PL-900 Manage the Microsoft Power Platform environment Practice Test 7 — 15 Questions

Question 1

A financial services firm uses Power Platform in a highly regulated environment. They have a production environment that contains sensitive customer data. The compliance officer requires that all changes to apps and flows in production be approved before deployment. The development team uses a separate sandbox environment. The admin needs to implement a change management process that ensures only approved solutions are deployed to production. What should the admin do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Managed Environments for the production environment and configure the deployment pipeline with approval gates.. Managed Environments in Power Platform provide governance features such as solution checker enforcement, sharing limits, and deployment pipeline integration. Configuring the deployment pipeline with approval gates ensures that a designated approver must sign off before a solution is promoted from the sandbox to production, satisfying the compliance requirement for pre-deployment approval. This is the only option that directly enforces an approval workflow at the deployment stage.

Answer

Use Power Automate approval flows to send notifications when a change is made.

Answer

Restrict permissions so only the admin can deploy solutions to production.

Answer

Manually review and approve changes by checking version history in the sandbox.

Question 2

A retail company uses Power Platform for inventory and sales apps. They have multiple environments: Development, Test, and Production. The Development environment is running low on storage capacity due to many test records. The admin needs to free up storage without affecting the Test and Production environments. The admin also wants to maintain data integrity for ongoing development. What should the admin do?

Accepted Answer

Reset the Development environment using the Admin Center.. Resetting the Development environment using the Admin Center removes all data and configuration while preserving the environment itself, freeing storage without touching Test or Production. Because Development is used for ongoing work, the team can re-provision or re-import solutions and test data as needed, and the reset does not affect other environments. This is the cleanest way to reclaim storage while maintaining isolation.

Answer

Delete the Development environment and create a new one.

Answer

Increase the storage capacity of the Development environment by purchasing add-ons.

Answer

Manually delete all test records from the Dataverse database.

Question 3

A Power Platform administrator needs to ensure that all new canvas apps created by makers in the 'Sales' environment use only the Salesforce connector and cannot use any other connectors. The administrator has already created a data loss prevention (DLP) policy at the tenant level. What should the administrator do to meet this requirement?

Accepted Answer

In the Power Platform admin center, edit the DLP policy to put the Salesforce connector in the Business group and put all other connectors in the Blocked group, then add the 'Sales' environment to the policy.. Data loss prevention policies in Power Platform allow administrators to classify connectors into Business, Non-Business, or Blocked groups. By placing the Salesforce connector in the Business group and all other connectors in the Blocked group, and then applying the policy to the 'Sales' environment, the administrator ensures that makers can only use Salesforce. This is the correct method to restrict connectors per environment.

Answer

Use PowerShell to run the Set-AdminPowerAppEnvironmentConnector command to restrict connectors in the 'Sales' environment.

Answer

Add the Salesforce connector to the Business group and block all other connectors in the DLP policy, then scope the policy to the 'Sales' environment.

Answer

Create a custom connector that wraps the Salesforce API and only allow that custom connector in the environment.

Question 4

A Power Platform administrator has been asked to allow a specific user, Sam, to sign in to the Power Platform admin center and manage environments, but Sam should not be able to modify tenant-wide settings or manage user licenses. What should the administrator do?

Accepted Answer

Assign Sam the Environment Admin role for the specific environment(s) in the Power Platform admin center.. The Environment Admin role is designed to delegate management of specific environments without granting tenant-wide privileges. It allows the user to sign in to the Power Platform admin center and perform administrative tasks only for the environments they are assigned to. This satisfies the requirement while adhering to least privilege, unlike tenant-level roles such as Power Platform Administrator or Global Administrator.

Answer

Assign Sam the Dynamics 365 Administrator role in Microsoft Entra ID.

Answer

Assign Sam the Global Administrator role in Microsoft Entra ID.

Answer

Assign Sam the Power Platform Administrator role in Microsoft Entra ID.

Question 5

A company's Power Platform administrator needs to ensure that all new Power Apps and Power Automate flows created in a specific environment can connect only to the Microsoft Dataverse connector and the Office 365 Outlook connector. All other connectors must be blocked. What should the administrator configure?

Accepted Answer

Create a data loss prevention (DLP) policy for the environment that includes only the Dataverse and Office 365 Outlook connectors in the Business group, and set the default classification to Blocked.. DLP policies classify connectors into Business, Non-business, and Blocked groups. When the default classification is set to Blocked, any connector not explicitly allowed is blocked. Adding only the Dataverse and Office 365 Outlook connectors to the Business group and leaving all others unclassified (thus blocked) enforces the strictest control, ensuring users can only connect to those two services.

Answer

Use Power Automate to create a flow that monitors new apps and flows and disables them if they use unapproved connectors.

Answer

Set the environment's 'Connector access' setting to 'Only selected connectors' and choose Dataverse and Office 365 Outlook.

Answer

Modify the environment security role to allow only the Dataverse and Office 365 Outlook connectors.

Question 6

A company has a Power Platform environment named Sales-Prod that is used by the sales team. The administrator needs to give a new sales manager the ability to sign in to the environment and use apps, but must not grant administrative rights. Which security role should the administrator assign to the new manager in the Power Platform admin center?

Accepted Answer

Basic User. The Basic User security role is designed for individuals who need to use apps and data within an environment but do not need to administer or customize it. Assigning this role to the new sales manager provides the necessary access while adhering to the principle of least privilege. Administrative roles such as System Administrator or System Customizer would grant excessive permissions beyond the stated requirement.

Answer

Environment Maker

Answer

System Customizer

Answer

System Administrator

Question 7

A Power Platform administrator needs to prevent makers in the default environment from using the Twitter connector together with the Microsoft Dataverse connector in the same app or flow. The administrator has already created a data loss prevention (DLP) policy and assigned it to the default environment. Which configuration should the administrator perform next?

Accepted Answer

Add the Twitter connector to the Business group and the Dataverse connector to the Non-Business group in the DLP policy.. Data loss prevention policies in Power Platform group connectors into Business, Non-Business, and Blocked categories. Connectors in different groups cannot be used together in the same app or flow. To prevent only the combination of Twitter and Dataverse, the administrator must place them in separate groups, such as Business and Non-Business, while leaving both connectors available for other scenarios.

Answer

Add the Twitter connector and the Dataverse connector to the Blocked group in the DLP policy.

Answer

Create a separate DLP policy that blocks all connectors, and apply it only to the default environment.

Answer

Add both connectors to the Business group and set the policy to audit-only mode.

Question 8

A Power Platform administrator for a consulting firm needs to ensure that a newly created environment used for a client project is not visible in the environment picker to makers who are not part of the project team. The environment is already provisioned. What should the administrator do?

Accepted Answer

In the Power Platform admin center, configure the environment's security group to include only the project team, then assign the Environment Maker security role to that group.. Assigning a security group to an environment is the supported method to limit environment visibility and access to a specific set of users. When a security group is assigned, only members of that group can see and use the environment. This directly meets the requirement to hide the environment from makers who are not part of the project team.

Answer

In the Power Platform admin center, change the environment type from Production to Sandbox.

Answer

In the Power Platform admin center, enable the 'Restrict maker access' setting for the environment and add the project team as allowed users.

Answer

In the Power Platform admin center, set the environment's region to a different geography than the one used by other makers.

Question 9

A company has a Power Platform environment that contains several Power Apps and Power Automate flows. The administrator needs to ensure that all data connections used by these resources are audited for compliance. What should the administrator do?

Accepted Answer

Enable Microsoft Purview audit logging for the environment.. Microsoft Purview audit logging is the built-in mechanism for recording user and admin activities in Power Platform, including connection creation, modification, and usage. Enabling it ensures that all data connections are audited and can be reviewed for compliance. Other options either do not provide auditing, are too broad, or are manual workarounds that lack completeness.

Answer

Assign the Power Platform Administrator role to the environment owner.

Answer

Configure a data loss prevention (DLP) policy for the environment.

Answer

Create a Power Automate flow that logs connection details to a SharePoint list.

Question 10

A Power Platform administrator needs to ensure that all new Power Apps canvas apps created in the 'Sales' environment are automatically shared with the 'Sales Support' Microsoft Entra ID security group. The administrator wants to avoid manual sharing for each app. What is the most efficient way to achieve this?

Accepted Answer

Use the Power Platform admin center to set the environment's security group to 'Sales Support' and enable the 'Share with everyone in the environment' setting.. The requirement is to automatically share new canvas apps with a specific security group. The Power Platform admin center provides an environment setting to share apps with everyone in the environment, and you can scope that environment to a security group. This native feature eliminates manual or custom automation, ensuring immediate access for group members. It is the most efficient and supported method.

Answer

Assign the 'Sales Support' security group as an environment Maker and set the environment's default app sharing settings.

Answer

Configure a Power Automate cloud flow that triggers when a new app is created and adds the security group as a co-owner.

Answer

Create a Power Apps management connector flow that runs on a schedule and shares all new apps with the security group.

Question 11

A Power Platform administrator needs to ensure that all new Power Automate cloud flows created by makers in a specific environment are automatically shared with the security group 'FlowAuditors' for compliance review. The administrator wants this to apply only to that environment, not tenant-wide. What should the administrator do?

Accepted Answer

In the Power Platform admin center, select the environment, go to Settings > Product > Privacy + Security, and enable 'Share new flows with security group'.. The correct setting is found in the Power Platform admin center under the specific environment's Settings > Product > Privacy + Security. Enabling 'Share new flows with security group' allows an administrator to designate a security group that will be automatically added as a co-owner to every new cloud flow created in that environment. This is scoped to the environment, satisfying the requirement without tenant-wide impact.

Answer

Assign the 'FlowAuditors' group the Environment Maker role in the environment, which automatically grants them access to all flows.

Answer

Use the Power Automate admin center to create a data loss prevention policy that includes the 'FlowAuditors' group as a shared owner.

Answer

Create a Power Automate flow that triggers on new flow creation and adds the 'FlowAuditors' group as an owner using the Power Automate Management connector.

Question 12

A Power Platform administrator is configuring a new environment. The organization requires that the environment's data be stored in a specific geographic region and that all users be able to access the environment from any device without additional licensing. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Verify that users have the necessary Power Apps or Power Automate licenses assigned.. Data residency is controlled by selecting the appropriate region when the environment is created. Device-agnostic access is achieved by ensuring users have valid Power Apps or Power Automate licenses, as the platform is accessible via web and mobile clients without additional environment-specific settings. Assigning excessive roles or tenant-wide availability does not fulfill the stated requirements.

Answer

Assign the 'Environment Maker' security role to all users who need access.

Answer

Ensure that the environment is not tied to a specific security group and is available to all users in the tenant.

Answer

Enable the 'Mobile access' setting in the environment's security settings.

Question 13

A Power Platform administrator for Contoso needs to give a newly hired automation developer the ability to create and manage Power Automate cloud flows inside the existing 'Finance-Prod' environment, without granting any tenant-wide administrative rights. The developer already has a Power Apps Premium license. What should the administrator assign?

Accepted Answer

Assign the Environment Maker security role within the Finance-Prod environment.. Authoring cloud flows inside a specific environment is controlled by environment-scoped Dataverse security roles, and Environment Maker is the least-privilege role that allows creating flows, apps, and connections there. Tenant-wide roles such as Power Platform Administrator and full environment roles such as System Administrator grant far more control than the task requires. An additional license does not substitute for environment-level permissions.

Answer

Assign the Power Automate per-user plan license to the developer.

Answer

Assign the System Administrator security role in the Finance-Prod environment.

Answer

Assign the Power Platform Administrator role in Microsoft Entra ID.

Question 14

A Power Platform administrator in a regulated bank must ensure that every new environment created in the tenant inherits a specific set of data loss prevention policies and that only members of a designated security group can create environments. Which combination of controls achieves this with the least administrative effort?

Accepted Answer

Create a tenant-level DLP policy and set the environment creation permission to only specific users in the Power Platform admin center tenant settings. Tenant-level data loss prevention policies are scoped to the whole tenant and automatically apply to environments created afterward, which removes the need to touch each environment. Combining that with the tenant setting that limits who may create environments to a specific security group enforces both the policy inheritance and the creation restriction in one place.

Answer

Create a tenant-level DLP policy and assign the Environment Maker role only to the designated security group

Answer

Create an environment-level DLP policy in each environment and remove the Environment Maker role from all users

Answer

Create a tenant-level DLP policy and configure a Microsoft Entra Conditional Access policy that blocks the Power Platform admin center

Question 15

A Power Platform administrator is configuring a data loss prevention (DLP) policy for a new environment. The policy must allow the 'SharePoint' and 'Microsoft Dataverse' connectors to be used together in Power Automate flows, but must block the 'Twitter' connector from being used with any business data connectors. Which DLP policy configuration should the administrator use?

Accepted Answer

Create a DLP policy with two groups: 'Business' containing SharePoint and Dataverse, and 'Blocked' containing Twitter. Assign the policy to the environment.. DLP policies control connector usage by grouping them into Business, Non-Business, or Blocked. To allow SharePoint and Dataverse together, they must be in the same group, typically Business. To block Twitter entirely, it must be placed in the Blocked group. This configuration ensures that Twitter cannot be used in any flow, thus preventing its combination with business data connectors. The other options either allow Twitter in some capacity or use invalid settings.

Answer

Create a DLP policy with one group: 'Business' containing SharePoint, Dataverse, and Twitter. Assign the policy to the environment.

Answer

Create a DLP policy with three groups: 'Business' containing SharePoint and Dataverse, 'Non-Business' containing Twitter, and 'Blocked' empty. Assign the policy to the environment.

Answer

Create a DLP policy with two groups: 'Business' containing SharePoint and Dataverse, and 'Non-Business' containing Twitter, but set the policy to 'Block all non-business connectors'.