PL-900 Practice Question: Describe the business value of Microsoft Power Platform
A healthcare organization is deploying Power Apps for patient intake. They must ensure that the app complies with HIPAA regulations. Which feature should they use to protect patient data at rest?
⚠ Common exam trap
Watch out — candidates often confuse data protection features (like MFA, audit logging, or DLP policies) with encryption at rest, assuming any security feature satisfies HIPAA's data-at-rest requirement, but only CMK provides the necessary customer-controlled encryption for stored data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Customer Managed Key (CMK) for the Power Platform environment.
Customer Managed Key (CMK) allows the healthcare organization to control the encryption key used to protect data at rest in their Power Platform environment. This ensures that even Microsoft cannot access the underlying data without the organization's key, which is a critical requirement for HIPAA compliance regarding data encryption at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require multi-factor authentication (MFA) for app users.
Why it's wrong here
MFA secures access, not data at rest.
- ✗
Enable audit logging in the Power Platform admin center.
Why it's wrong here
Audit logs track activities, not encrypt data.
- ✓
Enable Customer Managed Key (CMK) for the Power Platform environment.
Why this is correct
CMK encrypts data at rest with a key the organization controls.
- ✗
Create a Data Loss Prevention (DLP) policy to restrict connectors.
Why it's wrong here
DLP policies control data movement, not encryption.
Go deeper
Related to this question
About these practice questions
One of 904 original PL-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PL-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-900 exam.