PL-900 Manage the Microsoft Power Platform environment Practice Test 5 — 15 Questions

Question 1

Which TWO actions are necessary to enable AI Builder in a Power Apps environment? (Select 2)

Accepted Answer

Purchase AI Builder credits. Option B is correct because AI Builder is a premium capability that requires AI Builder credits (capacity) to be purchased and allocated to the environment before models can be created and run. Option D is correct because AI Builder must be explicitly enabled in the target Power Platform environment (via the Power Platform admin center or environment settings) before makers can use it. Option A is not required because AI Builder connectors are part of the platform and do not need separate installation. Option C is not required because a DLP policy restricting or allowing AI Builder is not a prerequisite for enabling it. Option E is not required because a Power Automate license alone does not enable AI Builder; the necessary capacity comes from AI Builder credits.

Answer

Install AI Builder connectors

Answer

Create a DLP policy that allows AI Builder

Answer

Assign a Power Automate license to users

Question 2

Which THREE features are available in Power Platform managed environments? (Select 3)

Accepted Answer

Weekly analytics digests. Managed environments in Power Platform provide governance and control capabilities beyond standard environments, and three of the listed features are exclusive to them. Option B (Weekly analytics digests) is correct because managed environments automatically deliver weekly email digests summarizing usage, inventory, and adoption metrics for the environment. Option C (Solution checker integration) is correct because managed environments allow administrators to enforce solution checker rules so that solutions are validated against best practices before deployment. Option D (Sharing limits for canvas apps) is correct because managed environments let admins set a maximum number of users with whom a canvas app can be shared, preventing uncontrolled broad sharing. Options A (Data loss prevention policies) and E (Data policies enforcement) are not exclusive to managed environments; DLP policies and their enforcement are available and applied at the tenant level for all environments, including standard ones, so they are not among the features introduced by managed environments.

Answer

Data loss prevention (DLP) policies

Answer

Data policies enforcement

Question 3

Refer to the exhibit.

{
  "name": "Environment Usage Report",
  "type": "Power BI report",
  "dataset": {
    "name": "Power Platform Admin View",
    "tables": [
      {
        "name": "Environments",
        "columns": [
          { "name": "EnvironmentName", "dataType": "string" },
          { "name": "TotalActiveUsers", "dataType": "int" },
          { "name": "TotalAppUsage", "dataType": "int" },
          { "name": "TotalFlowRuns", "dataType": "int" }
        ]
      }
    ]
  }
}

An admin runs a report to see total active users per environment. The report shows zero active users for a production environment that is actively used. What is the most likely reason?

Accepted Answer

The environment is not included in the Power Platform Admin View dataset. The most likely reason for zero active users is that the production environment is not included in the Power Platform Admin View dataset that the report queries. If the environment is missing from the dataset, the report cannot display its user counts, resulting in zeros or missing rows.

Answer

The report uses a canvas app connector that is blocked

Answer

The TotalActiveUsers column is missing from the dataset

Answer

The admin does not have permission to view the dataset

Question 4

Refer to the exhibit.

Get-MgDirectoryRole | Where-Object {$_.DisplayName -eq "Power Platform Administrator"} | Select-Object Id

An admin runs this Microsoft Graph PowerShell command and gets no output. What does this indicate?

Accepted Answer

The Power Platform Administrator role is not activated in the tenant. The command queries directory roles whose DisplayName equals 'Power Platform Administrator'. If the role is not activated in the tenant, it does not appear in the directory roles list, so the pipeline returns no output. The command itself is syntactically valid and the admin's permissions are sufficient to read directory roles, so the absence of output indicates the role is not activated.

Answer

The admin does not have permission to run the command

Answer

There are no directory roles in the tenant

Answer

The command syntax is incorrect

Question 5

Refer to the exhibit.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.PowerPlatform/enterprisePolicies",
      "apiVersion": "2021-01-01",
      "name": "myDlpPolicy",
      "location": "eastus",
      "properties": {
        "definition": {
          "$schema": "https://schema.management.azure.com/providers/Microsoft.PowerPlatform/policyDefinitions/2021-01-01/schema.json#",
          "rules": [
            {
              "name": "Block SharePoint",
              "action": "Block",
              "connectors": [
                "shared_sharepointonline"
              ]
            }
          ]
        }
      }
    }
  ]
}

An admin deploys this ARM template to create a DLP policy. After deployment, users report they can still use the SharePoint connector in Power Automate. What is the most likely reason?

Accepted Answer

The resource type should be 'Microsoft.PowerPlatform/dlpPolicies'. The ARM template uses the resource type 'Microsoft.PowerPlatform/enterprisePolicies', which is incorrect for DLP policies. The correct resource type for Power Platform DLP policies is 'Microsoft.PowerPlatform/dlpPolicies'. Because the resource type is wrong, the deployment may succeed but the policy is not actually created or enforced, allowing users to continue using the SharePoint connector.

Answer

The policy was not applied to the environment where users are working

Answer

The policy name does not match the connector name

Answer

The policy is applied at the tenant level and does not affect individual environments

Question 6

A company is deploying Microsoft Power Platform to multiple departments. The security team requires that all environment creation be restricted to a specific group of administrators. Which action should the Power Platform administrator take?

Accepted Answer

Create a security group in Microsoft Entra ID that includes the allowed administrators.. In Power Platform, environment creation permissions are controlled by assigning the Environment Creator role to a security group in the Power Platform admin center, and only members of that group can create environments. The first step is to create the Microsoft Entra ID security group containing the allowed administrators. Once the group exists, the admin can grant it environment creation rights via the tenant settings. This restricts environment creation to only that group.

Answer

Disable environment creation for all users in the Power Platform admin center.

Answer

Install the CoE Starter Kit and configure environment creation policies.

Answer

Assign the Environment Admin role to the security group in the Power Platform admin center.

Question 7

A Power Platform administrator needs to ensure that any maker can create environments in the default tenant, but only for development purposes. The administrator wants to enforce a policy that automatically deletes unused environments after 30 days. Which feature should the administrator use?

Accepted Answer

Environment Lifecycle Policies in the Power Platform admin center.. The Environment Lifecycle Policies in the Power Platform admin center, which allow setting deletion policies based on inactivity. Option B is incorrect because the Power Platform API can be used but is not the built-in policy feature. Option C is incorrect because capacity management does not delete environments. Option D is incorrect because Data Loss Prevention (DLP) policies control connectors, not environment lifecycle.

Answer

Power Platform API to schedule deletion scripts.

Answer

Capacity management in the Power Platform admin center.

Answer

Data Loss Prevention (DLP) policies.

Question 8

A company uses Microsoft Power Platform and wants to allow external users (guests) to access a canvas app. The app connects to a Dataverse database that contains sensitive customer information. The security team is concerned about data leakage. What should the administrator do to minimize risk?

Accepted Answer

Create a new environment specifically for external users with only the required data.. Creating a separate environment for external users allows the administrator to control exactly which Dataverse tables and data are exposed, minimizing the risk of sensitive customer information being leaked. This approach follows the principle of least privilege by isolating guest access to a sandboxed environment with only the required data, rather than granting access to the existing production environment.

Answer

Disable sharing of the app with external users.

Answer

Add external users as guests in Microsoft Entra ID and grant them access to the existing environment.

Answer

Use DLP policies to block all connectors except the canvas app.

Question 9

A Power Platform administrator receives a report that a user is unable to create a new environment. The user has a Power Apps per user license and is a member of the global admin group. What is the most likely cause?

Accepted Answer

The user does not have a Power Apps Plan 2 license or Environment Creation add-on.. Creating environments in Power Platform requires either a Power Apps Plan 2 license (legacy) or the Environment Creation add-on. A Power Apps per user license does not include environment creation rights. Although the user is a global admin, that role does not automatically grant environment creation privileges in Power Platform; the necessary license or add-on is still required.

Answer

The user does not have the Environment Admin role.

Answer

A DLP policy is blocking environment creation.

Answer

The tenant has reached its environment capacity limit.

Question 10

A Power Platform administrator is configuring a data loss prevention (DLP) policy for a production environment. The policy must block the use of the SharePoint connector but allow the use of the SQL Server connector. The administrator creates a policy and assigns it to the environment. However, users can still use the SharePoint connector. What is the most likely reason?

Accepted Answer

A tenant-level DLP policy allows SharePoint and is set to a higher priority.. In Power Platform, DLP policies are evaluated with tenant-level policies taking precedence over environment-level policies. If a tenant-scoped policy allows the SharePoint connector, that allowance overrides the environment-scoped block, so users can still use SharePoint. The administrator's environment-level policy is effectively shadowed by the higher-priority tenant policy.

Answer

The policy was not assigned to the correct environment.

Answer

The users have the System Administrator role in the environment.

Answer

The DLP policy has not been saved and published.

Question 11

An organization uses Microsoft Power Platform and wants to implement a governance strategy that automatically blocks the creation of environments in specific regions to comply with company policy. What should the administrator do?

Accepted Answer

Use the Power Platform admin center to define allowed data locations for environment creation.. The Power Platform admin center allows administrators to define allowed data locations for environment creation, effectively blocking regions that are not allowed. Option A is incorrect because creating a support ticket is not the standard method for this governance control; the admin center provides the capability. Option B is incorrect because capacity limits control the number of environments or storage, not geographic restrictions. Option D is incorrect because setting the default environment region only affects the default region for new environments but does not block creation in other regions; it is not a restriction.

Answer

Create a support ticket with Microsoft to block regions.

Answer

Implement capacity limits that prevent creation in disallowed regions.

Answer

Set the default environment region in tenant settings to the allowed region.

Question 12

A Power Platform administrator is planning to implement environment lifecycle management. Which TWO actions should the administrator take to ensure unused environments are automatically cleaned up?

Accepted Answer

Create a Power Automate flow that runs periodically and deletes environments that have not been accessed in 30 days.. The two correct actions are D and E. Option D: Creating a Power Automate flow that periodically deletes environments inactive for 30 days automates cleanup. Option E: Setting an environment retention policy in the Power Platform admin center automatically deletes environments after a period of inactivity. Both are automated approaches. Other options are not automatic or not effective: A assigns admin role but doesn't auto-clean, B relies on manual intervention via Copilot, C is manual and not automatic.

Answer

Assign the Environment Admin role to all makers so they can delete their own environments.

Answer

Use the Power Platform Copilot to identify unused environments.

Answer

Manually review environments each month.

Question 13

An organization has multiple Power Platform environments and wants to enforce consistent data loss prevention (DLP) policies across all environments. Which THREE steps should the administrator take?

Accepted Answer

Create a DLP policy at the tenant level with the desired default rules.. To enforce consistent DLP policies across multiple environments, the administrator should create a DLP policy at the tenant level (C) to set default rules, assign policies explicitly to each environment (D) to override any conflicting defaults, and use DLP policy profiles (E) to define different policies for various environment types (e.g., production, development). Option A is incorrect because removing existing environment-level policies is not necessary; they can be overridden by explicit assignments. Option B is incorrect because audit logging tracks violations but does not enforce policies.

Answer

Remove all existing environment-level DLP policies.

Answer

Enable audit logging to track DLP policy violations.

Question 14

You are the Power Platform administrator for a large multinational corporation. The company has a single Microsoft Entra ID tenant with users in North America, Europe, and Asia. Due to data residency regulations, each region must store its data within its geographic boundaries. The company has three production environments: NA-Prod (East US), EU-Prod (West Europe), and ASIA-Prod (Southeast Asia). Each production environment has a corresponding sandbox environment for development. Recently, the security team discovered that a developer in Europe accidentally accessed customer data from the NA-Prod environment by using a connection reference that pointed to the North American Dataverse instance. To prevent cross-region data access, you need to implement a solution that blocks any Power Automate flow or Power Apps canvas app from connecting to Dataverse instances in other regions. You must also ensure that developers can still use non-Dataverse connectors (e.g., SharePoint, Office 365) that may be global. What should you do?

Accepted Answer

Create environment-level DLP policies that block the Dataverse connector in each environment, then add the Dataverse connector back as a business connector only for the local instance using endpoint filtering.. Environment-level DLP policies can block the Dataverse connector, and using endpoint filtering allows you to whitelist only the local Dataverse instance, preventing cross-region connections while still enabling non-Dataverse connectors. Option B is incorrect because Microsoft Entra ID Conditional Access policies control user authentication and access to applications, not the connections used by Power Automate flows or Power Apps. Option C is incorrect because a tenant-level DLP policy that blocks the Dataverse connector would prevent all environments from using Dataverse entirely, including legitimate local usage. Option D is incorrect because audit logging and notification flows only detect and report cross-region access after it occurs; they do not block it.

Answer

Use Microsoft Entra ID Conditional Access policies to block cross-region access to Dataverse.

Answer

Create a tenant-level DLP policy that blocks the Dataverse connector for all environments.

Answer

Enable audit logging and create a Power Automate flow to notify administrators when cross-region access is detected.

Question 15

You are a Power Platform administrator for a medium-sized business. The company uses Power Apps and Power Automate extensively. The development team has requested the ability to create their own sandbox environments for testing without waiting for IT. However, the security team requires that all environments be subject to data loss prevention (DLP) policies and that environment creation be tracked. You need to design a solution that allows developers to self-service environment creation while maintaining governance. The developers currently have Power Apps Plan 2 licenses. What should you do?

Accepted Answer

Create a security group in Microsoft Entra ID, add developers, and configure tenant settings to allow only members of that group to create environments. Enable audit logging.. The requirement is self-service environment creation for developers while maintaining governance (DLP policies and audit tracking). Creating a Microsoft Entra ID security group, adding the developers, and configuring tenant settings to allow only that group to create environments satisfies self-service, and enabling audit logging satisfies the tracking requirement. DLP policies apply tenant-wide to all environments, so governance is preserved.

Answer

Assign the Power Platform Administrator role to all developers.

Answer

Disable environment creation for non-admins and have developers submit requests to IT.

Answer

Install the CoE Starter Kit and configure the environment creation policy to allow all users.