PL-900 Practice Question: Manage the Microsoft Power Platform environment
A hospital uses Power Apps to manage patient intake forms. The app stores data in Microsoft Dataverse. The security policy requires that patient health information (PHI) be encrypted at rest and in transit. The environment is already configured with default Dataverse settings. The IT admin needs to ensure compliance. What should the admin do?
⚠ Common exam trap
PL-900 often tests the misconception that encryption must be manually enabled in Power Platform services, when in fact Dataverse encrypts data at rest and in transit by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No further action is needed; Dataverse encrypts data at rest and in transit by default.
Microsoft Dataverse encrypts all data at rest using SQL Server Transparent Data Encryption (TDE) and AES-256, and encrypts data in transit using TLS 1.2 or higher by default. Because the environment already uses default Dataverse settings, the encryption-at-rest and in-transit requirements for PHI are already satisfied without any additional configuration. Customer-managed keys are an optional compliance enhancement, not a baseline requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable customer-managed encryption keys for Dataverse.
Why it's wrong here
Customer-managed keys change who controls the at-rest encryption key, not whether encryption exists; Dataverse already encrypts at rest and in transit by default, so this adds no compliance. It is tempting because CMK genuinely satisfies key-custody regulations, and would be correct where policy demands the organisation own and rotate its own keys.
- ✓
No further action is needed; Dataverse encrypts data at rest and in transit by default.
Why this is correct
Microsoft Dataverse encrypts data at rest using transparent data encryption and secures data in transit with TLS by default, so the existing environment already satisfies the PHI encryption policy. No additional configuration is required to meet the stated compliance requirement.
- ✗
Configure a VPN for all access to the environment.
Why it's wrong here
A VPN secures the network path a client takes to reach the environment, but does nothing for Dataverse storage encryption, which the policy also requires. It is tempting because VPNs genuinely protect data in transit, and would be correct for unmanaged remote clients accessing the environment over untrusted networks.
- ✗
Use Power Automate to encrypt data before storing it in Dataverse.
Why it's wrong here
Power Automate encrypts only the payload it processes in a flow, leaving Dataverse storage and the client connection untouched, so neither at-rest nor in-transit requirements are met. It is tempting because flows genuinely transform and protect data moving between systems, which suits custom field-level obfuscation rather than platform encryption.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PL-900 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This PL-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-900 exam.