PL-900 Demonstrate the capabilities of Power Apps Practice Question
A healthcare organization is developing a Power Apps model-driven app for patient case management. The app uses Microsoft Dataverse as the data source and includes a custom table named 'Patient Cases' with columns: Patient Name, Case Type (choice: Consultation, Procedure, Follow-up), Assigned Doctor, Status (choice: New, In Progress, Completed), and Priority (choice: Low, Medium, High, Critical). The organization requires that when a case is created with Priority = 'Critical', an immediate notification must be sent to the Assigned Doctor via Microsoft Teams and the case must be automatically escalated to the manager if not resolved within 4 hours. Additionally, the app must use a Copilot to summarize patient history when a case is opened. The security team mandates that only doctors and managers can view cases assigned to them, and that all data access must be audited. Which combination of features should you implement to meet all requirements with minimal custom development?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement JavaScript in the form to call Power Automate for notifications, use owner teams to restrict access, add a custom Copilot page, and enable auditing via Power Apps settings.
It uses owner teams to provide record-level security, ensuring that doctors and managers only see cases assigned to them. JavaScript can call a Power Automate flow to send immediate Teams notifications when Priority is Critical, and the flow can implement a 4-hour escalation timer. Adding a custom Copilot page provides patient history summarization. Auditing can be enabled via Power Apps settings. This combination meets all requirements with minimal custom development. Option B is incorrect because field-level security profiles control access to specific fields, not record visibility; they cannot restrict users to only seeing records assigned to them. Option C is incorrect because sharing permissions are not designed for role-based, record-level access control; they are for ad-hoc sharing. Option D is incorrect because business rules cannot trigger notifications or set timers; they are for simple logic within forms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement JavaScript in the form to call Power Automate for notifications, use owner teams to restrict access, add a custom Copilot page, and enable auditing via Power Apps settings.
Why this is correct
Correct: Owner teams restrict access to assigned records, JavaScript calls Power Automate for notifications/escalation, custom Copilot page provides summarization, and auditing is enabled via settings. This uses minimal custom development.
- ✗
Use a Dataverse business process flow to trigger Power Automate flows for notifications and escalation, configure field-level security profiles to restrict data access, enable Copilot in the model-driven app to summarize patient history, and enable audit logging on the Patient Cases table.
Why it's wrong here
Incorrect: Field-level security profiles control field permissions, not record visibility. They cannot ensure that users only see cases assigned to them.
- ✗
Design a Power Automate flow triggered on case creation that sends Teams notifications and waits for 4 hours before escalation, use sharing permissions to control access, and embed a Copilot AI Builder component.
Why it's wrong here
Incorrect: Sharing permissions are for ad-hoc sharing, not for implementing role-based record-level security. Embedding AI Builder Copilot may require custom work.
- ✗
Create business rules to send email notifications and set escalation timers, use role-based security for data access, add a Copilot chat control, and rely on Dataverse default auditing.
Why it's wrong here
Incorrect: Business rules cannot trigger Power Automate flows or set timers; they are limited to simple form logic. Role-based security is correct, but the notification and escalation requirements are not met.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 904 original PL-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PL-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-900 exam.