PL-900 Manage the Microsoft Power Platform environment Practice Test 9 — 15 Questions

Question 1

A company is deploying Microsoft Power Platform to multiple departments. The security team requires that all environment creation be restricted to a specific group of administrators. Which two actions should the Power Platform administrator take?

Accepted Answer

Create a security group in Microsoft Entra ID that includes the allowed administrators.. To restrict environment creation, the administrator should create a security group in Microsoft Entra ID for allowed creators and then configure the tenant settings to restrict creation to that group. Option A is wrong because disabling creation for everyone is too restrictive and not granular. Option B is wrong because assigning the Environment Admin role does not control creation. Option D is wrong because CoE Starter Kit does not restrict creation.

Answer

Disable environment creation for all users in the Power Platform admin center.

Answer

Install the CoE Starter Kit and configure environment creation policies.

Answer

Assign the Environment Admin role to the security group in the Power Platform admin center.

Question 2

A Power Platform administrator needs to ensure that any maker can create environments in the default tenant, but only for development purposes. The administrator wants to enforce a policy that automatically deletes unused environments after 30 days. Which feature should the administrator use?

Accepted Answer

Environment Lifecycle Policies in the Power Platform admin center.. The correct answer is the Environment Lifecycle Policies in the Power Platform admin center, which allow setting deletion policies based on inactivity. Option A is incorrect because DLP policies control connectors, not environment lifecycle. Option B is incorrect because capacity management does not delete environments. Option D is incorrect because the Power Platform API can be used but is not the built-in policy feature.

Answer

Power Platform API to schedule deletion scripts.

Answer

Capacity management in the Power Platform admin center.

Answer

Data Loss Prevention (DLP) policies.

Question 3

A global organization has multiple geographic regions and needs to comply with data residency requirements. Each region must have its own Power Platform environment with data stored locally. What is the recommended approach to manage these environments?

Accepted Answer

Create separate environments for each region within the same tenant.. The correct approach is to create separate environments for each region, as Power Platform supports multiple environments within the same tenant. Option A is incorrect because a single environment cannot enforce data residency for multiple regions. Option B is incorrect because creating a separate tenant per region complicates management and is not recommended. Option D is incorrect because using Microsoft Entra ID groups does not address data residency.

Answer

Use Microsoft Entra ID conditional access policies to enforce data location.

Answer

Create separate tenants for each region.

Answer

Create a single environment and use data policies to restrict data access by region.

Question 4

A company uses Microsoft Power Platform and wants to allow external users (guests) to access a canvas app. The app connects to a Dataverse database that contains sensitive customer information. The security team is concerned about data leakage. What should the administrator do to minimize risk?

Accepted Answer

Create a new environment specifically for external users with only the required data.. The best approach is to create a separate environment for external users and restrict access to only necessary data. Option A is incorrect because disabling sharing altogether prevents the business need. Option B is incorrect because B2B collaboration does not isolate data. Option D is incorrect because DLP policies do not restrict data within Dataverse.

Answer

Disable sharing of the app with external users.

Answer

Add external users as guests in Microsoft Entra ID and grant them access to the existing environment.

Answer

Use DLP policies to block all connectors except the canvas app.

Question 5

A Power Platform administrator receives a report that a user is unable to create a new environment. The user has a Power Apps per user license and is a member of the global admin group. What is the most likely cause?

Accepted Answer

The user does not have a Power Apps Plan 2 license or Environment Creation add-on.. Environment creation requires a Power Apps Plan 2 license or an Environment Creation add-on. Having only a per user license is insufficient. Option A is incorrect because the user has global admin rights. Option C is incorrect because capacity is not the issue. Option D is incorrect because DLP policies do not prevent environment creation.

Answer

The user does not have the Environment Admin role.

Answer

A DLP policy is blocking environment creation.

Answer

The tenant has reached its environment capacity limit.

Question 6

A Power Platform administrator is configuring a data loss prevention (DLP) policy for a production environment. The policy must block the use of the SharePoint connector but allow the use of the SQL Server connector. The administrator creates a policy and assigns it to the environment. However, users can still use the SharePoint connector. What is the most likely reason?

Accepted Answer

A tenant-level DLP policy allows SharePoint and is set to a higher priority.. DLP policies can be set at the tenant level or environment level. If a tenant-level policy allows SharePoint, it overrides the environment-level policy unless the environment policy is set to be more restrictive. Option A is incorrect because the policy was assigned. Option C is incorrect because the user's role does not bypass DLP. Option D is incorrect because policies take effect immediately.

Answer

The policy was not assigned to the correct environment.

Answer

The users have the System Administrator role in the environment.

Answer

The DLP policy has not been saved and published.

Question 7

A company is using Power Automate flows that connect to multiple third-party services. The security administrator wants to ensure that no sensitive data is sent to unauthorized external services. Which feature should be used to enforce this requirement?

Accepted Answer

Create and apply Data Loss Prevention (DLP) policies.. Data Loss Prevention (DLP) policies allow blocking or restricting connectors to prevent data leakage. Option A is incorrect because audit logs only record activity, not prevent it. Option B is incorrect because environment routing does not control connectors. Option D is incorrect because Copilot is an AI assistant, not a security feature.

Answer

Enable audit logging in the Power Platform admin center.

Answer

Configure environment routing rules.

Answer

Use the Power Platform Copilot to monitor flows.

Question 8

A Power Platform administrator wants to delegate the responsibility of managing environments to regional leads without granting them full admin privileges. Which role should the administrator assign?

Accepted Answer

Environment Admin role.. The Environment Admin role allows a user to manage all aspects of a specific environment, including security and settings, without tenant-wide privileges. Option A is incorrect because System Customizer only customizes, not manages. Option C is incorrect because Power Platform Administrator is a tenant-wide role. Option D is incorrect because Dynamics 365 Administrator is broader and not specific to Power Platform environments.

Answer

Dynamics 365 Administrator role.

Answer

System Customizer role.

Answer

Power Platform Administrator role.

Question 9

An organization uses Microsoft Power Platform and wants to implement a governance strategy that automatically blocks the creation of environments in specific regions to comply with company policy. What should the administrator do?

Accepted Answer

Use the Power Platform admin center to define allowed data locations for environment creation.. Power Platform admin center allows setting location policies to restrict environment creation to specific regions. Option A is incorrect because the tenant default region is not a restriction. Option B is incorrect because capacity limits do not block by region. Option D is incorrect because they do not want to allow all regions.

Answer

Create a support ticket with Microsoft to block regions.

Answer

Implement capacity limits that prevent creation in disallowed regions.

Answer

Set the default environment region in tenant settings to the allowed region.

Question 10

The exhibit shows a JSON snippet used to create a Power Platform environment via the Power Platform API. The administrator runs the script but the environment is created with the default language and currency instead of the specified values. What is the most likely reason?

Accepted Answer

The JSON syntax is invalid because of the empty securityGroupId.. The JSON uses "securityGroupId" as an empty GUID (all zeros). The correct property for Dataverse settings is "securityGroupId" but an empty GUID may be interpreted as null, causing the default to be used. However, the more likely issue is that the JSON structure is incorrect: the properties should be nested under "dataverse" properly, but the exhibit shows correct nesting. Another possibility: the API version used does not support these properties. But the most common cause is that the securityGroupId is invalid (empty) and the API ignores the entire dataverse block. Option A is incorrect because the location is correct. Option B is incorrect because the environment name is correct. Option C is incorrect because the syntax is valid.

Answer

The API version used does not support specifying language and currency.

Answer

The environment name "ContosoSales" is already in use.

Answer

The location "eastus" is not a valid Azure region for Power Platform.

Question 11

A Power Platform administrator is planning to implement environment lifecycle management. Which TWO actions should the administrator take to ensure unused environments are automatically cleaned up?

Accepted Answer

Create a Power Automate flow that runs periodically and deletes environments that have not been accessed in 30 days.. Setting an environment retention policy and creating a Power Automate flow to check inactivity are two valid approaches. Option A is not automatic. Option D is not automatic. Option E is not directly related to cleanup.

Answer

Assign the Environment Admin role to all makers so they can delete their own environments.

Answer

Use the Power Platform Copilot to identify unused environments.

Answer

Manually review environments each month.

Question 12

An organization has multiple Power Platform environments and wants to enforce consistent data loss prevention (DLP) policies across all environments. Which THREE steps should the administrator take?

Accepted Answer

Create a DLP policy at the tenant level with the desired default rules.. To enforce consistent DLP policies, create a policy at the tenant level, use policy profiles for different environment types, and assign policies to specific environments. Option D is incorrect because auditing does not enforce. Option E is incorrect because it does not ensure consistency.

Answer

Remove all existing environment-level DLP policies.

Answer

Enable audit logging to track DLP policy violations.

Question 13

Which TWO are valid methods to create a new Power Platform environment?

Accepted Answer

Using the Power Platform admin center web interface.. Environments can be created through the Power Platform admin center and via the Power Platform API. Option B is incorrect because SharePoint is not used. Option C is incorrect because the Teams admin center does not create environments. Option E is incorrect because the Power Apps mobile app does not create environments.

Answer

Using the Microsoft Teams admin center.

Answer

Using the Power Apps mobile app.

Answer

Using the SharePoint admin center.

Question 14

You are the Power Platform administrator for a large multinational corporation. The company has a single Microsoft Entra ID tenant with users in North America, Europe, and Asia. Due to data residency regulations, each region must store its data within its geographic boundaries. The company has three production environments: NA-Prod (East US), EU-Prod (West Europe), and ASIA-Prod (Southeast Asia). Each production environment has a corresponding sandbox environment for development. Recently, the security team discovered that a developer in Europe accidentally accessed customer data from the NA-Prod environment by using a connection reference that pointed to the North American Dataverse instance. To prevent cross-region data access, you need to implement a solution that blocks any Power Automate flow or Power Apps canvas app from connecting to Dataverse instances in other regions. You must also ensure that developers can still use non-Dataverse connectors (e.g., SharePoint, Office 365) that may be global. What should you do?

Accepted Answer

Create environment-level DLP policies that block the Dataverse connector in each environment, then add the Dataverse connector back as a business connector only for the local instance using endpoint filtering.. Data Loss Prevention (DLP) policies can be configured at the environment level to block the Dataverse connector in environments where it is not allowed. However, since each environment needs Dataverse for its own region, you need to create DLP policies that block the Dataverse connector for cross-region connections. But DLP policies block connectors entirely, not specific instances. A better approach is to use environment routing rules to restrict traffic to specific Dataverse instances. Option B is incorrect because DLP policies block the connector entirely. Option C is incorrect because conditional access controls user access but not app connections. Option D is incorrect because audit logs only detect, not prevent.

Answer

Use Microsoft Entra ID Conditional Access policies to block cross-region access to Dataverse.

Answer

Create a tenant-level DLP policy that blocks the Dataverse connector for all environments.

Answer

Enable audit logging and create a Power Automate flow to notify administrators when cross-region access is detected.

Question 15

You are a Power Platform administrator for a medium-sized business. The company uses Power Apps and Power Automate extensively. The development team has requested the ability to create their own sandbox environments for testing without waiting for IT. However, the security team requires that all environments be subject to data loss prevention (DLP) policies and that environment creation be tracked. You need to design a solution that allows developers to self-service environment creation while maintaining governance. The developers currently have Power Apps Plan 2 licenses. What should you do?

Accepted Answer

Create a security group in Microsoft Entra ID, add developers, and configure tenant settings to allow only members of that group to create environments. Enable audit logging.. The best approach is to create a security group in Microsoft Entra ID, add developers to it, and then configure the tenant settings to allow that group to create environments. Additionally, enable audit logging to track creation. Option A is incorrect because assigning the Power Platform Administrator role gives too much privilege. Option B is incorrect because disabling creation for non-admins prevents self-service. Option C is incorrect because the CoE Starter Kit is for governance but does not directly enable self-service creation.

Answer

Assign the Power Platform Administrator role to all developers.

Answer

Disable environment creation for non-admins and have developers submit requests to IT.

Answer

Install the CoE Starter Kit and configure the environment creation policy to allow all users.