PL-900 Manage the Microsoft Power Platform environment Practice Test 8 — 15 Questions

Question 1

A manufacturing company uses Power Automate flows to process inventory updates. The flows use standard connectors. The company needs to ensure that the flows can be run by users in their own context without requiring the flow owner's credentials. Which authentication type should be used for the connections?

Accepted Answer

User-provided credentials. User-provided credentials (option B) are correct because they allow each user who runs the flow to authenticate with their own identity, enabling the flow to execute in the user's context without requiring the flow owner's credentials. This is essential when flows are shared with multiple users and need to respect individual permissions and data access.

Answer

Owner-provided credentials

Answer

Anonymous authentication

Answer

Service principal authentication

Question 2

A company uses Power BI to visualize sales data from Dynamics 365 Sales. A new policy requires that all data must be stored in the US region only. The Power BI tenant is currently in the default region (home region). What should the admin do to comply with the policy?

Accepted Answer

Provision Power BI Premium capacity in the US region. Option C is correct because Power BI Premium capacity can be assigned to a specific region, ensuring data residency. Option A is wrong because Microsoft Entra ID region does not control Power BI data storage. Option B is wrong because Power BI service itself does not allow per-workspace region selection without Premium. Option D is wrong because data classification labels do not enforce physical data location.

Answer

Change the Microsoft Entra ID location to US

Answer

Apply a data classification label to restrict storage

Answer

Set the workspace region to US in Power BI settings

Question 3

A global organization has multiple environments in Power Platform. The security team wants to prevent users from sharing canvas apps with external users. What is the most effective way to enforce this restriction?

Accepted Answer

Disable ‘Share with external users’ in the Power Platform admin center tenant settings. Option A is correct because the tenant-level setting to block sharing with external users is the most direct and comprehensive control. Option B is wrong because DLP policies do not control sharing permissions. Option C is wrong because environment-level sharing settings can be overridden by tenant settings, and external sharing control is at tenant level. Option D is wrong because assigning a custom security role does not prevent external sharing by default.

Answer

Set environment-level sharing to ‘Only specific security groups’

Answer

Assign a custom security role that denies the ‘Share’ privilege

Answer

Create a Data Loss Prevention (DLP) policy that blocks connectors used by external users

Question 4

A user reports that a Power Automate flow stopped working after a co-owner modified the flow. The user is the original owner. What is the most likely reason for the failure?

Accepted Answer

The co-owner changed the connection references used by the flow. Option B is correct because if the co-owner changed the connection references, the flow may lose access to required data sources or services. Option A is wrong because the original owner still retains ownership. Option C is wrong because co-owners can modify flows. Option D is wrong because flow runs do not require manual approval unless configured.

Answer

The flow requires manual approval to run

Answer

The user lost ownership of the flow

Answer

The co-owner deleted the user's permissions

Question 5

An organization uses Power Apps portals to allow external customers to submit support tickets. The portal uses Microsoft Entra ID for authentication. The security team wants to require multi-factor authentication (MFA) for external portal users. What is the best approach?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires MFA for the portal application. Option B is correct because MFA can be enforced via a Conditional Access policy targeting the portal application. Option A is wrong because turning on MFA for all Entra ID users would affect internal users. Option C is wrong because portal authentication settings do not include MFA enforcement. Option D is wrong because MFA enforcement at the identity provider level is not granular for the portal only.

Answer

Enable MFA for all Microsoft Entra ID users

Answer

Use a third-party identity provider that supports MFA

Answer

Configure MFA in the Power Apps portal authentication settings

Question 6

A company uses Power Virtual Agents (now Copilot Studio) to build a customer service chatbot. The bot needs to securely escalate to a live agent when it cannot resolve the issue. The escalation must pass the conversation context to the agent. What should the bot use?

Accepted Answer

Transfer conversation action. Option C is correct because the 'Transfer conversation' action in Copilot Studio passes context to the next agent. Option A is wrong because HTTP requests do not inherently pass conversation context to a human agent. Option B is wrong because a custom connector is overkill and does not directly manage escalation. Option D is wrong because a Power Automate flow can be used but the built-in transfer action is simpler and designed for this purpose.

Answer

HTTP request to a webhook

Answer

Power Automate flow trigger

Answer

Custom connector for the live agent system

Question 7

A non-profit organization uses Power Platform to manage donor information. The organization wants to ensure that only users in the ‘Donor Managers’ security group can edit records in the ‘Donations’ table. What is the best way to achieve this?

Accepted Answer

Assign a custom security role that grants edit permissions on the Donations table to the security group. Option D is correct because the most direct and secure method to control record-level permissions in Dataverse is to assign a custom security role with specific edit privileges on the Donations table to the 'Donor Managers' security group. This leverages Dataverse role-based security, which governs CRUD operations at the table level, ensuring that only members of that group can edit records without affecting other tables or users.

Answer

Create a DLP policy to restrict edit connectors

Answer

Use a business process flow to require approval

Answer

Share the canvas app only with the security group

Question 8

A company uses Power BI dashboards to monitor real-time production metrics. The dashboards use DirectQuery to a SQL Server database. Users report that the dashboards are slow during peak hours. What is the most effective first step to improve performance?

Accepted Answer

Optimize the SQL queries used in the dataset. Option B is correct because optimizing the source query can reduce the amount of data processed. Option A is wrong because increasing capacity may help but is not the first step. Option C is wrong because switching to Import mode would require scheduled refreshes and is not real-time. Option D is wrong because aggregations are useful but creating them without query optimization may not address the root cause.

Answer

Create aggregations in the dataset

Answer

Increase the Power BI Premium capacity

Answer

Switch the dataset to Import mode

Question 9

A financial services company uses Power Automate to process loan applications. The flow uses the ‘When a new email arrives’ trigger from a shared mailbox. The flow recently stopped working after an admin changed the mailbox permissions. What is the most likely cause?

Accepted Answer

The mailbox connection lost permissions to access the mailbox. Option D is correct because the connection used by the trigger may have been invalidated due to permission changes. Option A is wrong because mailbox size does not affect the trigger if permissions changed. Option B is wrong because license deletion would affect all flows, not just this one. Option C is wrong because flow owner change does not necessarily impact permissions.

Answer

The mailbox exceeded its storage limit

Answer

The flow owner's Power Automate license was deleted

Answer

The flow was transferred to another owner

Question 10

Which TWO actions are necessary to enable AI Builder in a Power Apps environment? (Select 2)

Accepted Answer

Purchase AI Builder credits. Option B is correct because AI Builder requires an add-on license. Option D is correct because AI Builder must be enabled in the environment. Option A is wrong because AI Builder works with standard connectors. Option C is wrong because no Power Automate license is required to use AI Builder in Power Apps. Option E is wrong because DLP policies are not required for AI Builder enablement.

Answer

Install AI Builder connectors

Answer

Create a DLP policy that allows AI Builder

Answer

Assign a Power Automate license to users

Question 11

Which THREE features are available in Power Platform managed environments? (Select 3)

Accepted Answer

Weekly analytics digests. Option A is correct because managed environments support weekly analytics digests. Option B is correct because solution checker integration is a feature. Option D is correct because sharing limits for canvas apps can be configured. Option C is wrong because data policies are part of standard environment management. Option E is wrong because data loss prevention is a separate feature, not exclusive to managed environments.

Answer

Data loss prevention (DLP) policies

Answer

Data policies enforcement

Question 12

Which TWO are valid ways to distribute a Power App to end users? (Select 2)

Accepted Answer

Add the app to Microsoft Teams. Option A is correct because Power Apps can be added directly to Microsoft Teams as a tab or personal app, allowing end users to access the app within the Teams interface without leaving the collaboration environment. This leverages the Teams integration capabilities of Power Apps, which uses the Teams manifest and the Power Apps app for Teams to provide seamless access.

Answer

Email the app as an attachment

Answer

Export the app and send it as a .msapp file

Answer

Publish the app to Microsoft AppSource

Question 13

Refer to the exhibit.

{
  "name": "Environment Usage Report",
  "type": "Power BI report",
  "dataset": {
    "name": "Power Platform Admin View",
    "tables": [
      {
        "name": "Environments",
        "columns": [
          { "name": "EnvironmentName", "dataType": "string" },
          { "name": "TotalActiveUsers", "dataType": "int" },
          { "name": "TotalAppUsage", "dataType": "int" },
          { "name": "TotalFlowRuns", "dataType": "int" }
        ]
      }
    ]
  }
}

An admin runs a report to see total active users per environment. The report shows zero active users for a production environment that is actively used. What is the most likely reason?

Accepted Answer

The environment is not included in the Power Platform Admin View dataset. Option B is correct because the Power Platform Admin View dataset may not include the production environment if it is not an admin-managed environment (e.g., default environment). Option A is wrong because the dataset uses the Admin View, which is designed for admin analytics. Option C is wrong because the report is a Power BI report, not a canvas app. Option D is wrong because the columns are present in the dataset.

Answer

The report uses a canvas app connector that is blocked

Answer

The TotalActiveUsers column is missing from the dataset

Answer

The admin does not have permission to view the dataset

Question 14

Refer to the exhibit.

Get-MgDirectoryRole | Where-Object {$_.DisplayName -eq "Power Platform Administrator"} | Select-Object Id

An admin runs this Microsoft Graph PowerShell command and gets no output. What does this indicate?

Accepted Answer

The Power Platform Administrator role is not activated in the tenant. Option B is correct because the command filters for a role with DisplayName exactly 'Power Platform Administrator', but the actual role name is 'Power Platform Administrator' (case-sensitive). If the command returns no output, the role may not be activated in the tenant. Option A is wrong because no output means no matching role found, not that the admin lacks permissions. Option C is wrong because no output does not indicate no roles exist; it indicates no matching role. Option D is wrong because the command is valid PowerShell.

Answer

The admin does not have permission to run the command

Answer

There are no directory roles in the tenant

Answer

The command syntax is incorrect

Question 15

Refer to the exhibit.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.PowerPlatform/enterprisePolicies",
      "apiVersion": "2021-01-01",
      "name": "myDlpPolicy",
      "location": "eastus",
      "properties": {
        "definition": {
          "$schema": "https://schema.management.azure.com/providers/Microsoft.PowerPlatform/policyDefinitions/2021-01-01/schema.json#",
          "rules": [
            {
              "name": "Block SharePoint",
              "action": "Block",
              "connectors": [
                "shared_sharepointonline"
              ]
            }
          ]
        }
      }
    }
  ]
}

An admin deploys this ARM template to create a DLP policy. After deployment, users report they can still use the SharePoint connector in Power Automate. What is the most likely reason?

Accepted Answer

The resource type should be 'Microsoft.PowerPlatform/dlpPolicies'. Option A is correct because the resource type 'Microsoft.PowerPlatform/enterprisePolicies' is used for creating policies, but the API version and properties may not be correct for DLP policies. The correct resource type for DLP policies is 'Microsoft.PowerPlatform/dlpPolicies'. Option B is wrong because the environment might not have the policy applied, but the template attempts to create a policy. Option C is wrong because the policy is created at the tenant level, not per environment. Option D is wrong because the policy name is set correctly.

Answer

The policy was not applied to the environment where users are working

Answer

The policy name does not match the connector name

Answer

The policy is applied at the tenant level and does not affect individual environments