PL-900 Manage the Microsoft Power Platform environment Practice Test 8 — 15 Questions

Question 1

A company wants to restrict the ability to create Power Apps and Power Automate flows in the default environment to only a specific security group. What is the recommended approach?

Accepted Answer

Assign the security group to the Environment Maker role for the default environment.. The recommended approach to restrict app and flow creation in the default environment is to assign only the desired security group to the Environment Maker role for that environment. The Environment Maker role grants permissions to create resources like Power Apps and Power Automate flows, and by assigning it exclusively to a security group, you effectively limit creation capabilities to members of that group while removing the role from all other users.

Answer

Create a DLP policy that blocks creation of apps and flows.

Answer

Disable the default environment and create a new one with restricted access.

Answer

Remove the Environment Maker role from all users and add the security group as co-admins.

Question 2

An admin needs to view the capacity add-ons purchased for a tenant, including AI Builder credits. Where should the admin go?

Accepted Answer

Power Platform admin center > Resources > Capacity. The Power Platform admin center is the dedicated management interface for Power Platform resources, including capacity add-ons and AI Builder credits. Under Resources > Capacity, admins can view detailed breakdowns of capacity entitlements, such as database, file, log, and add-on credits like AI Builder service credits. This is the correct location because it provides tenant-level capacity monitoring specific to Power Platform, not general licensing or Azure billing.

Answer

Power Platform admin center > Billing > Licenses

Answer

Microsoft 365 admin center > Billing > Licenses

Answer

Azure portal > Cost Management + Billing

Question 3

A company uses Microsoft Copilot Studio to create a custom copilot. The copilot needs to access customer data stored in a Dataverse table that contains sensitive information. The compliance team requires that data accessed by the copilot must be audited. What should the admin configure?

Accepted Answer

Enable auditing in Microsoft Purview and log copilot interactions.. Microsoft Purview auditing captures detailed logs of user and admin activities, including interactions with custom copilots built in Copilot Studio. By enabling auditing in Purview and logging copilot interactions, the admin can meet the compliance requirement to audit all data accessed by the copilot, ensuring a traceable record of sensitive customer data access.

Answer

Deploy Microsoft Sentinel to monitor copilot behavior.

Answer

Configure a DLP policy to block non-compliant data access.

Answer

Use Copilot Studio analytics to track usage.

Question 4

A Power Platform admin needs to ensure that all environments have a backup policy that automatically creates backups every 24 hours. What is the default backup frequency for Dataverse environments?

Accepted Answer

Every 24 hours. The default backup frequency for Dataverse environments is every 24 hours, which ensures automatic system backups are created daily without requiring manual configuration. This policy applies to all environments, including trial and production, unless a custom backup schedule is explicitly set by an administrator.

Answer

Only for paid environments, there is no default schedule.

Answer

Every 12 hours

Answer

Every 48 hours

Question 5

A user reports they cannot create a new environment in the Power Platform admin center. What is the most likely reason?

Accepted Answer

The user lacks the Global Admin or Power Platform Administrator role.. Creating a new environment in Power Platform requires either the Global Admin or Power Platform Administrator role. The Environment Admin role can manage existing environments but cannot create new ones. Therefore, the most likely reason is that the user lacks the necessary administrative role. Option C correctly identifies the required roles.

Answer

The tenant has insufficient trial capacity.

Answer

The user does not have a Power Apps license.

Answer

The user's network blocks the Power Platform admin center.

Question 6

An organization uses Power Automate flows that connect to Microsoft Teams and SharePoint. They want to ensure that if a flow is accidentally deleted, it can be recovered within 30 days. What should they do?

Accepted Answer

No action needed; deleted flows are automatically retained in the recycle bin for 30 days.. Power Automate automatically retains deleted flows in the recycle bin for 30 days, with no additional configuration required. This built-in recovery mechanism applies to both cloud flows and desktop flows, allowing administrators to restore them within that window without needing backups or export policies.

Answer

Store the flow in a solution and export it regularly.

Answer

Enable version history for the flow.

Answer

Configure a backup policy in the Power Platform admin center.

Question 7

Which TWO actions can a Power Platform admin perform in the Power Platform admin center to manage environments? (Choose two.)

Accepted Answer

Create and delete environments.. Options B and C are correct. A Power Platform admin can create and delete environments and manage environment security roles in the Power Platform admin center. Option A is incorrect because modifying Dataverse table schemas is done in the Power Apps maker portal, not the admin center. Option D is incorrect because assigning Power Apps licenses to users is performed in the Microsoft 365 admin center. Option E is incorrect because creating Microsoft Entra ID security groups is done in the Microsoft Entra admin center.

Answer

Modify Dataverse table schemas.

Answer

Assign Power Apps licenses to users.

Answer

Create Microsoft Entra ID security groups.

Question 8

Which THREE factors determine the capacity limits (database, file, log) of a Power Platform environment? (Choose three.)

Accepted Answer

Environment type (production vs. sandbox). Environment type (production vs. sandbox) directly determines the default capacity limits for database, file, and log storage. Production environments receive higher default entitlements, while sandbox environments are capped at 1 GB of database capacity, ensuring that testing does not consume production resources.

Answer

Number of licensed users in the tenant

Answer

Environment geographic region

Question 9

Which TWO are valid ways to access the Power Platform admin center? (Choose two.)

Accepted Answer

Through the Microsoft 365 admin center under 'All admin centers'. The Microsoft 365 admin center includes a link to 'All admin centers,' which provides direct access to the Power Platform admin center. Option D is correct because the Power Platform admin center can be accessed directly via its dedicated URL, https://admin.powerplatform.com, which is the primary entry point for managing environments, data policies, and settings.

Answer

Through the Power Apps maker portal under 'Admin'

Answer

Through the Microsoft Entra admin center under 'Power Platform'

Answer

Through the Azure portal under 'Power Platform'

Question 10

Refer to the exhibit. A Power Platform admin creates a DLP policy with this JSON configuration. What is the effect?

Accepted Answer

The SharePoint connector is blocked in all production environments.. The JSON configuration sets the SharePoint connector to 'Blocked' with the scope 'Environment', meaning it applies to all production environments. Therefore, the SharePoint connector is blocked in all production environments, including the default one, making option A correct. Option B is incorrect because the policy only blocks the SharePoint connector, not all SharePoint Online and on-premises connectors. Option C is incorrect because the connector is blocked, not restricted to the business data group. Option D is incorrect because the policy applies to all production environments, not just the default environment.

Answer

The policy blocks all SharePoint Online and SharePoint on-premises connectors.

Answer

The SharePoint connector is restricted to the business data group.

Answer

The SharePoint connector is blocked only in the default environment.

Question 11

Refer to the exhibit. An admin runs the PowerShell command and gets the output shown. How many environments are in the tenant?

Accepted Answer

3. The PowerShell cmdlet `Get-AdminPowerAppEnvironment` returns a list of environments in the tenant. The output shows three distinct environment objects (each with a unique `EnvironmentName`), indicating that the tenant contains exactly three environments. The correct answer is B (3).

Answer

1

Answer

4

Answer

6

Question 12

Refer to the exhibit. A Power Platform admin views the capacity of a sandbox environment. Based on the exhibit, which statement is true?

Accepted Answer

The environment is a sandbox and thus has reduced capacity limits.. The exhibit shows a sandbox environment with capacity values that are lower than production defaults. Sandbox environments in Power Platform have reduced capacity limits by design, as they are intended for development and testing, not production workloads. This aligns with the statement that the environment is a sandbox and thus has reduced capacity limits.

Answer

The capacity values are unusually low and may indicate a problem.

Answer

The environment has production-level capacity.

Answer

The capacity cannot be increased with add-ons.

Question 13

A manufacturing company uses Power Automate flows to process inventory updates. The flows use standard connectors. The company needs to ensure that the flows can be run by users in their own context without requiring the flow owner's credentials. Which authentication type should be used for the connections?

Accepted Answer

User-provided credentials. User-provided credentials (option B) are correct because they allow each user who runs the flow to authenticate with their own identity, enabling the flow to execute in the user's context without requiring the flow owner's credentials. This is essential when flows are shared with multiple users and need to respect individual permissions and data access.

Answer

Owner-provided credentials

Answer

Anonymous authentication

Answer

Service principal authentication

Question 14

A company uses Power BI to visualize sales data from Dynamics 365 Sales. A new policy requires that all data must be stored in the US region only. The Power BI tenant is currently in the default region (home region). What should the admin do to comply with the policy?

Accepted Answer

Provision Power BI Premium capacity in the US region. Provisioning Power BI Premium capacity in the US region and assigning workspaces to that capacity enforces data residency in the US. Option A is incorrect because Microsoft Entra ID location does not control Power BI data storage. Option B is incorrect because data classification labels do not enforce physical data location. Option C is incorrect because setting the workspace region is only available with Premium capacity, but without Premium capacity, the workspace region defaults to the tenant home region and cannot be changed.

Answer

Change the Microsoft Entra ID location to US

Answer

Apply a data classification label to restrict storage

Answer

Set the workspace region to US in Power BI settings

Question 15

A global organization has multiple environments in Power Platform. The security team wants to prevent users from sharing canvas apps with external users. What is the most effective way to enforce this restriction?

Accepted Answer

Disable ‘Share with external users’ in the Power Platform admin center tenant settings. Disabling 'Share with external users' in the Power Platform admin center tenant settings is the most direct and comprehensive way to prevent sharing canvas apps with external users across all environments. Option A is incorrect because environment-level sharing settings can be overridden by tenant settings, and external sharing control is at tenant level. Option C is incorrect because assigning a custom security role that denies the 'Share' privilege may not explicitly prevent external sharing and is less comprehensive than the tenant-level setting. Option D is incorrect because DLP policies control connectors and data flows, not sharing permissions, so they do not prevent sharing apps with external users.

Answer

Set environment-level sharing to ‘Only specific security groups’

Answer

Assign a custom security role that denies the ‘Share’ privilege

Answer

Create a Data Loss Prevention (DLP) policy that blocks connectors used by external users