PL-900 Manage the Microsoft Power Platform environment Practice Test 13 — 15 Questions

Question 1

Which TWO are valid methods to create a new Power Platform environment?

Accepted Answer

Using the Power Platform admin center web interface.. Option A is correct because the Power Platform admin center (admin.powerplatform.microsoft.com) provides a dedicated Environments page where an administrator can click 'New' and specify environment name, type (Sandbox, Production, Trial, Developer, Teams), region, and Dataverse provisioning. Option B is correct because the Power Platform API exposes environment lifecycle operations, including the CreateEnvironment endpoint (via the BAP/Business Application Platform REST API), enabling programmatic environment creation with appropriate authentication and permissions. Option C is incorrect because the Microsoft Teams admin center manages Teams policies, users, and settings, not Power Platform environment provisioning. Option D is incorrect because the Power Apps mobile app is a client for running and consuming apps, not an administrative tool for creating environments. Option E is incorrect because the SharePoint admin center manages SharePoint sites, storage, and sharing settings, and has no capability to create Power Platform environments.

Answer

Using the Microsoft Teams admin center.

Answer

Using the Power Apps mobile app.

Answer

Using the SharePoint admin center.

Question 2

An organization has multiple Power Platform environments. The security team mandates that all environments must use Microsoft Entra ID conditional access policies to enforce multi-factor authentication. However, one environment hosts a service account that cannot perform interactive logins. What should the administrator do to comply without breaking the service account?

Accepted Answer

Exclude the service account from the conditional access policy. Conditional Access policies in Microsoft Entra ID support targeted exclusions for specific users, groups, or service principals. Excluding the non-interactive service account from the MFA-requiring policy allows it to authenticate programmatically (e.g., via client credentials or service principal) without triggering an interactive MFA challenge, while all other users remain protected. This is the standard, supported approach for service accounts that cannot perform interactive logins.

Answer

Create a new environment for the service account

Answer

Change the service account to use interactive login

Answer

Disable MFA for that environment

Question 3

A company wants to ensure that changes to a Power Platform solution are tracked and can be rolled back if necessary. The development team uses source control. What should the administrator configure to enable solution lifecycle management?

Accepted Answer

Use managed solutions and export to source control. Solution lifecycle management in Power Platform relies on the ALM pattern: develop in an unmanaged solution, export it as a managed solution, and store the solution source (including the .zip and unpacked XML) in a source control repository such as Azure DevOps or GitHub. Managed solutions are immutable in target environments, preventing out-of-band edits, and the source-controlled artifacts enable versioning, diffing, and rollback by re-importing a prior version.

Answer

Backup the environment daily

Answer

Share the app with the team

Answer

Disable sharing to prevent changes

Question 4

An organization is using Power Virtual Agents (now Copilot Studio) to create a customer service chatbot. The chatbot must be available only to users inside the organization, not to external customers. What should the administrator do?

Accepted Answer

Configure authentication in the chatbot. To restrict a Power Virtual Agents (Copilot Studio) chatbot to internal users only, the administrator should configure authentication in the chatbot. This enforces sign-in and limits access to users within the organization's Microsoft Entra ID tenant, preventing external customers from interacting with it.

Answer

Publish the chatbot to a public website

Answer

Create a new environment for the chatbot

Answer

Disable analytics for the chatbot

Question 5

An administrator is planning the environment strategy for a large enterprise. Which TWO considerations should the administrator include to ensure proper governance?

Accepted Answer

Establish environment naming conventions. Environment naming conventions and DLP policies are key governance considerations. Option B (establish naming conventions) helps organize environments; Option D (implement DLP policies) protects data. Option A is wrong because using only the default environment is not recommended for governance. Option C is wrong because disabling environment monitoring reduces visibility and control. Option E is wrong because allowing all connectors poses a security risk.

Answer

Use only the default environment to simplify management

Answer

Disable environment monitoring to reduce overhead

Answer

Allow all connectors to maximize flexibility

Question 6

A company is migrating a complex Power Apps solution from a development environment to production. The solution includes custom connectors, flows, and Dataverse tables. Which THREE steps should the administrator take to ensure a successful migration?

Accepted Answer

Test the solution in a staging environment first. To ensure a successful migration, the administrator should test the solution in a staging environment first (A) to validate functionality, export it as a managed solution (C) to maintain component relationships and support future upgrades, and run the solution checker (E) to identify and fix issues before migration. Deleting the development environment after export (B) is risky because it removes the source before the migration is verified. Manually recreating the solution in production (D) is error-prone and not recommended.

Answer

Delete the development environment after export

Answer

Manually recreate the solution in production

Question 7

An administrator configures a Data Loss Prevention (DLP) policy with the scope set to 'All environments' and places selected connectors in the 'Blocked' group. What will be the result of this policy?

Accepted Answer

The connectors are blocked in all environments. A DLP policy scoped to 'All environments' applies its connector classification across every Power Platform environment in the tenant. When connectors are placed in the 'Blocked' group, any app or flow using those connectors is prevented from running in any environment, including the default one. The scope setting directly determines where the policy's restrictions take effect.

Answer

The connectors are allowed but audited

Answer

The connectors are blocked only in production environments

Answer

The connectors are blocked except for the default environment

Question 8

You are a Power Platform administrator for a non-profit organization. The organization has a single environment used by volunteers and staff. A new volunteer needs to be able to run a specific Power App that manages event registrations, but should not be able to modify the app or access any other resources in the environment. The volunteer has a valid Power Apps license. You need to provide the volunteer with the minimum permissions necessary. What should you do?

Accepted Answer

Share the app directly with the volunteer. Sharing the app directly with the volunteer grants run-only access to that specific app without granting environment-wide privileges. The volunteer can use the app but cannot modify it or access other resources, satisfying the least-privilege requirement.

Answer

Create a new environment and add the volunteer there

Answer

Assign the volunteer the Environment Maker role and share the app

Answer

Add the volunteer to the System Administrator role

Question 9

An organization is preparing for a Power Platform rollout. They need to ensure that only licensed users can create new environments, and that environment creation is audited. Additionally, they want to restrict which connectors can be used in production environments. Which THREE capabilities should they use?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies allow administrators to block or restrict specific connectors (e.g., HTTP, custom connectors) in production environments, ensuring sensitive data is not exposed through unauthorized integrations. This directly addresses the requirement to restrict which connectors can be used in production environments.

Answer

Power Virtual Agents bot

Answer

Power Apps mobile app

Question 10

A multinational corporation uses Power Platform extensively. They have multiple environments: DEV, TEST, UAT, STAGING, and PROD. A developer accidentally published a Power App that connects to a SQL Server database using an unapproved connector in the PROD environment. The organization has strict data governance policies that require all connections to use approved connectors only. The admin needs to block this connector in PROD while still allowing it in other environments. What should the admin do?

Accepted Answer

Create an environment-level DLP policy for PROD that blocks the connector.. Environment-level DLP policies in Power Platform apply only to a specific environment, so creating one for PROD that blocks the unapproved connector restricts it there while leaving DEV, TEST, UAT, and STAGING unaffected. This precisely meets the requirement to block the connector only in PROD. Tenant-level policies would affect all environments, which is too broad.

Answer

Create a tenant-level DLP policy that blocks the connector for all environments.

Answer

Remove the developer's permissions to the PROD environment.

Answer

Delete the Power App from PROD.

Question 11

A hospital uses Power Apps to manage patient intake forms. The app stores data in Microsoft Dataverse. The security policy requires that patient health information (PHI) be encrypted at rest and in transit. The environment is already configured with default Dataverse settings. The IT admin needs to ensure compliance. What should the admin do?

Accepted Answer

No further action is needed; Dataverse encrypts data at rest and in transit by default.. Microsoft Dataverse encrypts all data at rest using SQL Server Transparent Data Encryption (TDE) and AES-256, and encrypts data in transit using TLS 1.2 or higher by default. Because the environment already uses default Dataverse settings, the encryption-at-rest and in-transit requirements for PHI are already satisfied without any additional configuration. Customer-managed keys are an optional compliance enhancement, not a baseline requirement.

Answer

Enable customer-managed encryption keys for Dataverse.

Answer

Configure a VPN for all access to the environment.

Answer

Use Power Automate to encrypt data before storing it in Dataverse.

Question 12

A government agency uses Power Platform with strict compliance requirements. They need to retain all audit logs of user activities within Power Platform for at least 7 years. The agency uses Microsoft Purview for compliance and Microsoft Sentinel for security monitoring. The admin needs to ensure that all Power Platform audit events are captured and retained for the required period. What should the admin do?

Accepted Answer

Configure a retention policy in Microsoft Purview for the Power Platform audit logs.. Power Platform audit logs are stored in the Microsoft 365 unified audit log. Microsoft Purview allows configuring retention policies for these logs to meet compliance requirements. Option C is correct because it directly addresses the need to retain logs for 7 years via a Purview retention policy. Options A, B, and D are insufficient or misaligned: A (export to Azure Blob Storage) is an extra step and not the native retention mechanism; B (Microsoft Sentinel) is for security monitoring, not primary retention; D (enabling audit logging) is necessary but does not set the retention duration.

Answer

Export audit logs to Azure Blob Storage and set a retention policy there.

Answer

Use Microsoft Sentinel to store and retain the logs for 7 years.

Answer

Enable audit logging in each Power Platform environment's settings.

Question 13

A university uses Power Apps for student registration. The app is built on Dataverse and shared with all students. Recently, a student reported that they cannot access the app and receive an error that they do not have permission. The app was working earlier. The admin checks the environment and finds that the app's sharing settings have been changed. The admin needs to restore access for all students quickly. What should the admin do?

Accepted Answer

Share the app with the 'All Students' security group in the Power Apps maker portal.. Sharing the app with the 'All Students' security group in the Power Apps maker portal restores access for all students quickly and correctly. Security groups are the recommended way to manage access at scale in Dataverse-backed apps.

Answer

Contact Microsoft Support to restore the previous sharing settings.

Answer

Assign the 'Environment Maker' role to all students.

Answer

Re-create the app from a backup.

Question 14

A Power Platform administrator is configuring a data loss prevention (DLP) policy for a new environment. The policy must allow the use of the SharePoint and Outlook connectors together, but must prevent the use of the Twitter connector with any other connector. How should the administrator configure the DLP policy?

Accepted Answer

Place SharePoint and Outlook in the Business group, and Twitter in the Blocked group.. To allow SharePoint and Outlook together, they must be in the same group (Business). To prevent Twitter from being used with any other connector, it must be in the Blocked group, which disallows its use entirely. Thus, the correct configuration is SharePoint and Outlook in Business, Twitter in Blocked.

Answer

Place SharePoint in the Business group, Outlook in the Non-Business group, and Twitter in the Blocked group.

Answer

Place SharePoint and Outlook in the Business group, and Twitter in the Business group as well.

Answer

Place SharePoint and Outlook in the Business group, and Twitter in the Non-Business group.

Question 15

A Power Platform administrator needs to provide a team of makers with a shared environment that includes a pre-installed Microsoft Dataverse database and sample apps. The environment should be available to all team members without requiring them to create their own. What should the administrator do?

Accepted Answer

Create a new environment in the Power Platform admin center, select 'Yes' for 'Create a database for this environment?', and then assign the 'Environment Maker' security role to the team members.. A shared environment with a Dataverse database is created explicitly in the Power Platform admin center by selecting the option to create a database. Assigning the Environment Maker role to team members grants them the necessary permissions to build resources in that environment. Personal environments and the default environment are not suitable for controlled team collaboration with a dedicated database.

Answer

Instruct each team member to create their own personal environment and then share their apps with the team.

Answer

Use the default environment and enable the 'Sample apps' feature in the Power Platform admin center.

Answer

Create a Microsoft 365 group and enable Power Apps for the group, which automatically provisions a Dataverse database.