PL-900 Manage the Microsoft Power Platform environment Practice Test 14 — 15 Questions

Question 1

A Power Platform administrator at Contoso manages a production environment that contains several mission-critical Power Apps canvas apps. The administrator wants to ensure that any change made to an app in this environment is recorded and can be traced back to the user who made it, for audit purposes. Which feature should the administrator enable to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Environment-level activity logging for app and flow modifications, viewable in the Power Platform admin center. Environment activity logging in the Power Platform admin center records environment-level operations such as app and flow creation, modification, and deletion, along with the acting user. This gives the administrator the traceability needed to audit who changed mission-critical apps. Dataverse auditing, DLP policies, and managed environment sharing restrictions address data records, connector governance, and sharing scope respectively, not app definition change history.

Answer

Managed environments with the 'Share' restriction enabled for the production environment

Answer

Microsoft Purview Data Loss Prevention policies scoped to the environment's connectors

Answer

Dataverse auditing at the environment level, configured on the tables used by the apps

Question 2

A Power Platform administrator is setting up a new environment for a department. The department requires that data stored in the environment remain within a specific geographic region. The administrator creates the environment in the Europe region. Which additional step must the administrator take to ensure that all data, including backups, stays in that region?

Accepted Answer

Configure the environment's region during creation; no further action is required.. Data residency in Power Platform is determined by the region chosen when an environment is created. The environment's data, including backups, is stored in data centers within that region. No additional configuration is required to enforce this. The administrator's creation of the environment in the Europe region already ensures that data remains in that geography, making other proposed steps unnecessary or ineffective.

Answer

Create a data loss prevention policy that blocks connectors outside the region.

Answer

Enable the 'Data residency' setting in the Power Platform admin center.

Answer

Assign the environment to a security group that is restricted to users in that region.

Question 3

A company has a production environment containing a model-driven app used by 400 sales staff. The administrator wants to review who accessed the app in the last 30 days and which users were inactive, without enabling any paid auditing features. Which tool should the administrator use?

Accepted Answer

The Power Platform admin center Analytics section for the environment, selecting the Power Apps report. Environment analytics in the Power Platform admin center is the built-in, no-extra-cost way to see app usage and inactive users for a specific environment. It reports which apps are used, how often, and by whom, so the administrator can identify inactive sales staff without enabling paid auditing or digging through compliance tooling.

Answer

Microsoft Purview audit log search filtered to the Dataverse workload

Answer

Environment-level data loss prevention policy reports in the Power Platform admin center

Answer

The Microsoft 365 admin center Reports dashboard, Service usage section

Question 4

A Power Platform administrator needs to provide a team of makers with a shared environment that includes a common set of connectors and a preconfigured Microsoft Dataverse database. The makers should be able to collaborate on apps and flows without affecting other environments. What should the administrator create?

Accepted Answer

A new environment with a Dataverse database and assign the makers the Environment Maker security role.. To provide a shared, isolated workspace with Dataverse, the administrator should create a new environment and provision a Dataverse database. Assigning the Environment Maker security role enables team members to create and collaborate on apps and flows within that environment. This approach keeps their work separate from other environments and ensures they have the necessary permissions.

Answer

A new Power Platform environment with no database and share the default environment with the team.

Answer

A new Power Apps solution that includes all required connectors and share it with the team.

Answer

A new security group in Microsoft Entra ID and assign the team to it.

Question 5

A Power Platform administrator needs to provide a team of makers with a shared environment that includes preinstalled sample data and apps for learning purposes. The team should be able to reset the environment to its initial state if needed. Which environment type should the administrator create?

Accepted Answer

Sandbox. Sandbox environments are the correct choice for training and testing because they support sample data and apps, and can be reset to a clean state. They are shared environments that can be assigned to a security group, making them ideal for a team of makers learning Power Platform.

Answer

Production

Answer

Default

Answer

Developer

Question 6

An administrator is setting up a new Power Platform environment for a department. The department requires that all users in the environment use only approved connectors, and that data cannot be shared between the approved connectors and any unapproved connectors. What should the administrator configure?

Accepted Answer

A data loss prevention (DLP) policy that classifies connectors into Business, Non-Business, and Blocked groups.. Data loss prevention policies in Power Platform are designed to classify connectors and control data flow between them. By assigning approved connectors to the Business group and unapproved ones to Blocked, the policy ensures that only approved connectors are used and that data cannot be shared with unapproved ones. This is the correct and only native mechanism to enforce such restrictions.

Answer

A Power Automate flow that monitors connector usage and alerts the administrator.

Answer

Environment security roles that restrict which connectors users can access.

Answer

Microsoft Entra ID conditional access policies that block unapproved connectors.

Question 7

A small business wants to give its finance team a dedicated space to build apps and flows that only finance team members can access, separate from the default environment used by the rest of the company. The administrator needs to create this isolated workspace. What should the administrator create?

Accepted Answer

A new Power Platform environment with restricted user access. Power Platform environments are the fundamental security and isolation boundary. Creating a dedicated environment and granting access only to finance team members ensures their apps, flows, and data are separated from the default environment. Microsoft 365 groups, Dataverse tables, and solutions do not provide this isolation, since they either manage unrelated services, store data inside an existing environment, or package components for transport.

Answer

A new Microsoft 365 group and assign it the Global Administrator role

Answer

A new Dataverse table with column-level security for finance data

Answer

A new Power Apps solution containing the finance team's apps

Question 8

A Power Platform administrator is configuring a new environment for a team that will use both Power Apps and Power Automate. The administrator needs to ensure that the team can only use a specific set of connectors and that data cannot be shared between certain connectors. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Apply the DLP policy to the environment so that it enforces the connector restrictions for all apps and flows within it.. To restrict connector usage and prevent data sharing between certain connectors, the administrator must create a DLP policy that defines connector groups and blocks cross-group usage, and then apply that policy to the environment. These two actions together enforce the desired governance. Other actions, such as assigning roles or setting region, do not address connector-level restrictions or data flow control.

Answer

Configure the environment's security group to include only the team members who need access.

Answer

Use the Power Platform admin center to set the environment's region to a specific geography.

Answer

Assign the Environment Maker security role to all team members.

Question 9

A Power Platform administrator needs to delegate the ability to create and manage environments to a specific user without granting full Power Platform administrator privileges. The administrator wants to follow the principle of least privilege. What should the administrator do?

Accepted Answer

Assign the Environment Admin role for the environments and the Environment Creator role at the tenant level.. To delegate environment creation and management without full admin rights, the administrator should assign the Environment Creator role at the tenant level and Environment Admin roles for the specific environments. This combination provides the necessary permissions while adhering to least privilege, as the user cannot manage unrelated environments or tenant-wide policies.

Answer

Assign the Environment Admin role for each environment the user should manage.

Answer

Assign the Power Platform Administrator role to the user in Microsoft Entra ID.

Answer

Assign the Environment Creator role in the Power Platform admin center.

Question 10

A Power Platform administrator is configuring data loss prevention (DLP) policies for a tenant. The administrator needs to allow the use of the SharePoint connector and the Outlook connector in the same flow, but must block the use of the Twitter connector. Which DLP policy configuration should the administrator use?

Accepted Answer

Add SharePoint and Outlook to the Business data group, and add Twitter to the Blocked group.. DLP policies classify connectors into Business, Non-Business, and Blocked groups. Connectors in the same group can be used together in a flow. To allow SharePoint and Outlook together, they must be in the same group, such as Business. To block Twitter, it must be placed in the Blocked group. This configuration satisfies both conditions.

Answer

Add SharePoint to the Business data group, add Outlook to the Non-Business data group, and add Twitter to the Blocked group.

Answer

Add SharePoint and Outlook to the Non-Business data group, and add Twitter to the Business data group.

Answer

Add SharePoint and Outlook to the Blocked group, and add Twitter to the Non-Business data group.

Question 11

A Power Platform administrator needs to ensure that all Power Automate cloud flows in a specific environment can only use connectors approved by the security team, and that flows combining a blocked connector with any other connector are prevented from running. Which mechanism should the administrator use?

Accepted Answer

A Data Loss Prevention policy that classifies connectors as Business, Non-Business, or Blocked. Data Loss Prevention policies are the designated mechanism for connector governance in Power Platform. By grouping connectors into Business, Non-Business, and Blocked categories, the admin can block a specific connector entirely and prevent flows from combining Business and Non-Business connectors. Security roles, connector consent, and managed environment solution checker settings address permissions, consent, and quality respectively, not connector combination rules.

Answer

Managed environment settings that enforce the solution checker before flows can be shared

Answer

Connector consent settings in the Power Platform admin center that require admin approval for new connectors

Answer

Environment security roles that deny the Flow creation privilege to all makers

Question 12

A Power Platform administrator needs to monitor the usage of Power Apps and Power Automate across the tenant to identify which environments are consuming the most resources. Which tool should the administrator use?

Accepted Answer

Power Platform admin center. The Power Platform admin center includes built-in analytics and usage reports that show how Power Apps and Power Automate are being used across environments. Administrators can access these reports to see metrics like active users, app launches, and flow runs, helping identify environments with high resource consumption. Other tools like Microsoft 365 admin center or Azure Monitor do not provide this specific Power Platform usage data out of the box.

Answer

Power BI

Answer

Microsoft 365 admin center

Answer

Azure Monitor

Question 13

A Power Platform administrator needs to manage user access to a specific environment. The administrator wants to allow a group of users to create apps and flows in that environment, but restrict them from modifying environment settings or managing other users. Which two actions should the administrator perform? (Choose two.)

Accepted Answer

Add the users to the environment's Maker security group (if using security groups).. To allow users to create apps and flows without granting administrative rights, the administrator should assign the Environment Maker role. This can be done directly or by adding users to the environment's Maker security group if security groups are used. These actions provide the necessary creation permissions while adhering to least privilege, unlike Environment Admin or tenant-level roles.

Answer

Assign the Environment Admin role to the group of users for the environment.

Answer

Assign the Power Platform Administrator role to the group of users.

Answer

Ensure the users have the Common Data Service User security role in the environment.

Question 14

A Power Platform administrator is reviewing the capacity of a production environment. The environment has a database size of 2 GB, file storage of 10 GB, and log storage of 1 GB. The tenant has a total of 10 GB of database capacity, 50 GB of file capacity, and 2 GB of log capacity. The administrator notices that the production environment is consuming a disproportionate amount of database capacity. Which action should the administrator take to identify the largest tables in the environment?

Accepted Answer

In the Power Platform admin center, select the environment, then go to Analytics > Dataverse, and view the 'Table size' report.. The Power Platform admin center includes Dataverse analytics that provide detailed storage usage reports. The 'Table size' report specifically lists each table and its size, enabling administrators to pinpoint which tables are consuming the most database capacity. This is the intended and supported method for storage analysis at the table level.

Answer

Use the Microsoft Dataverse API to retrieve metadata for all tables and calculate their sizes using the 'RetrieveTotalRecordCount' message.

Answer

In the Power Apps maker portal, open each table and check the 'Table properties' for the 'Storage size' field.

Answer

Run a SQL query against the Dataverse database using the TDS endpoint to select table names and their sizes from the sys.tables view.

Question 15

A Power Platform administrator needs to view the capacity consumption for the tenant, including how much Dataverse storage and Power Platform request capacity is being used. Where should the administrator go?

Accepted Answer

The Power Platform admin center, under Analytics > Capacity.. The Power Platform admin center is the dedicated portal for managing Power Platform environments and capacity. The Capacity page under Analytics provides a comprehensive view of Dataverse storage, Power Platform requests, and other add-on capacities. This is the correct place for administrators to monitor tenant-wide capacity usage.

Answer

The Azure portal, under Cost Management + Billing.

Answer

The Microsoft 365 admin center, under Billing > Licenses.

Answer

The Microsoft Purview compliance portal, under Reports.