Entra ID authentication and set up domain restrictions.. Option D is correct because Power Apps portals can be configured to use Microsoft Entra ID (formerly Azure AD) as the identity provider, and within the portal settings you can restrict sign-in to users from specific domains. This ensures that only authenticated external users whose email domain matches the allowed list can access the portal, meeting the requirement without relying on IP filtering or obscurity.

Answer

Create a data loss prevention (DLP) policy that blocks external users.

Answer

Restrict access to the portal by IP address using a web application firewall.

Answer

Share the portal URL only with users from the allowed domains.

Question 7

You need to grant a user the ability to manage environments in the Power Platform admin center, but not to manage other aspects of the tenant. Which role should you assign?

Accepted Answer

Power Platform administrator. The Power Platform administrator role grants full administrative access to Power Platform environments, including the ability to manage environments in the admin center, without granting broader tenant-level permissions like user management or directory settings. This role is scoped specifically to Power Platform resources, making it the correct choice for the described requirement.

Answer

Environment administrator

Answer

Global administrator

Answer

Dynamics 365 administrator

Question 8

Your organization has multiple Power Platform environments. You need to ensure that a specific connector (e.g., SQL Server) is blocked in the production environment but allowed in the development environment. What should you configure?

Accepted Answer

Create a data loss prevention (DLP) policy and assign it to the production environment.. Data loss prevention (DLP) policies in Power Platform allow administrators to classify connectors as Blocked, Business Data Only, or No Business Data Allowed. By creating a DLP policy and assigning it to the production environment, you can specifically block the SQL Server connector in that environment while leaving it available in the development environment, which is not assigned the same policy.

Answer

Set the connector's API rate limits to zero in the production environment.

Answer

Modify the connector's sharing settings in the environment.

Answer

Configure environment-level security roles to restrict connector usage.

Question 9

Your organization uses Power Virtual Agents (now Copilot Studio) for customer service. You need to ensure that the bot can access customer data from a Dataverse table that contains sensitive information. What is the best approach to secure the data?

Accepted Answer

Assign appropriate security roles and field-level security to the bot's service principal.. The correct answer is B because using Dataverse security roles and field-level security allows you to control access to the sensitive data within the bot. Option A is incorrect because DLP policies do not control data access within Dataverse. Option C is incorrect because environment-level security roles affect all users, not just the bot. Option D is incorrect because the bot's authentication settings control user identity, not data access.

Answer

Configure a data loss prevention (DLP) policy to block the bot from accessing the table.

Answer

Use the bot's authentication settings to require multi-factor authentication.

Answer

Restrict access to the environment to only the bot's service account.

Question 10

Which TWO settings can you configure in a Power Platform environment to control data loss prevention?

Accepted Answer

Default action for connectors. Option D is correct because the 'Default action for connectors' setting in a Power Platform environment allows administrators to define the default behavior (e.g., Block, Allow, or Audit) for connectors that are not explicitly covered by a DLP policy. This setting directly controls data loss prevention by preventing data from being shared with unmanaged or risky connectors. Option E is correct because environment-specific DLP policies enable granular control over which connectors can be used together, preventing data from flowing between business and non-business connectors within that environment.

Answer

Connector sharing settings

Answer

Environment security roles

Answer

Audit logging configuration

Question 11

Which THREE actions can a Power Platform administrator perform in the Power Platform admin center to manage environments?

Accepted Answer

Create a new environment. Option A is correct because the Power Platform admin center provides administrators with the ability to create new environments, which are containers for managing apps, flows, and data. This action is a core administrative task for organizing and isolating resources within a tenant.

Answer

Create a new Microsoft Entra ID security group

Answer

Install a managed solution from AppSource

Question 12

Which TWO of the following are valid environment types in Power Platform?

Accepted Answer

Production. Production and Sandbox are both valid environment types in Power Platform. Production environments are intended for live, end-user applications and data, while Sandbox environments are isolated, non-production environments used for development, testing, and training. Both support the full set of Power Platform capabilities, including Dataverse, Power Apps, Power Automate, and Power Virtual Agents.

Answer

Development

Answer

Trial

Answer

Preview

Question 13

Refer to the exhibit. The JSON policy shown fails to apply to the production environment. What is the most likely reason?

Accepted Answer

The JSON uses 'environment' as a key instead of 'environments'.. Option C is correct because the JSON policy uses 'environment' as a key, but the correct key in Microsoft Power Platform DLP (Data Loss Prevention) policy JSON schema is 'environments' (plural). This mismatch causes the policy to fail validation and not apply to the production environment, as the platform expects an array of environment IDs under the 'environments' key.

Answer

The connector IDs should include the full path with 'shared_twitter' and 'shared_facebook', which they do.

Answer

The action value should be 'Block' with a capital B, but the JSON uses 'Block' which is correct.

Answer

The policy name is missing a required prefix.

Question 14

Refer to the exhibit. The environment 'Contoso Production' was created on January 15, 2023. You need to restore this environment to a state from January 20, 2023. What is the first step you must take?

Accepted Answer

Check if a backup from January 20, 2023, exists in the environment's backup list.. Option B is correct because the first step in restoring a Power Platform environment to a specific past date is to verify that a backup exists for that date. Microsoft Power Platform automatically creates daily backups for production environments, but you must check the backup list to confirm that a backup from January 20, 2023, is available before proceeding with the restore operation.

Answer

Enable point-in-time restore in the environment settings.

Answer

Convert the environment to a sandbox environment.

Answer

Copy the environment to a new environment using the date parameter.

Question 15

Refer to the exhibit. You run the Azure CLI command to create a DLP policy. The command fails with an error that the resource type is invalid. What is the most likely cause?

Accepted Answer

The resource type should be 'Microsoft.PowerPlatform/dlpPolicies'.. The Azure CLI command for creating a DLP policy in Power Platform requires the correct resource type identifier. The error 'resource type is invalid' indicates that the resource type specified in the command does not match the expected Azure Resource Manager (ARM) resource type. The correct resource type for Power Platform DLP policies is 'Microsoft.PowerPlatform/dlpPolicies', not a generic or incorrect type like 'Microsoft.PowerPlatform/dlpPolicies' (note the exact casing and spelling). Option C correctly identifies this as the most likely cause.

Answer

The --location parameter should be 'global' instead of 'eastus'.

Answer

The --name parameter is missing the policy prefix.

Answer

The --properties parameter should reference a URL instead of a file.

Question 16

A company plans to deploy Power Apps for field service technicians. The IT department requires that all users authenticate using their corporate credentials and that access to the Power Apps environment is restricted to users from the company's tenant only. Which configuration should the administrator use?

Accepted Answer

Set the environment security group to 'Only internal users' and disable external sharing. Option D is correct because setting the environment security group to 'Only internal users' and disabling external sharing ensures that only authenticated users from the company's own Microsoft Entra ID (formerly Azure AD) tenant can access the Power Apps environment. This meets the IT requirement of restricting access to corporate credentials and the company's tenant only, preventing any external guest or user from another tenant from signing in.

Answer

Enable 'Allow users from other tenants' in environment settings

Answer

Set the environment security group to 'All users' and enable external sharing

Answer

Assign a security group that includes only specific technicians

Question 17

A Power Platform administrator notices that a production environment has exceeded its storage quota. The administrator needs to free up storage without impacting active solutions. Which action should the administrator take first?

Accepted Answer

Analyze storage by entity and delete unused custom tables. Option A is correct because analyzing storage by entity allows the administrator to identify which custom tables consume the most space, and deleting unused custom tables directly frees up storage without affecting active solutions. This is the recommended first step in the Power Platform admin center, as it targets the root cause of storage overage while preserving production functionality.

Answer

Increase the storage quota

Answer

Remove the environment and create a new one

Answer

Delete all audit logs older than 30 days

Question 18

An organization uses Power Automate flows that connect to Microsoft SharePoint Online and Microsoft Dataverse. The security team requires that all connections to Dataverse use service principal authentication instead of user credentials. The administrator needs to ensure that flows relying on Dataverse connections continue to work after the change. What should the administrator do?

Accepted Answer

Register a service principal in Microsoft Entra ID and update connection references in the flows' solution. Service principal authentication in Power Automate requires registering an application in Microsoft Entra ID (formerly Azure AD) and using its credentials to authenticate to Dataverse. Updating the connection references in the flows' solution to point to a service principal-based connection ensures all flows continue to work without requiring user credentials, meeting the security team's requirement.

Answer

Create a new environment and migrate flows there

Answer

Recreate all flows with a shared connection using a service principal

Answer

Delete existing connections and ask users to create new ones

Question 19

A company is deploying Power Virtual Agents (now Copilot Studio) chatbots across multiple departments. Each department needs its own environment to manage chatbots independently. However, the company wants to share a common set of entities and workflows across all environments. Which approach should the administrator take?

Accepted Answer

Create a separate environment per department and deploy managed solutions containing the common components. Option D is correct because managed solutions allow you to package common components (entities, workflows) and deploy them to multiple environments, ensuring consistency while maintaining departmental isolation. Each department gets its own environment for independent chatbot management, and the shared components are installed via managed solutions that cannot be modified, preserving the common baseline.

Answer

Create a single environment for all departments and use security roles to isolate chatbots

Answer

Use Power Apps component library to share components across environments

Answer

Create a shared environment for common components and link each department environment to it

Question 20

A Power Platform administrator is configuring data loss prevention (DLP) policies. The company uses Power Automate flows that connect to Microsoft SharePoint and Microsoft Teams. The security team wants to block any flow from sending data from SharePoint to unsanctioned third-party services. Which DLP policy configuration should the administrator apply?

Accepted Answer

Classify SharePoint as Business and all third-party services as Blocked. Option B is correct because DLP policies in Power Platform allow administrators to classify connectors into Business, Non-Business, and Blocked categories. By classifying SharePoint as Business and all third-party services as Blocked, the administrator ensures that no flow can send data from SharePoint to unsanctioned third-party connectors, as blocked connectors cannot be used in any flow that also uses a Business connector. This directly enforces the security team's requirement to prevent data exfiltration to unsanctioned services.

Answer

Create a policy that only applies to non-production environments

Answer

Classify SharePoint as Business and all third-party services as Non-Business

Answer

Classify all connectors as Blocked