Knowledge + Practice

CCNA Manage the Microsoft Power Platform environment Questions

73 of 148 questions · Page 2/2 · Manage the Microsoft Power Platform environment · Answers revealed

Practice these questions Domain overview All questions

76

MCQmedium

A company is using Power Automate flows that connect to multiple third-party services. The security administrator wants to ensure that no sensitive data is sent to unauthorized external services. Which feature should be used to enforce this requirement?

A.Create and apply Data Loss Prevention (DLP) policies.

B.Enable audit logging in the Power Platform admin center.

C.Configure environment routing rules.

D.Use the Power Platform Copilot to monitor flows.

AnswerA

DLP policies can block specific connectors from being used in apps and flows.

Why this answer

Data Loss Prevention (DLP) policies allow blocking or restricting connectors to prevent data leakage. Option A is correct. Option B is incorrect because audit logs only record activity, not prevent it.

Option C is incorrect because environment routing does not control connectors. Option D is incorrect because Copilot is an AI assistant, not a security feature.

Practice this question →

77

MCQmedium

A Power Platform admin needs to ensure that all environments have a backup policy that automatically creates backups every 24 hours. What is the default backup frequency for Dataverse environments?

A.Every 24 hours

B.Only for paid environments, there is no default schedule.

C.Every 12 hours

D.Every 48 hours

AnswerA

Dataverse automatically creates system backups every 24 hours.

Why this answer

The default backup frequency for Dataverse environments is every 24 hours, which ensures automatic system backups are created daily without requiring manual configuration. This policy applies to all environments, including trial and production, unless a custom backup schedule is explicitly set by an administrator.

Exam trap

The trap here is that candidates may assume backups are only for paid environments or that the default frequency is shorter (12 hours) due to common industry practices, but Microsoft's default for Dataverse is explicitly 24 hours across all environment types.

How to eliminate wrong answers

Option B is wrong because the default backup schedule applies to all Dataverse environments, not just paid ones; even trial environments receive automatic backups every 24 hours. Option C is wrong because the default interval is 24 hours, not 12 hours; a 12-hour frequency would require custom configuration. Option D is wrong because the default interval is 24 hours, not 48 hours; a 48-hour frequency would leave a longer gap between backups and is not the default.

Practice this question →

78

MCQmedium

An administrator runs a PowerShell command to check a DLP policy. Based on the output, which connector is allowed to be used in Power Automate flows?

A.Dropbox

B.Google Drive

C.Microsoft Teams

D.Microsoft OneDrive

AnswerC

Teams is in the allowed list.

Why this answer

The PowerShell command output indicates that the DLP policy allows the 'Microsoft Teams' connector, as it is listed in the allowed connector list. DLP policies in Power Platform control which connectors can be used in Power Automate flows, and the output explicitly shows Microsoft Teams as permitted.

Exam trap

The trap here is that candidates may assume all Microsoft-owned connectors (like OneDrive) are automatically allowed in a DLP policy, but the output specifically lists only Microsoft Teams, requiring careful reading of the allowed connectors list.

How to eliminate wrong answers

Option A is wrong because Dropbox is a third-party file storage connector that is typically blocked or restricted in DLP policies unless explicitly allowed, and the output does not list it. Option B is wrong because Google Drive is also a third-party connector that is commonly restricted in enterprise DLP policies, and it is not shown as allowed in the output. Option D is wrong because Microsoft OneDrive, while a Microsoft service, is a separate connector from Microsoft Teams and is not indicated as allowed in the provided output.

Practice this question →

79

MCQhard

An administrator reviews the JSON output from a Power Platform environment. What should the administrator be concerned about based on the data?

A.The Dataverse URL is incorrect

B.The admin email is not configured

C.The API rate limit is approaching its maximum

D.The environment is out of storage

AnswerC

85% usage indicates potential throttling soon.

Why this answer

The JSON output shows the 'RateLimitRemaining' field approaching zero, indicating that the API rate limit is nearly exhausted. Power Platform enforces per-tenant and per-user API limits to ensure fair resource usage, and hitting the limit will throttle or block further API calls, disrupting integrations and automated workflows.

Exam trap

The trap here is that candidates often confuse API rate limit warnings with storage capacity issues, overlooking the 'RateLimitRemaining' field in favor of storage-related fields, because both involve resource exhaustion but affect different operational aspects.

How to eliminate wrong answers

Option A is wrong because the JSON includes a valid 'DataverseUrl' field with a correctly formatted URL, and there is no error or mismatch in the URL structure to indicate an incorrect Dataverse URL. Option B is wrong because the JSON output does not contain any field related to admin email configuration; admin email is typically set in the Power Platform admin center, not exposed in API response JSON. Option D is wrong because the JSON shows storage usage fields (e.g., 'StorageUsed' and 'StorageAvailable') with ample remaining capacity, and no storage exhaustion warning is present.

Practice this question →

80

MCQhard

The exhibit shows a DLP policy configuration for a Power Platform environment. Which connector is allowed for business use?

A.Outlook

B.Twitter

C.Facebook

D.SharePoint

AnswerD

SharePoint is in the Business data group under this DLP policy, so it is allowed for business use.

Why this answer

SharePoint is classified as 'Business' in the DLP policy because it is a Microsoft-owned enterprise service that supports data loss prevention (DLP) actions like blocking, monitoring, or restricting data flow. The exhibit shows SharePoint under the 'Business' data group, meaning it is allowed for business use without triggering policy violations. In contrast, Outlook, Twitter, and Facebook are placed in the 'Non-Business' group, which blocks their connectors from being used in apps and flows within this environment.

Exam trap

The trap here is that candidates assume all Microsoft-owned connectors (like Outlook) are automatically 'Business' by default, but DLP policies are environment-specific and can be customized by administrators to reclassify connectors into Non-Business groups.

How to eliminate wrong answers

Option A is wrong because Outlook is listed under the 'Non-Business' data group in the exhibit, which means its connector is blocked for business use. Option B is wrong because Twitter is also in the 'Non-Business' group, preventing its connector from being used in business flows. Option C is wrong because Facebook is likewise categorized as 'Non-Business', so its connector is disallowed for business purposes.

Practice this question →

81

MCQhard

A large enterprise uses Power Platform with multiple environments. They need to enforce a policy that blocks all Canvas apps from using the 'Twitter' connector, but only in the 'Production' environment. What should the administrator do?

A.Create a DLP policy at the tenant level and set the 'Twitter' connector to 'Blocked'

B.Disable the 'Twitter' connector in the Power Platform admin center for the Production environment

C.Create an environment-level DLP policy for the Production environment and set 'Twitter' to 'Blocked'

D.Use the 'Set Connector' API to disable the connector for the Production environment

AnswerC

An environment-level DLP policy can block specific connectors in a specific environment.

Why this answer

Environment-level DLP policies allow administrators to apply connector restrictions to specific environments, such as blocking the 'Twitter' connector only in 'Production' while leaving it available in other environments. This granular control is essential for enforcing governance without affecting development or testing environments.

Exam trap

The trap here is that candidates may assume tenant-level policies are the only option or that connectors can be disabled directly in the admin center, but the correct approach requires understanding that environment-level DLP policies provide the necessary granularity.

How to eliminate wrong answers

Option A is wrong because a tenant-level DLP policy applies to all environments, not just the 'Production' environment, which would block the 'Twitter' connector everywhere. Option B is wrong because the Power Platform admin center does not provide a direct toggle to disable a specific connector per environment; connector blocking is managed through DLP policies, not a simple disable switch. Option D is wrong because the 'Set Connector' API is not a supported method for disabling connectors in Power Platform; DLP policies are the intended mechanism for controlling connector usage.

Practice this question →

82

Multi-Selecthard

Which THREE components are included in a Power Platform environment?

Select 3 answers

A.Power BI workspaces

B.Dataverse database

C.Microsoft 365 groups

D.Power Apps

E.Power Automate flows

AnswersB, D, E

Dataverse is a core component of environments.

Why this answer

A Dataverse database (Option B) is a core component of a Power Platform environment because it provides the underlying data storage and management layer for apps, flows, and bots. Without a Dataverse database, many environment features like custom tables, relationships, and security roles are unavailable. This makes it a fundamental building block for any environment that needs structured data persistence.

Exam trap

Candidates often mistakenly think that Power BI workspaces are part of the Power Platform environment, but in reality, Power BI workspaces are separate and managed through the Power BI admin portal, not the Power Platform admin center.

Practice this question →

83

MCQeasy

Refer to the exhibit. An administrator deploys this ARM/Bicep template to create a new Power Platform environment. What type of environment will be created?

A.Developer environment

B.Trial environment

C.Production environment

D.Sandbox environment

AnswerD

The environmentSku is set to 'Sandbox'.

Why this answer

The ARM/Bicep template sets the 'environmentSku' property to 'Sandbox', which directly specifies the environment type as a Sandbox environment. Sandbox environments are non-production instances used for development, testing, and training, isolated from production data and workloads.

Exam trap

The trap here is that candidates may confuse 'Sandbox' with 'Developer' or 'Trial' environments, as all three are non-production types, but the ARM/Bicep template's explicit 'environmentSku' value of 'Sandbox' uniquely identifies the environment type, and the exam tests the ability to distinguish between these SKUs based on the template syntax.

How to eliminate wrong answers

Option A is wrong because a Developer environment is a specific type of Power Platform environment that is created for individual developers with a limited capacity and is not defined by the 'Sandbox' SKU in the template. Option B is wrong because a Trial environment is a temporary environment with a fixed expiration date, typically created through the Power Platform admin center or trial offers, not by specifying 'Sandbox' in an ARM/Bicep template. Option C is wrong because a Production environment is the default environment type when no specific SKU is provided or when 'Production' is explicitly set, but the template explicitly sets 'environmentSku' to 'Sandbox', overriding the default.

Practice this question →

84

MCQmedium

The exhibit shows a PowerShell command and its output. What does the EnvironmentState value indicate?

A.The environment is active and can be used

B.The environment is pending creation

C.The environment is disabled

D.The environment has a provisioning error

AnswerA

'Enabled' means the environment is active.

Why this answer

The EnvironmentState value displayed in the PowerShell output indicates that the environment is active and can be used. This status confirms that the environment is fully provisioned and available for hosting apps, flows, and other resources in the Microsoft Power Platform.

Exam trap

The trap here is that candidates may confuse 'Ready' with other states like 'PendingCreation' or 'Disabled', assuming any non-error state means the environment is usable, but only 'Ready' confirms full provisioning and availability.

How to eliminate wrong answers

Option B is wrong because 'PendingCreation' is a separate state that appears when an environment is still being provisioned, not when it is already showing 'Ready'. Option C is wrong because a disabled environment would show a state like 'Disabled' or 'NotReady', not 'Ready'. Option D is wrong because a provisioning error would result in a state like 'ProvisioningFailed' or 'Error', not 'Ready'.

Practice this question →

85

MCQmedium

A company is deploying Power Virtual Agents (now Copilot Studio) chatbots across multiple departments. Each department needs its own environment to manage chatbots independently. However, the company wants to share a common set of entities and workflows across all environments. Which approach should the administrator take?

A.Create a single environment for all departments and use security roles to isolate chatbots

B.Use Power Apps component library to share components across environments

C.Create a shared environment for common components and link each department environment to it

D.Create a separate environment per department and deploy managed solutions containing the common components

AnswerD

Managed solutions enable standardized deployment across environments.

Why this answer

Managed solutions allow you to package common components (entities, workflows) and deploy them to multiple environments, ensuring consistency while maintaining departmental isolation. Each department gets its own environment for independent chatbot management, and the shared components are installed via managed solutions that cannot be modified, preserving the common baseline.

Exam trap

The trap here is that candidates confuse environment-level isolation with component sharing, assuming a single environment with security roles or a linked environment is sufficient, when the correct pattern requires deploying managed solutions to each environment.

How to eliminate wrong answers

Option A is wrong because using a single environment with security roles does not provide true isolation for chatbot management; security roles control data access but not component-level separation, and all chatbots would share the same entities and workflows, leading to potential conflicts. Option B is wrong because Power Apps component libraries are designed for sharing UI components (e.g., controls, screens) across canvas apps, not for deploying backend entities or workflows across environments. Option C is wrong because Power Platform does not support linking environments to a shared environment for common components; the correct mechanism is to use managed solutions to deploy components into each environment, not a runtime link.

Practice this question →

86

MCQmedium

A global company with offices in multiple regions wants to ensure that Power Automate flows processing sensitive customer data are only executed in specific geographic regions to comply with data residency requirements. What should the administrator configure?

A.Data loss prevention (DLP) policies

B.Audit log settings

C.Solution checker

D.Environment routing rules

AnswerA

DLP policies control data movement and connector usage.

Why this answer

Data loss prevention (DLP) policies can be applied to environments in specific geographic regions to restrict connectors and data flow, ensuring that sensitive data is processed only in allowed regions. Environment routing rules do not exist as a feature in Power Platform. Audit logs only record events, not enforce residency.

Solution checker analyzes solutions for code issues, not data residency.

Practice this question →

87

MCQmedium

An administrator configures a Data Loss Prevention (DLP) policy with the scope set to 'All environments' and places selected connectors in the 'Blocked' group. What will be the result of this policy?

A.The connectors are allowed but audited

B.The connectors are blocked only in production environments

C.The connectors are blocked in all environments

D.The connectors are blocked except for the default environment

AnswerC

Correct. The policy scope is 'All environments' and the connectors are blocked, meaning they cannot be used in any environment.

Why this answer

The DLP policy is configured with the scope set to 'All environments' and the selected connectors are in the 'Blocked' group. Therefore, these connectors are blocked in every environment, including production and non-production. Option A is incorrect because audit mode is not enabled; the connectors are blocked, not audited.

Option B is incorrect because the policy applies to all environments, not just production. Option D is incorrect because there is no exception for the default environment—the policy applies universally.

Exam trap

Candidates often confuse the scope of DLP policies. A policy applied to 'All environments' affects every environment, including the default environment. The configuration clearly sets the scope to 'All environments' and the connectors are in the 'Blocked' group.

Practice this question →

88

MCQmedium

Refer to the exhibit. The JSON policy shown fails to apply to the production environment. What is the most likely reason?

A.The connector IDs should include the full path with 'shared_twitter' and 'shared_facebook', which they do.

B.The action value should be 'Block' with a capital B, but the JSON uses 'Block' which is correct.

C.The JSON uses 'environment' as a key instead of 'environments'.

D.The policy name is missing a required prefix.

AnswerC

The correct key is 'environments' (plural) for the array of environment names.

Why this answer

The JSON policy uses 'environment' as a key, but the correct key in Microsoft Power Platform DLP (Data Loss Prevention) policy JSON schema is 'environments' (plural). This mismatch causes the policy to fail validation and not apply to the production environment, as the platform expects an array of environment IDs under the 'environments' key.

Exam trap

The trap here is that candidates may focus on the connector IDs or action values, which appear correct, and overlook the subtle but critical difference between 'environment' and 'environments' in the JSON key, a classic schema validation pitfall in Power Platform DLP policies.

How to eliminate wrong answers

Option A is wrong because the connector IDs in the exhibit do not include the full path with 'shared_twitter' and 'shared_facebook'; they are missing the 'shared_' prefix, which is required for connector references in Power Platform DLP policies. Option B is wrong because the action value 'Block' is correctly capitalized and valid; the issue is not with the action value but with the key name. Option D is wrong because Power Platform DLP policies do not require a specific prefix in the policy name; the name is arbitrary and does not affect policy application.

Practice this question →

89

MCQmedium

An organization wants to ensure that all Power Platform solutions in production environments are tracked and changes are approved. What should the administrator implement?

A.Data Loss Prevention (DLP) policies

B.Environment security groups

C.Disable the 'Create personal productivity environments' setting

D.Managed solutions with application lifecycle management (ALM)

AnswerD

Managed solutions and ALM provide controlled deployment and change tracking.

Why this answer

Managed solutions with application lifecycle management (ALM) ensure that all Power Platform solutions in production environments are tracked and changes are approved by enforcing version control, solution layering, and controlled deployment through environments. This approach uses solution components and environment segmentation to prevent unapproved modifications and maintain an audit trail.

Exam trap

The trap here is that candidates often confuse DLP policies or security groups with change management, but only managed solutions with ALM provide the structured tracking and approval workflow required for production governance.

How to eliminate wrong answers

Option A is wrong because Data Loss Prevention (DLP) policies control data flow between connectors and prevent data exfiltration, but they do not track or approve changes to solutions. Option B is wrong because environment security groups manage user access and permissions to environments, not the tracking or approval of solution changes. Option C is wrong because disabling the 'Create personal productivity environments' setting only prevents users from creating their own environments, but does not enforce change tracking or approval for production solutions.

Practice this question →

90

MCQmedium

A company uses Power BI to create reports from Dataverse data. The administrator needs to ensure that report creators can only see data from tables they have access to in Dataverse. Which security feature should the administrator configure?

A.Set environment security group to include only report creators

B.Configure table-level permissions in Dataverse

C.Define row-level security (RLS) roles in Power BI and map them to Dataverse roles

D.Assign the 'Environment Maker' role to report creators

AnswerC

RLS restricts data visible to each user in the report.

Why this answer

Row-level security (RLS) in Power BI can be used to restrict data access at the row level, and by mapping Power BI RLS roles to Dataverse roles, report creators will only see data from tables they have access to in Dataverse. Option A is wrong because environment security group controls access to the environment, not data within reports. Option B is wrong because table-level permissions in Dataverse control access to the table itself, but when using Power BI to report on Dataverse data, the data is imported or queried; RLS in Power BI is needed to enforce row-level restrictions.

Option D is wrong because the Environment Maker role allows creating resources in the environment but does not restrict data visibility in reports.

Practice this question →

91

Multi-Selectmedium

A company wants to enforce data loss prevention (DLP) policies for Power Automate flows. Which TWO actions can the administrator perform?

Select 2 answers

A.Allow users to bypass DLP policies with administrator approval

B.Block specific connectors from being used in flows

C.Create a custom DLP policy for a specific environment

D.Assign DLP policies to specific users

E.Inherit the tenant-level DLP policy for all environments

AnswersB, C

Blocking connectors is a common DLP action.

Why this answer

Administrators can block specific connectors from being used in Power Automate flows as part of a DLP policy, preventing data from being shared with unauthorized services. Option C is correct because DLP policies can be scoped to a specific environment, allowing granular control over connector usage within that environment. This enables the administrator to enforce data protection rules tailored to different business contexts.

Exam trap

The trap here is that candidates often confuse environment-level DLP policy assignment with user-level assignment, or assume that tenant-level policies are automatically inherited by all environments, when in fact each environment can have its own independent DLP policy.

Practice this question →

92

MCQmedium

An organization uses Microsoft Power Platform and wants to enforce data loss prevention (DLP) policies across all environments. They need to block the use of a specific third-party connector in all environments. What should the administrator do?

A.Create a DLP policy for each environment and block the connector

B.Create a custom connector with the same name and block it

C.Remove the connector from the default solution

D.Create a tenant-level DLP policy that blocks the connector

AnswerD

A tenant-level DLP policy applies to all environments.

Why this answer

DLP policies in Microsoft Power Platform can be configured at the tenant level to apply across all environments. By creating a tenant-level DLP policy and blocking the specific third-party connector, the administrator ensures consistent enforcement without needing to manage individual environment policies. This approach centralizes control and prevents the connector from being used in any environment.

Exam trap

The trap here is that candidates often assume DLP policies must be created per environment, overlooking the tenant-level scope that provides centralized enforcement across all environments.

How to eliminate wrong answers

Option A is wrong because creating a DLP policy for each environment is inefficient and error-prone; it requires manual replication across environments and does not guarantee uniform enforcement if environments are added or missed. Option B is wrong because creating a custom connector with the same name does not block the original third-party connector; custom connectors are separate entities and blocking a custom connector does not affect the built-in or certified connector. Option C is wrong because removing a connector from the default solution does not block its use; connectors are not managed through solutions in that way, and removal from a solution only affects solution components, not connector availability in environments.

Practice this question →

93

MCQhard

An organization uses Power Automate flows that connect to Microsoft SharePoint Online and Microsoft Dataverse. The security team requires that all connections to Dataverse use service principal authentication instead of user credentials. The administrator needs to ensure that flows relying on Dataverse connections continue to work after the change. What should the administrator do?

A.Create a new environment and migrate flows there

B.Register a service principal in Microsoft Entra ID and update connection references in the flows' solution

C.Recreate all flows with a shared connection using a service principal

D.Delete existing connections and ask users to create new ones

AnswerB

This allows flows to authenticate using the service principal.

Why this answer

Service principal authentication in Power Automate requires registering an application in Microsoft Entra ID (formerly Azure AD) and using its credentials to authenticate to Dataverse. Updating the connection references in the flows' solution to point to a service principal-based connection ensures all flows continue to work without requiring user credentials, meeting the security team's requirement.

Exam trap

The trap here is that candidates may think recreating flows or migrating environments is necessary, when in fact the solution-level connection reference can be updated to switch authentication methods without rebuilding the flows.

How to eliminate wrong answers

Option A is wrong because creating a new environment and migrating flows does not change the authentication method; the flows would still use user credentials unless the connection references are updated. Option C is wrong because recreating all flows is unnecessary and inefficient; the existing flows can be updated by modifying their connection references to use a service principal connection. Option D is wrong because deleting existing connections and asking users to create new ones would disrupt operations and still rely on user credentials, not service principal authentication.

Practice this question →

94

MCQeasy

A user reports they cannot create a new environment in the Power Platform admin center. What is the most likely reason?

A.The tenant has insufficient trial capacity.

B.The user does not have a Power Apps license.

C.The user lacks the Global Admin or Power Platform Administrator role.

D.The user's network blocks the Power Platform admin center.

AnswerC

Correct. This option includes Global Admin, which is one of the roles that can create environments. However, note that Environment Admin alone is insufficient; only Global Admin (or Power Platform Administrator) works.

Why this answer

Creating a new environment in Power Platform requires either the Global Admin or Power Platform Administrator role. The Environment Admin role can manage existing environments but cannot create new ones. Therefore, the most likely reason is that the user lacks the necessary administrative role.

Option C correctly identifies the required roles.

Exam trap

A common trap is thinking the Environment Admin role is sufficient for creating environments, but it only allows management of existing environments. Only Global Admin or Power Platform Administrator can provision new ones.

How to eliminate wrong answers

Option A is wrong because insufficient trial capacity prevents the creation of a trial environment, but the question does not specify that the user is trying to create a trial environment; the user could be attempting to create a production or sandbox environment, which do not rely on trial capacity. Option B is wrong because a Power Apps license is required to use Power Apps, but creating environments in the admin center is a management task that depends on administrative roles, not on having a Power Apps license assigned. Option D is wrong because while network blocks could prevent accessing the admin center URL, the user reports they cannot create a new environment, implying they can access the admin center but the creation action fails, which points to a permissions issue rather than a connectivity problem.

Practice this question →

95

MCQmedium

Refer to the exhibit. The JSON shows a snippet of a DLP policy. Which effect will this policy have on a Power Automate flow that uses Google Sheets and Dropbox connectors?

A.The flow will be blocked because it uses blocked connectors.

B.The flow will run but the connection references will be deleted.

C.The flow will be blocked only if it uses both connectors together.

D.The flow will run normally but will be restricted to the production environment only.

AnswerA

Both connectors are blocked, so any flow using them will not run.

Why this answer

The DLP policy in the exhibit defines a 'Blocked' connector group that includes both Google Sheets and Dropbox. In Power Automate, when a flow uses any connector listed in a blocked group, the flow is prevented from running. Since the flow uses both blocked connectors, it will be blocked entirely, regardless of whether they are used together or separately.

Exam trap

The trap here is that candidates may think DLP policies only block flows when multiple connectors from different groups are combined (cross-group sharing), but in reality, any connector placed in the 'Blocked' group alone is sufficient to block the flow entirely.

How to eliminate wrong answers

Option B is wrong because DLP policies do not delete connection references; they block the execution of flows that use blocked connectors. Option C is wrong because the policy blocks any flow that uses a blocked connector individually; it does not require both connectors to be used together. Option D is wrong because DLP policies apply across all environments unless specifically scoped, and the policy does not restrict the flow to a production environment—it blocks it entirely.

Practice this question →

96

Multi-Selecthard

Which THREE components are part of the Power Platform environment lifecycle management?

Select 3 answers

A.Environment creation

B.Environment deletion

C.Creating users in Microsoft Entra ID

D.Environment backup and restore

E.Publishing Power BI reports

AnswersA, B, D

Creating environments is a key lifecycle operation.

Why this answer

Environment creation is a core component of Power Platform environment lifecycle management because it establishes the isolated container where apps, flows, and data reside. The lifecycle begins when an administrator provisions a new environment, which sets up a dedicated Dataverse database, security boundaries, and resource limits. Without creation, no subsequent lifecycle operations (backup, restore, deletion) can occur.

Exam trap

The trap here is that candidates confuse operational tasks (like creating users or publishing reports) with environment lifecycle management, which strictly covers the creation, deletion, backup, and restore of the environment itself, not activities that occur within it.

Practice this question →

97

MCQmedium

A multinational corporation uses Power Platform extensively. They have multiple environments: DEV, TEST, UAT, STAGING, and PROD. A developer accidentally published a Power App that connects to a SQL Server database using an unapproved connector in the PROD environment. The organization has strict data governance policies that require all connections to use approved connectors only. The admin needs to block this connector in PROD while still allowing it in other environments. What should the admin do?

A.Create a tenant-level DLP policy that blocks the connector for all environments.

B.Remove the developer's permissions to the PROD environment.

C.Delete the Power App from PROD.

D.Create an environment-level DLP policy for PROD that blocks the connector.

AnswerD

Environment-level policies can block connectors in specific environments without affecting others.

Why this answer

Environment-level DLP policies allow blocking connectors in specific environments. The admin should create an environment-level DLP policy for PROD that blocks the unapproved connector. This overrides the tenant-level policy that might allow it elsewhere.

Practice this question →

98

MCQmedium

A company uses Microsoft Power Platform and requires that all environment creation requests go through an approval process. The security team wants to prevent non-admins from creating trial environments. What should the administrator configure?

A.In Power Platform Admin Center, set 'Disable trial environments created by non-admins' to Yes

B.Assign users to an environment group with restricted permissions

C.In Power Apps settings, disable 'Allow users to create environments'

D.Create a Data Loss Prevention (DLP) policy that blocks trial environments

AnswerA

This setting prevents non-admins from creating trial environments.

Why this answer

The Power Platform Admin Center provides a dedicated tenant-level setting called 'Disable trial environments created by non-admins' that, when set to 'Yes', prevents users without administrative privileges from creating trial environments. This directly addresses the security team's requirement to block non-admins from creating trial environments, as it enforces an approval-based control at the environment creation level.

Exam trap

The trap here is that candidates often confuse DLP policies with environment lifecycle controls, assuming DLP can block environment creation, when in reality DLP only governs data connectors and policies across environments, not provisioning actions.

How to eliminate wrong answers

Option B is wrong because environment groups (or environment routing groups) do not exist in Power Platform; this is a fabricated concept and cannot restrict environment creation permissions. Option C is wrong because the setting 'Allow users to create environments' in Power Apps settings is a legacy control that only applies to the default environment and does not specifically block trial environments; it also does not enforce an approval process. Option D is wrong because Data Loss Prevention (DLP) policies control data movement and connector usage across environments, not environment creation or trial environment provisioning; DLP policies cannot block the creation of environments.

Practice this question →

99

MCQmedium

A company needs to ensure that all Power Apps and Power Automate flows in the 'Development' environment are automatically backed up daily. What should the administrator configure?

A.Enable Dataverse backups for the Development environment

B.Enable the 'Backup Policy' in the Power Platform admin center for the Development environment

C.Schedule a daily export of all solutions using the Power Platform admin center

D.Use the 'Solution Backup' feature in the Power Platform admin center

AnswerA

Incorrect because Dataverse backups only protect database data, not the definitions of Power Apps and Power Automate flows.

Why this answer

Dataverse backups are automatically enabled for environments with a Dataverse database, including the Development environment. These backups occur daily and capture the entire environment state, which includes all data, apps (canvas and model-driven), and Power Automate flows stored within Dataverse. No additional configuration is required, making it the simplest way to ensure automatic daily backups of Power Apps and Power Automate flows.

Exam trap

The trap here is that candidates may confuse the automatic Dataverse backup with a manual export or a configurable backup policy, leading them to select options that require manual intervention or do not exist in the Power Platform admin center.

How to eliminate wrong answers

Option B is wrong because there is no 'Backup Policy' feature in the Power Platform admin center; backups are automatic and not configurable via a policy setting. Option C is wrong because scheduling a daily export of all solutions is not an automated backup mechanism—it is a manual or custom process that requires additional tooling and does not cover all data (e.g., Dataverse tables). Option D is wrong because there is no 'Solution Backup' feature in the Power Platform admin center; solutions can be exported manually, but this is not an automatic daily backup solution.

Practice this question →

100

MCQmedium

An organization wants to allow external partners to access specific Power Apps and data without granting them full access to the tenant. What should they configure?

A.Use Microsoft Intune to manage partner devices.

B.Create a data loss prevention (DLP) policy that allows external sharing.

C.Invite partners as guest users in Microsoft Entra ID and assign them appropriate security roles in the Power Platform environment.

D.Share the app URL with the partners and ask them to sign in with their own accounts.

AnswerC

Guest users (B2B) can be assigned security roles to access specific resources.

Why this answer

Inviting external partners as guest users in Microsoft Entra ID (formerly Azure AD) and assigning them appropriate security roles in the Power Platform environment is the standard method for providing controlled, least-privilege access to specific Power Apps and their underlying data sources. This approach leverages Microsoft Entra B2B collaboration to create guest identities, which can then be granted access to specific environments and resources without giving them full tenant-level permissions.

Exam trap

The trap here is that candidates often confuse sharing the app URL (Option D) with a valid access method, not realizing that Power Apps requires authenticated users with appropriate permissions in the environment, and simply providing a URL does not grant access unless the user is already a guest or member of the tenant.

How to eliminate wrong answers

Option A is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) solution for managing devices and apps, not a mechanism for granting external users access to Power Apps or data. Option B is wrong because a data loss prevention (DLP) policy controls how data can be shared between connectors and prevents data exfiltration, but it does not provide authentication or authorization for external users to access Power Apps. Option D is wrong because sharing the app URL and asking partners to sign in with their own accounts would require those accounts to be recognized by the tenant (e.g., as guest users) or the app to be publicly accessible, which would bypass security controls and is not a supported method for secure external access.

Practice this question →

101

MCQhard

A company has multiple Power Platform environments. They want to automatically apply consistent settings (e.g., DLP policies, audit settings) to all new environments. What should they do?

A.Use PowerShell scripts to configure each environment after creation.

B.Use Azure Blueprints to define and apply a set of Azure resources.

C.Create an environment group in the Power Platform admin center and assign policies to the group.

D.Use Microsoft Intune to enforce settings on Power Platform environments.

AnswerC

Environment groups allow central management of policies that apply to all environments in the group.

Why this answer

Environment groups in the Power Platform admin center allow administrators to define a set of policies (such as DLP policies and audit settings) that are automatically applied to all environments within the group, including newly created ones. This provides a centralized, no-code method to enforce consistent governance across multiple environments without manual intervention.

Exam trap

The trap here is that candidates may confuse Azure Blueprints (which manage Azure infrastructure) with Power Platform environment governance, or think that PowerShell scripting is the only way to automate settings, overlooking the built-in environment group feature that provides automatic, policy-driven consistency.

How to eliminate wrong answers

Option A is wrong because using PowerShell scripts to configure each environment after creation is a manual, reactive approach that does not automatically apply settings to new environments as they are created, and it requires ongoing maintenance and scripting expertise. Option B is wrong because Azure Blueprints are designed to orchestrate the deployment of Azure resources (e.g., VMs, databases) and are not applicable to managing Power Platform environment settings like DLP policies or audit configurations. Option D is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) tool for managing devices and apps, not for enforcing settings on Power Platform environments.

Practice this question →

102

MCQhard

A financial services company uses Power Automate to process loan applications. The flow uses the ‘When a new email arrives’ trigger from a shared mailbox. The flow recently stopped working after an admin changed the mailbox permissions. What is the most likely cause?

A.The mailbox exceeded its storage limit

B.The mailbox connection lost permissions to access the mailbox

C.The flow owner's Power Automate license was deleted

D.The flow was transferred to another owner

AnswerB

Permission changes can invalidate the existing connection, causing the trigger to fail.

Why this answer

The flow uses the 'When a new email arrives' trigger, which relies on a connection to the shared mailbox. When an admin changes mailbox permissions, the existing connection loses its authorization to access the mailbox, causing the trigger to fail. This is the most direct cause because the connection object in Power Automate must have valid permissions to read emails from the specified mailbox.

Exam trap

The trap here is that candidates may confuse a permissions issue with a storage limit or license problem, but the trigger's dependency on a valid connection object makes permission changes the immediate and most likely cause.

How to eliminate wrong answers

Option A is wrong because exceeding the mailbox storage limit would cause new emails to be rejected or bounce, but the flow trigger would still attempt to run and fail with a different error (e.g., mailbox full), not a permissions-related failure. Option C is wrong because deleting the flow owner's Power Automate license would disable the flow entirely or prevent it from being saved/run, but the scenario specifies the flow stopped working after a permissions change, not a license change. Option D is wrong because transferring the flow to another owner does not inherently break the mailbox connection; the new owner would need to re-authenticate, but the trigger failure is directly tied to the permissions change, not ownership transfer.

Practice this question →

103

Multi-Selecthard

Which THREE factors determine the capacity limits (database, file, log) of a Power Platform environment? (Choose three.)

Select 3 answers

A.Environment type (production vs. sandbox)

B.Number of licensed users in the tenant

C.Environment geographic region

D.Base license type (Power Apps, Power Automate, Dynamics 365)

E.Purchased capacity add-ons

AnswersA, D, E

Sandbox environments have reduced capacity limits.

Why this answer

Environment type (production vs. sandbox) directly determines the default capacity limits for database, file, and log storage. Production environments receive higher default entitlements, while sandbox environments are capped at 1 GB of database capacity, ensuring that testing does not consume production resources.

Exam trap

The trap here is that candidates often confuse tenant-wide capacity pooling with per-environment limits, mistakenly thinking the number of licensed users directly sets each environment's cap, when in fact the environment type and base license type are the primary determinants.

Practice this question →

104

MCQmedium

You are a Power Platform administrator for a medium-sized business. The company uses Power Apps and Power Automate extensively. The development team has requested the ability to create their own sandbox environments for testing without waiting for IT. However, the security team requires that all environments be subject to data loss prevention (DLP) policies and that environment creation be tracked. You need to design a solution that allows developers to self-service environment creation while maintaining governance. The developers currently have Power Apps Plan 2 licenses. What should you do?

A.Assign the Power Platform Administrator role to all developers.

B.Disable environment creation for non-admins and have developers submit requests to IT.

C.Install the CoE Starter Kit and configure the environment creation policy to allow all users.

D.Create a security group in Microsoft Entra ID, add developers, and configure tenant settings to allow only members of that group to create environments. Enable audit logging.

AnswerD

This enables self-service while restricting creation to approved users and tracking activity.

Why this answer

The best approach is to create a security group in Microsoft Entra ID, add developers to it, and then configure the tenant settings to allow that group to create environments. Additionally, enable audit logging to track creation. Option A is incorrect because assigning the Power Platform Administrator role gives too much privilege.

Option B is incorrect because disabling creation for non-admins prevents self-service. Option C is incorrect because the CoE Starter Kit is for governance but does not directly enable self-service creation.

Practice this question →

105

MCQeasy

An organization wants to enable Microsoft Copilot Studio (formerly Power Virtual Agents) to answer questions from employees about company policies. The chatbot must only use internal company documents stored in SharePoint as its knowledge source. Which configuration should the administrator use?

A.Enable the 'Use generative AI' feature in the Power Platform admin center

B.Deploy a custom connector to SharePoint

C.Create a Power Automate flow to fetch data from SharePoint and pass it to the chatbot

D.Add a SharePoint knowledge source in Copilot Studio and configure authentication to use the company's Microsoft Entra ID

AnswerD

This allows the chatbot to access SharePoint documents securely.

Why this answer

Microsoft Copilot Studio allows administrators to add SharePoint as a knowledge source directly, enabling the chatbot to retrieve answers from internal documents without custom development. Configuring authentication with Microsoft Entra ID ensures that only authorized users can access the company policies, maintaining security and compliance.

Exam trap

The trap here is that candidates may overcomplicate the solution by thinking a custom connector or Power Automate flow is required, when in fact Copilot Studio's native SharePoint integration handles the connection directly.

How to eliminate wrong answers

Option A is wrong because the 'Use generative AI' feature in the Power Platform admin center is a tenant-level setting that enables AI capabilities across environments, but it does not directly connect a chatbot to SharePoint documents as a knowledge source. Option B is wrong because deploying a custom connector to SharePoint is unnecessary and overly complex; Copilot Studio natively supports SharePoint as a knowledge source without requiring custom connectors. Option C is wrong because creating a Power Automate flow to fetch data from SharePoint and pass it to the chatbot introduces unnecessary latency and complexity, whereas Copilot Studio can directly query SharePoint using its built-in integration.

Practice this question →

106

MCQhard

A Power Platform administrator is configuring data loss prevention (DLP) policies. The company uses Power Automate flows that connect to Microsoft SharePoint and Microsoft Teams. The security team wants to block any flow from sending data from SharePoint to unsanctioned third-party services. Which DLP policy configuration should the administrator apply?

A.Create a policy that only applies to non-production environments

B.Classify SharePoint as Business and all third-party services as Blocked

C.Classify SharePoint as Business and all third-party services as Non-Business

D.Classify all connectors as Blocked

AnswerB

Blocked group prevents any connection to those services.

Why this answer

DLP policies in Power Platform allow administrators to classify connectors into Business, Non-Business, and Blocked categories. By classifying SharePoint as Business and all third-party services as Blocked, the administrator ensures that no flow can send data from SharePoint to unsanctioned third-party connectors, as blocked connectors cannot be used in any flow that also uses a Business connector. This directly enforces the security team's requirement to prevent data exfiltration to unsanctioned services.

Exam trap

The trap here is that candidates often confuse 'Non-Business' with 'Blocked', not realizing that Non-Business connectors can still be used in flows alongside Business connectors, whereas only the Blocked category prevents data from being sent to those services entirely.

How to eliminate wrong answers

Option A is wrong because applying a policy only to non-production environments would not protect production flows that connect SharePoint to unsanctioned third-party services, leaving the security requirement unmet. Option C is wrong because classifying third-party services as Non-Business would still allow flows to use both Business (SharePoint) and Non-Business connectors in the same flow, which does not block data from being sent to those services—only the 'Blocked' category prevents connector usage entirely. Option D is wrong because classifying all connectors as Blocked would prevent all flows from using any connector, including SharePoint and Teams, which would break legitimate business flows and is not the targeted restriction the security team requires.

Practice this question →

107

MCQeasy

A hospital uses Power Apps to manage patient intake forms. The app stores data in Microsoft Dataverse. The security policy requires that patient health information (PHI) be encrypted at rest and in transit. The environment is already configured with default Dataverse settings. The IT admin needs to ensure compliance. What should the admin do?

A.Enable customer-managed encryption keys for Dataverse.

B.No further action is needed; Dataverse encrypts data at rest and in transit by default.

C.Configure a VPN for all access to the environment.

D.Use Power Automate to encrypt data before storing it in Dataverse.

AnswerB

Dataverse provides encryption by default, meeting the requirements.

Why this answer

Dataverse provides encryption at rest by default (using Microsoft-managed keys) and encryption in transit (TLS). No additional configuration is needed unless the organization requires customer-managed keys, which is not mentioned.

Practice this question →

108

MCQhard

A Power Platform administrator needs to move a canvas app and its associated Dataverse data from a development environment to a test environment. The solution must preserve data and configuration. Which approach should the administrator use?

A.Create a managed solution containing the app and Dataverse data using configuration data export

B.Export the canvas app as a managed solution and import it into test

C.Recreate the app in test and manually re-enter data

D.Use the 'Copy environment' feature in Power Platform Admin Center

AnswerA

Managed solutions can include data via configuration data export.

Why this answer

Creating a managed solution with configuration data export allows the administrator to package both the canvas app and its associated Dataverse data, preserving data and configuration during the move from development to test. This approach uses the Solution Packager and Configuration Migration tools to export data schemas and records, ensuring a consistent environment transfer.

Exam trap

The trap here is that candidates often confuse 'managed solution export' (which only moves app components) with 'configuration data export' (which includes data), leading them to choose Option B, or they overestimate the 'Copy environment' feature as a quick fix without realizing it duplicates the entire environment, not just the app and its data.

How to eliminate wrong answers

Option B is wrong because exporting a canvas app as a managed solution only moves the app's metadata and components, not the associated Dataverse data, so data would be lost. Option C is wrong because recreating the app manually and re-entering data is error-prone, time-consuming, and does not preserve existing data or configuration reliably. Option D is wrong because the 'Copy environment' feature in Power Platform Admin Center copies the entire environment, including all apps and data, but it is designed for full environment duplication, not selective migration of a specific app and its data, and may introduce unnecessary overhead or compliance issues.

Practice this question →

109

Multi-Selectmedium

Which TWO actions can a Power Platform admin perform in the Power Platform admin center to manage environments? (Choose two.)

Select 2 answers

A.Modify Dataverse table schemas.

B.Create and delete environments.

C.Manage environment security roles.

D.Assign Power Apps licenses to users.

E.Create Microsoft Entra ID security groups.

AnswersB, C

Environment management is a core function in the admin center.

Why this answer

Options B and C are correct. A Power Platform admin can create and delete environments and manage environment security roles in the Power Platform admin center. Option A is incorrect because modifying Dataverse table schemas is done in the Power Apps maker portal, not the admin center.

Option D is incorrect because assigning Power Apps licenses to users is performed in the Microsoft 365 admin center. Option E is incorrect because creating Microsoft Entra ID security groups is done in the Microsoft Entra admin center.

Practice this question →

110

Multi-Selecteasy

Which TWO roles can manage Power Platform environments at the tenant level?

Select 2 answers

A.Environment Admin

B.Power Platform Administrator

C.Dynamics 365 Administrator

D.System Administrator

E.Global Administrator

AnswersB, C

This role has tenant-level admin access to Power Platform.

Why this answer

The correct answers are Power Platform Administrator and Dynamics 365 Administrator because both roles have tenant-level administrative privileges over Power Platform environments. Power Platform Administrator can manage all settings and environments across the tenant, while Dynamics 365 Administrator has similar capabilities but also includes Dynamics 365-specific management. Environment Admin (A) can only manage specific environments assigned to them, not at the tenant level.

System Administrator (D) is a Dataverse role that operates within a specific environment, not tenant-wide. Global Administrator (E) has full access across all services but is not a dedicated Power Platform role and would be overkill for Power Platform management alone.

Practice this question →

111

MCQeasy

You are a Power Platform administrator. A user reports that they are unable to share a canvas app with external users. What is the most likely cause?

A.The environment is not enabled for external sharing.

B.The environment is a sandbox environment, which does not support external sharing.

C.The environment has a data loss prevention (DLP) policy that blocks sharing.

D.External users must have a Power Apps license to access the app.

AnswerA

External sharing must be enabled in the environment settings.

Why this answer

External sharing of canvas apps is controlled at the environment level in the Power Platform admin center. By default, external sharing is disabled for environments, and an administrator must explicitly enable it under the environment's settings. Without this setting enabled, users cannot share canvas apps with external users, even if they have the appropriate permissions.

Exam trap

The trap here is that candidates often confuse environment-level sharing settings with licensing requirements or DLP policies, assuming that external sharing is always available or that a license is the primary blocker, when in fact the environment setting is the first gate.

How to eliminate wrong answers

Option B is wrong because sandbox environments do support external sharing; the limitation is not based on environment type but on the external sharing setting itself. Option C is wrong because data loss prevention (DLP) policies control data connectors and data movement, not the ability to share apps with external users; DLP policies do not block sharing operations. Option D is wrong because external users can access shared canvas apps without a Power Apps license if the app is shared with them and they have a Microsoft account or Azure AD guest account; a license is required only for the app creator or for premium features.

Practice this question →

112

MCQmedium

Your organization uses Power Automate to automate business processes. A flow that runs daily fails intermittently with 'HTTP 429 - Too Many Requests' errors. What should you do to resolve this issue?

A.Increase the frequency of the flow to run more often.

B.Change the flow trigger from a schedule to an instant trigger.

C.Set up an on-premises data gateway to bypass the throttling limits.

D.Configure retry policies with exponential backoff in the flow actions.

AnswerD

Retry policies with backoff help manage throttling by spacing out retries.

Why this answer

HTTP 429 errors indicate throttling. Configuring retry policies with exponential backoff allows the flow to automatically retry failed actions after a delay, reducing the request rate and respecting service limits. Option A is incorrect because increasing the frequency would increase the number of requests, worsening the issue.

Option B is incorrect because changing the trigger type does not address throttling. Option C is incorrect because setting up an on-premises data gateway does not affect throttling limits; it is used for accessing on-premises data sources.

Practice this question →

113

Multi-Selectmedium

A global consulting firm uses Power Platform with environments in multiple regions. They need to enforce data loss prevention (DLP) policies that are consistent across all environments, but allow exceptions for specific connectors in a single environment used for a high-security client project. Which three components should they configure?

Select 3 answers

A.Power Apps component library

B.Environment-level DLP policy

C.Power Automate Cloud Flow

D.Tenant-level DLP policy

E.Connector classification

AnswersB, D, E

Environment-level policies can override tenant policies for specific environments to allow exceptions.

Why this answer

Environment-level DLP policies can be created to override tenant-level policies for specific environments. The tenant-level DLP policy provides a baseline. Connector classification (e.g., Blocked, Business, Non-business) is part of DLP policy configuration.

Practice this question →

114

MCQeasy

A company uses Power Automate flows that access Microsoft SharePoint and Microsoft Dataverse. They want to prevent data from leaving the organization. What should they configure?

A.Configure Microsoft Purview to automatically classify and protect data in Power Automate.

B.Enable Microsoft Defender XDR to monitor for suspicious data transfers.

C.Create a data loss prevention (DLP) policy in the Power Platform admin center that blocks sharing data with external connectors.

D.Apply Microsoft Entra ID Conditional Access policies to require managed devices.

AnswerC

DLP policies can restrict connectors to prevent data exfiltration.

Why this answer

Data Loss Prevention (DLP) policies in the Power Platform admin center are specifically designed to prevent data from leaving the organization by controlling which connectors can share data. By blocking external connectors, the policy ensures that SharePoint and Dataverse data cannot be sent to unauthorized external services, directly addressing the requirement.

Exam trap

The trap here is that candidates often confuse data loss prevention with broader security tools like Microsoft Purview or Conditional Access, not realizing that DLP policies are the specific Power Platform feature for controlling connector-level data flow.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview focuses on data classification and protection (e.g., labeling and encryption) but does not block data transfers between connectors in Power Automate flows. Option B is wrong because Microsoft Defender XDR is a threat detection and response tool for monitoring security incidents, not a mechanism to prevent data exfiltration via Power Automate connectors. Option D is wrong because Microsoft Entra ID Conditional Access policies control access based on device compliance or location, but they do not restrict how data flows between connectors within Power Automate.

Practice this question →

115

MCQhard

An organization has multiple Power Platform environments including production, development, and test. They want to ensure that changes made in development are promoted to test and then to production, with approval gates. Which feature should they use?

A.Use Power Apps check-in feature and version history.

B.Use unmanaged solutions and export/import manually between environments.

C.Use managed solutions with environment variables and configure deployment pipelines.

D.Export solutions to a SharePoint document library and import from there.

AnswerC

Managed solutions and deployment pipelines enable staged promotions with approvals.

Why this answer

Managed solutions with environment variables and deployment pipelines provide a structured, automated way to promote solutions across environments with approval gates. This approach ensures that only managed solutions (which are locked and not directly editable) are deployed to production, while environment variables allow configuration values to change per environment without modifying the solution itself.

Exam trap

The trap here is that candidates often confuse manual export/import (Option B) as sufficient for controlled promotion, missing that managed solutions and deployment pipelines are required for approval gates and environment-specific configuration.

How to eliminate wrong answers

Option A is wrong because Power Apps check-in and version history are source control features for individual app versions, not for promoting full solutions across environments with approval gates. Option B is wrong because unmanaged solutions can be edited in any environment, making them unsuitable for controlled promotion, and manual export/import lacks approval gates and automation. Option D is wrong because exporting to a SharePoint document library is a storage method, not a deployment pipeline; it does not provide approval gates, environment variable management, or automated promotion.

Practice this question →

116

Multi-Selectmedium

Which TWO actions can a Power Platform administrator perform in the Power Platform admin center?

Select 2 answers

A.Manage SharePoint Online site collections

B.Manage Exchange Online mailboxes

C.Create and delete environments

D.Create data loss prevention policies

E.Manage Microsoft Entra ID roles

AnswersC, D

This is a core function of the Power Platform admin center.

Why this answer

The Power Platform admin center provides administrators with the ability to create and delete environments, which are isolated containers for managing apps, flows, and data. This is a core administrative function that directly controls the lifecycle of Power Platform resources.

Exam trap

The trap here is that candidates may confuse the Power Platform admin center with the broader Microsoft 365 admin center, assuming it can manage all Microsoft 365 workloads like SharePoint and Exchange, when in reality it is scoped to Power Platform-specific tasks such as environment management and DLP policies.

Practice this question →

117

MCQeasy

A Power Platform administrator wants to see the capacity usage of all environments in the tenant. Where should they look?

A.Power Platform admin center > Environments

B.Power Platform admin center > Capacity

C.Power Platform admin center > Analytics

D.Power Platform admin center > Billing

AnswerB

The Capacity page shows storage and add-on capacity usage across all environments.

Why this answer

The Capacity page in the Power Platform admin center provides a tenant-level view of all capacity entitlements (database, file, log) and their consumption across environments. This is the dedicated location for monitoring capacity usage, including add-ons and storage overages, as documented in Microsoft's capacity management guidance.

Exam trap

The trap here is that candidates confuse the Environments list (where you manage individual environment settings) with the Capacity page (which is the sole location for tenant-wide storage monitoring), leading them to select the more familiar Environments option.

How to eliminate wrong answers

Option A is wrong because the Environments page lists individual environments and their details but does not aggregate capacity usage across the tenant. Option C is wrong because Analytics provides usage and adoption metrics (e.g., active users, API calls) rather than raw capacity consumption. Option D is wrong because Billing handles subscription, licensing, and invoice information, not the technical capacity allocation or usage tracking.

Practice this question →

118

Multi-Selecteasy

Which TWO are best practices for managing Power Platform environments in a large enterprise?

Select 2 answers

A.Give all users the ability to create environments

B.Assign the System Administrator role to all users

C.Use a single environment for all apps

D.Use separate environments for development, test, and production

E.Apply DLP policies to control data flow between connectors

AnswersD, E

This follows ALM best practices.

Why this answer

Using separate environments for development, test, and production (Option D) is a best practice to ensure proper application lifecycle management and governance. Additionally, applying Data Loss Prevention (DLP) policies (Option E) helps control data flow between connectors and prevent data leaks. Option A is incorrect because giving all users environment creation rights can lead to environment sprawl.

Option B is incorrect because assigning the System Administrator role to all users is a security risk and violates the principle of least privilege. Option C is incorrect because using a single environment for all apps does not allow for isolation and testing, increasing the risk of unintended changes impacting production.

Practice this question →

119

MCQhard

Your organization has a Power Apps portal that allows external users to submit support tickets. You need to ensure that only authenticated external users from specific domains can access the portal. What should you configure?

A.Create a data loss prevention (DLP) policy that blocks external users.

B.Restrict access to the portal by IP address using a web application firewall.

C.Share the portal URL only with users from the allowed domains.

D.Configure the portal to use Microsoft Entra ID authentication and set up domain restrictions.

AnswerD

Microsoft Entra ID allows domain-based access restrictions.

Why this answer

Power Apps portals can be configured to use Microsoft Entra ID (formerly Azure AD) as the identity provider, and within the portal settings you can restrict sign-in to users from specific domains. This ensures that only authenticated external users whose email domain matches the allowed list can access the portal, meeting the requirement without relying on IP filtering or obscurity.

Exam trap

The trap here is that candidates often confuse DLP policies (which control data connectors) with access control mechanisms, or they mistakenly believe that simply sharing a URL (security by obscurity) or using IP restrictions (which don't authenticate users) can satisfy domain-based authentication requirements.

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) policy controls which connectors can be used in Power Apps and Power Automate flows, not who can access a portal; it cannot block external users from accessing the portal itself. Option B is wrong because restricting by IP address using a web application firewall (WAF) would block or allow traffic based on network location, not on user authentication or domain membership, and external users may have dynamic IPs. Option C is wrong because sharing the portal URL only with allowed domains relies on security through obscurity and does not enforce authentication; anyone who obtains the URL can access the portal unless additional authentication and domain restrictions are configured.

Practice this question →

120

MCQmedium

An organization is using Power Virtual Agents (now Copilot Studio) to create a customer service chatbot. The chatbot must be available only to users inside the organization, not to external customers. What should the administrator do?

A.Configure authentication in the chatbot

B.Publish the chatbot to a public website

C.Create a new environment for the chatbot

D.Disable analytics for the chatbot

AnswerA

Configuring authentication restricts access to internal users only.

Why this answer

Configuring authentication in the chatbot (option A) ensures that only authenticated users (internal employees) can access the chatbot, restricting external customers. Option B is incorrect because publishing to a public website would make the chatbot accessible to anyone. Option C is incorrect because creating a new environment does not inherently restrict access; authentication is still needed.

Option D is incorrect because disabling analytics does not affect access control.

Practice this question →

121

MCQhard

A government agency uses Power Platform with strict compliance requirements. They need to retain all audit logs of user activities within Power Platform for at least 7 years. The agency uses Microsoft Purview for compliance and Microsoft Sentinel for security monitoring. The admin needs to ensure that all Power Platform audit events are captured and retained for the required period. What should the admin do?

A.Export audit logs to Azure Blob Storage and set a retention policy there.

B.Use Microsoft Sentinel to store and retain the logs for 7 years.

C.Configure a retention policy in Microsoft Purview for the Power Platform audit logs.

D.Enable audit logging in each Power Platform environment's settings.

AnswerC

Purview allows setting retention policies for audit logs to meet the 7-year requirement.

Why this answer

Power Platform audit logs are stored in the Microsoft 365 unified audit log. Microsoft Purview allows configuring retention policies for these logs to meet compliance requirements. Option C is correct because it directly addresses the need to retain logs for 7 years via a Purview retention policy.

Options A, B, and D are insufficient or misaligned: A (export to Azure Blob Storage) is an extra step and not the native retention mechanism; B (Microsoft Sentinel) is for security monitoring, not primary retention; D (enabling audit logging) is necessary but does not set the retention duration.

Practice this question →

122

Multi-Selecthard

Which THREE actions can a Power Platform administrator perform in the Power Platform admin center to manage environments?

Select 3 answers

A.Create a new environment

B.Create a new Microsoft Entra ID security group

C.Install a managed solution from AppSource

D.Delete an environment

E.Back up and restore an environment

AnswersA, D, E

Admins can create environments.

Why this answer

The Power Platform admin center provides administrators with the ability to create new environments, which are containers for managing apps, flows, and data. This action is a core administrative task for organizing and isolating resources within a tenant.

Exam trap

The trap here is that candidates may confuse environment-level actions (like installing solutions) with tenant-level administrative actions, or assume that security group creation is part of Power Platform administration when it is actually a separate Entra ID task.

Practice this question →

123

MCQmedium

A company is deploying Microsoft Power Platform to multiple departments. The security team requires that all environment creation be restricted to a specific group of administrators. Which action should the Power Platform administrator take?

A.Create a security group in Microsoft Entra ID that includes the allowed administrators.

B.Disable environment creation for all users in the Power Platform admin center.

C.Install the CoE Starter Kit and configure environment creation policies.

D.Assign the Environment Admin role to the security group in the Power Platform admin center.

AnswerA

This is correct because creating a security group and restricting environment creation to that group allows granular control.

Why this answer

To restrict environment creation to a specific group of administrators, the first step is to create a security group in Microsoft Entra ID that includes the allowed administrators (option A). The full solution also requires configuring the environment creation restriction in the Power Platform admin center tenant settings to allow only that security group, but among the provided options, only option A is correct. Option B is incorrect because disabling environment creation for all users is too restrictive and does not allow granular control.

Option C is incorrect because the CoE Starter Kit is used for governance and monitoring, not for restricting environment creation. Option D is incorrect because the Environment Admin role grants administrative permissions within an environment but does not control who can create new environments.

Practice this question →

124

MCQeasy

A non-profit organization uses Power Platform to manage donor information. The organization wants to ensure that only users in the ‘Donor Managers’ security group can edit records in the ‘Donations’ table. What is the best way to achieve this?

A.Create a DLP policy to restrict edit connectors

B.Use a business process flow to require approval

C.Share the canvas app only with the security group

D.Assign a custom security role that grants edit permissions on the Donations table to the security group

AnswerD

This ensures only members of that group can edit the table.

Why this answer

The most direct and secure method to control record-level permissions in Dataverse is to assign a custom security role with specific edit privileges on the Donations table to the 'Donor Managers' security group. This leverages Dataverse role-based security, which governs CRUD operations at the table level, ensuring that only members of that group can edit records without affecting other tables or users.

Exam trap

The trap here is that candidates confuse app-level sharing (Option C) with data-level security, forgetting that a canvas app's sharing settings only control access to the app interface, not the underlying Dataverse record permissions.

How to eliminate wrong answers

Option A is wrong because DLP policies control which connectors can be used in apps and flows, not who can edit records in a Dataverse table; they are for data loss prevention, not access control. Option B is wrong because a business process flow guides users through a sequence of stages and steps but does not enforce edit permissions; it requires additional logic (e.g., Power Automate) to check security group membership and cannot natively restrict editing. Option C is wrong because sharing a canvas app only controls who can open the app, not who can edit records in the underlying Dataverse table; a user could still edit records through other interfaces (e.g., model-driven app, API) if they have the appropriate security role.

Practice this question →

125

MCQeasy

Refer to the exhibit. { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.PowerPlatform/enterprisePolicies", "apiVersion": "2021-01-01", "name": "myDlpPolicy", "location": "eastus", "properties": { "definition": { "$schema": "https://schema.management.azure.com/providers/Microsoft.PowerPlatform/policyDefinitions/2021-01-01/schema.json#", "rules": [ { "name": "Block SharePoint", "action": "Block", "connectors": [ "shared_sharepointonline" ] } ] } } } ] } An admin deploys this ARM template to create a DLP policy. After deployment, users report they can still use the SharePoint connector in Power Automate. What is the most likely reason?

A.The resource type should be 'Microsoft.PowerPlatform/dlpPolicies'

B.The policy was not applied to the environment where users are working

C.The policy name does not match the connector name

D.The policy is applied at the tenant level and does not affect individual environments

AnswerA

The ARM resource type for DLP policies is different; the template uses an incorrect type.

Why this answer

The resource type 'Microsoft.PowerPlatform/enterprisePolicies' is used for creating policies, but the API version and properties may not be correct for DLP policies. The correct resource type for DLP policies is 'Microsoft.PowerPlatform/dlpPolicies'. Option B is wrong because the environment might not have the policy applied, but the template attempts to create a policy.

Option C is wrong because the policy is created at the tenant level, not per environment. Option D is wrong because the policy name is set correctly.

Practice this question →

126

MCQeasy

A company has a Power Apps app that uses Microsoft Dataverse. They need to ensure that only users with a specific security role can access the app. Where should the administrator configure this?

A.App-level permissions in the Power Apps app settings

B.Environment-level security roles in Power Platform Admin Center

C.Dataverse security roles in the 'Roles' area of the environment

D.Share the app with users directly from the Power Apps maker portal

AnswerA

You can assign security roles to control access to the app.

Why this answer

To control access to a specific Power Apps app based on security roles, the administrator should configure app-level permissions in the Power Apps app settings. This allows the app owner to assign which security roles (from Dataverse) can use the app. Option B (Environment-level security roles) controls access to the entire environment, not individual apps.

Option C (Dataverse security roles in the 'Roles' area) manages data permissions, not app access directly. Option D (Sharing directly from maker portal) shares with individuals or groups, but not role-based access.

Practice this question →

127

MCQmedium

Your organization has multiple Power Platform environments. You need to ensure that a specific connector (e.g., SQL Server) is blocked in the production environment but allowed in the development environment. What should you configure?

A.Set the connector's API rate limits to zero in the production environment.

B.Modify the connector's sharing settings in the environment.

C.Configure environment-level security roles to restrict connector usage.

D.Create a data loss prevention (DLP) policy and assign it to the production environment.

AnswerD

DLP policies can block specific connectors in specific environments.

Why this answer

Data loss prevention (DLP) policies in Power Platform allow administrators to classify connectors as Blocked, Business Data Only, or No Business Data Allowed. By creating a DLP policy and assigning it to the production environment, you can specifically block the SQL Server connector in that environment while leaving it available in the development environment, which is not assigned the same policy.

Exam trap

The trap here is that candidates often confuse environment security roles (which manage user permissions) with DLP policies (which manage connector availability), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because setting API rate limits to zero does not block a connector; it only throttles the number of requests, and the connector would still be available for use, just limited in throughput. Option B is wrong because connector sharing settings control who can share the connector with others, not whether the connector itself is available for use in an environment. Option C is wrong because environment-level security roles control user permissions (e.g., who can create or use resources), but they do not provide a mechanism to block specific connectors; DLP policies are the dedicated feature for connector classification and restriction.

Practice this question →

128

Multi-Selectmedium

A Power Platform administrator is planning to implement environment lifecycle management. Which TWO actions should the administrator take to ensure unused environments are automatically cleaned up?

Select 2 answers

A.Assign the Environment Admin role to all makers so they can delete their own environments.

B.Use the Power Platform Copilot to identify unused environments.

C.Manually review environments each month.

D.Create a Power Automate flow that runs periodically and deletes environments that have not been accessed in 30 days.

E.Set an environment retention policy in the Power Platform admin center to delete environments after a period of inactivity.

AnswersD, E

This provides a custom automatic solution.

Why this answer

The two correct actions are D and E. Option D: Creating a Power Automate flow that periodically deletes environments inactive for 30 days automates cleanup. Option E: Setting an environment retention policy in the Power Platform admin center automatically deletes environments after a period of inactivity.

Both are automated approaches. Other options are not automatic or not effective: A assigns admin role but doesn't auto-clean, B relies on manual intervention via Copilot, C is manual and not automatic.

Practice this question →

129

MCQhard

A company uses Power Virtual Agents (now Copilot Studio) to build a customer service chatbot. The bot needs to securely escalate to a live agent when it cannot resolve the issue. The escalation must pass the conversation context to the agent. What should the bot use?

A.HTTP request to a webhook

B.Transfer conversation action

C.Power Automate flow trigger

D.Custom connector for the live agent system

AnswerB

Correct. The 'Transfer conversation' action is built for escalation and automatically passes the conversation context to the designated live agent system.

Why this answer

The 'Transfer conversation' action in Copilot Studio is designed to escalate the conversation to a live agent while passing the full conversation context, making it the correct choice for secure escalation with context.

Exam trap

Candidates often confuse the 'Transfer conversation' action with other integration methods like HTTP requests or Power Automate flows, but only the transfer action is designed to pass context directly to a live agent.

Practice this question →

130

MCQhard

Your organization uses Power Virtual Agents (now Copilot Studio) for customer service. You need to ensure that the bot can access customer data from a Dataverse table that contains sensitive information. What is the best approach to secure the data?

A.Configure a data loss prevention (DLP) policy to block the bot from accessing the table.

B.Use the bot's authentication settings to require multi-factor authentication.

C.Assign appropriate security roles and field-level security to the bot's service principal.

D.Restrict access to the environment to only the bot's service account.

AnswerC

Security roles and field-level security can restrict data access for the bot.

Why this answer

Power Virtual Agents (Copilot Studio) uses a service principal to authenticate with Dataverse. By assigning appropriate security roles and field-level security to that service principal, you can grant the bot granular, least-privilege access to only the necessary customer data, ensuring sensitive information is protected while still enabling the bot to function.

Exam trap

The trap here is that candidates confuse DLP policies (which govern connector usage) with data access control, or they assume user authentication methods like MFA apply to non-interactive service principals, leading them to pick options A or B instead of understanding the service principal security role mechanism.

How to eliminate wrong answers

Option A is wrong because a DLP policy controls data movement between connectors and endpoints, not access to specific Dataverse tables; blocking the bot from the table would prevent it from working entirely, which is not a security approach. Option B is wrong because multi-factor authentication applies to interactive user sign-ins, not to service-to-service authentication used by the bot's service principal; the bot cannot perform MFA. Option D is wrong because restricting access to the environment to only the bot's service account would block all human administrators and users, breaking management and troubleshooting, and does not provide fine-grained data-level security.

Practice this question →

131

MCQmedium

A company uses Microsoft Power Platform and wants to enforce data loss prevention (DLP) policies for all environments. The admin needs to block the use of SharePoint connector in all default environments. Which action should the admin take?

A.Create a DLP policy and assign it to the default environment only.

B.Use Microsoft Entra ID conditional access to block the SharePoint connector.

C.Create a DLP policy that applies to all environments and block the SharePoint connector.

D.Configure connector sharing settings in Power Apps to block SharePoint.

AnswerC

A DLP policy can be scoped to all environments and block specific connectors.

Why this answer

DLP policies in Microsoft Power Platform are designed to control connector usage across environments. By creating a DLP policy that applies to all environments and blocking the SharePoint connector, the admin ensures that the connector is prohibited in every environment, including all default environments. This action directly enforces the data loss prevention requirement at the tenant level.

Exam trap

The trap here is that candidates may confuse DLP policies with other security controls like conditional access or connector sharing settings, mistakenly thinking those can block connector usage at the environment level.

How to eliminate wrong answers

Option A is wrong because assigning a DLP policy to the default environment only would not block the SharePoint connector in other environments, leaving them unprotected. Option B is wrong because Microsoft Entra ID conditional access controls user authentication and access to applications, not connector-level data policies within Power Platform; it cannot block a specific connector like SharePoint. Option D is wrong because connector sharing settings in Power Apps control who can share apps using a connector, not whether the connector itself can be used; blocking the connector requires a DLP policy, not sharing settings.

Practice this question →

132

MCQhard

A company uses Microsoft Copilot Studio to create a custom copilot. The copilot needs to access customer data stored in a Dataverse table that contains sensitive information. The compliance team requires that data accessed by the copilot must be audited. What should the admin configure?

A.Deploy Microsoft Sentinel to monitor copilot behavior.

B.Configure a DLP policy to block non-compliant data access.

C.Enable auditing in Microsoft Purview and log copilot interactions.

D.Use Copilot Studio analytics to track usage.

AnswerC

Microsoft Purview provides audit logging for Power Platform and Copilot Studio.

Why this answer

Microsoft Purview auditing captures detailed logs of user and admin activities, including interactions with custom copilots built in Copilot Studio. By enabling auditing in Purview and logging copilot interactions, the admin can meet the compliance requirement to audit all data accessed by the copilot, ensuring a traceable record of sensitive customer data access.

Exam trap

The trap here is that candidates often confuse analytics (usage metrics) with auditing (compliance logging), or assume that a DLP policy alone satisfies audit requirements, when in fact auditing must be explicitly enabled in Microsoft Purview to capture detailed interaction logs.

How to eliminate wrong answers

Option A is wrong because Microsoft Sentinel is a SIEM tool used for threat detection and response, not for auditing specific copilot data access logs; it can ingest audit logs but does not replace the need to enable auditing in Purview. Option B is wrong because a DLP policy prevents data leakage by blocking non-compliant actions but does not generate audit logs or provide a historical record of data access. Option D is wrong because Copilot Studio analytics tracks usage metrics like session counts and user satisfaction, not detailed audit trails of data access required for compliance.

Practice this question →

133

Multi-Selectmedium

A Power Platform administrator needs to delegate environment administration to a team member without granting full tenant-level admin rights. Which TWO roles can the administrator assign?

Select 2 answers

A.Power Platform Service Admin

B.Environment Admin

C.Microsoft Entra ID Admin

D.Dynamics 365 Admin

E.Global Admin

AnswersA, B

Service Admin can manage environments without full tenant access.

Why this answer

Options A (Power Platform Service Admin) and B (Environment Admin) are correct. The Power Platform Service Admin role provides global admin-like capabilities within the Power Platform, such as managing environments, without granting full tenant-level admin rights across all Microsoft 365 services. The Environment Admin role grants full administrative control over a specific environment, including managing permissions and settings, but is scoped to that environment only.

Option C (Microsoft Entra ID Admin) is incorrect because it only manages identity and access in Azure Active Directory, not Power Platform environments. Option D (Dynamics 365 Admin) is incorrect because while it does include some Power Platform administration, it is broader and not specifically for delegating environment-level administration without additional privileges; also, it is not one of the two roles recommended for scoped delegation. Option E (Global Admin) is incorrect because it has unrestricted access to all tenant-level settings and services.

Practice this question →

134

MCQhard

A Power Platform administrator needs to ensure that only certain users can create Power Apps in the 'Production' environment. What is the recommended approach?

A.Create a DLP policy that blocks app creation for unauthorized users

B.Disable 'Create apps' in the Power Platform admin center for the tenant

C.Use Microsoft Entra ID to create a role that blocks 'Create Apps'

D.Assign a custom security role in Dataverse that excludes 'Create App' privilege for the Production environment

AnswerD

Custom security roles can control app creation at the environment level.

Why this answer

The recommended approach to restrict app creation to specific users in a specific environment is to assign a custom security role in Dataverse that excludes the 'Create App' privilege for that environment. This leverages Dataverse's role-based security model, which allows granular control over actions like app creation at the environment level, without affecting other environments or tenant-wide settings.

Exam trap

The trap here is that candidates often confuse tenant-wide settings (like DLP policies or Entra ID roles) with environment-specific security roles, leading them to choose options that either apply too broadly or are technically incapable of controlling app creation permissions.

How to eliminate wrong answers

Option A is wrong because Data Loss Prevention (DLP) policies control data connectors and data sharing between environments, not user permissions to create apps; they cannot block app creation. Option B is wrong because disabling 'Create apps' in the Power Platform admin center for the tenant would block app creation for all users across all environments, which is too broad and not the recommended approach for restricting only the 'Production' environment. Option C is wrong because Microsoft Entra ID (formerly Azure AD) manages identity and access at the tenant level, not environment-specific permissions; it cannot block 'Create Apps' within a specific Power Platform environment.

Practice this question →

135

MCQmedium

The exhibit shows a JSON snippet used to create a Power Platform environment via the Power Platform API. The administrator runs the script but the environment is created with the default language and currency instead of the specified values. What is the most likely reason?

A.The JSON syntax is invalid because of the empty securityGroupId.

B.The API version used does not support specifying language and currency.

C.The environment name "ContosoSales" is already in use.

D.The location "eastus" is not a valid Azure region for Power Platform.

AnswerA

An empty GUID may cause the API to ignore the dataverse configuration and apply defaults.

Why this answer

The JSON snippet uses an empty GUID for 'securityGroupId' (all zeros). In the Power Platform API, an empty or invalid GUID in this field can cause the entire Dataverse settings block to be ignored, resulting in the environment being created with default language and currency. Option A correctly identifies this syntax issue.

Options B, C, and D are incorrect because the API version, environment name, and location are valid.

Practice this question →

136

MCQmedium

A software company uses Power Platform to build customer-facing portals. They have a dedicated production environment and a sandbox environment for development. The developer needs to copy the entire production environment (including all apps, flows, and data) to the sandbox environment for performance testing. The developer wants to ensure that the sandbox environment is an exact copy, including all data. What should the developer do?

A.Export the solutions from the production environment and import them into the sandbox environment.

B.Manually recreate the apps and flows in the sandbox and use the same data source.

C.Use Power Automate to copy all data from production to sandbox.

D.Use the 'Copy environment' feature in the Power Platform Admin Center, selecting 'Full copy' including data.

AnswerD

This copies everything, including data, to the sandbox environment.

Why this answer

The Power Platform Admin Center provides a 'Copy environment' feature that can copy both customizations and data from a production environment to a sandbox environment. This meets the requirement exactly.

Practice this question →

137

MCQmedium

An administrator needs to ensure that only users from a specific Microsoft Entra ID group can access a Power Platform environment. What should the administrator configure?

A.Disable the 'Create personal productivity environments' setting

B.Assign a security group to the environment in the Power Platform admin center

C.Set environment capacity limits

D.Configure a data loss prevention (DLP) policy

AnswerB

Security groups control which users can access the environment.

Why this answer

Assigning a security group to an environment in the Power Platform admin center restricts access to only members of that Microsoft Entra ID group. This is the standard method for controlling user access to a Power Platform environment, ensuring that only authorized users can interact with its resources.

Exam trap

The trap here is that candidates often confuse access control (security group assignment) with data governance (DLP policies) or capacity management, leading them to select options that address different administrative concerns.

How to eliminate wrong answers

Option A is wrong because disabling the 'Create personal productivity environments' setting only prevents users from creating their own personal environments; it does not restrict access to an existing environment. Option C is wrong because setting environment capacity limits controls storage and API usage, not user authentication or authorization. Option D is wrong because configuring a data loss prevention (DLP) policy governs data movement between connectors and services, not user access to the environment itself.

Practice this question →

138

Multi-Selecteasy

An administrator needs to assign user roles in a Power Platform environment. Which TWO roles can be assigned to allow users to create and edit Power Apps and flows, but not manage environments?

Select 2 answers

A.System Customizer

B.Basic User

C.System Administrator

D.Global Administrator

E.Environment Maker

AnswersA, E

System Customizer allows creating and editing Power Apps and flows, and can customize system settings, but does not have environment management permissions.

Why this answer

Environment Maker allows users to create and edit Power Apps and flows without environment management. System Customizer also allows creating and editing apps and flows, and additionally can customize system settings, but does not manage environments. Basic User only allows running apps and flows, not creating or editing.

System Administrator and Global Administrator include environment management capabilities, which are not desired.

Practice this question →

139

MCQmedium

A company uses Power BI dashboards to monitor real-time production metrics. The dashboards use DirectQuery to a SQL Server database. Users report that the dashboards are slow during peak hours. What is the most effective first step to improve performance?

A.Optimize the SQL queries used in the dataset

B.Create aggregations in the dataset

C.Increase the Power BI Premium capacity

D.Switch the dataset to Import mode

AnswerA

Optimizing queries reduces load on the source and improves responsiveness.

Why this answer

Optimizing the SQL queries used in the dataset directly addresses the root cause of slow DirectQuery performance: inefficient queries sent to the SQL Server. DirectQuery translates Power BI visuals into SQL queries executed in real time on the source database, so poorly written or unindexed queries create bottlenecks during peak loads. Improving query efficiency (e.g., adding indexes, reducing joins, filtering early) reduces server load and response time without requiring architectural changes.

Exam trap

The trap here is that candidates often assume performance issues are always solved by scaling up infrastructure (Premium capacity) or switching to Import mode, but the PL-900 exam emphasizes that the first step in troubleshooting DirectQuery slowness is to optimize the source queries and database design, not to add more resources or change the connectivity mode.

How to eliminate wrong answers

Option B is wrong because creating aggregations in the dataset is a performance optimization for Import mode or composite models, but with DirectQuery, aggregations are not automatically used unless the dataset is configured for DirectQuery with aggregations (a Premium feature), and even then, it does not address the immediate issue of inefficient SQL queries. Option C is wrong because increasing Power BI Premium capacity adds more compute resources to the Power BI service but does not fix slow SQL queries or network latency to the on-premises SQL Server; the bottleneck is at the database level, not the Power BI rendering layer. Option D is wrong because switching the dataset to Import mode would require a full data refresh schedule, breaking the real-time monitoring requirement, and it does not solve the immediate performance problem during peak hours—it only shifts the performance burden to the refresh process.

Practice this question →

140

Multi-Selectmedium

Which TWO actions are necessary to enable AI Builder in a Power Apps environment? (Select 2)

Select 2 answers

A.Install AI Builder connectors

B.Purchase AI Builder credits

C.Create a DLP policy that allows AI Builder

D.Enable AI Builder in the environment

E.Assign a Power Automate license to users

AnswersB, D

AI Builder requires a paid add-on or credits.

Why this answer

AI Builder requires purchasing credits or an add-on license. Option D is correct because AI Builder must be explicitly enabled in the Power Platform environment. Option A is incorrect because AI Builder uses standard Power Platform connectors; no special connector installation is needed.

Option C is incorrect because data loss prevention (DLP) policies are not a prerequisite for enabling AI Builder; they are configured separately. Option E is incorrect because a Power Automate license is not required; AI Builder is a standalone add-on.

Practice this question →

141

Multi-Selecthard

An administrator is planning to deploy a solution across multiple environments. Which THREE practices should they follow?

Select 3 answers

A.Create separate environments for development, test, and production

B.Use managed solutions in test and production environments

C.Export solutions as managed when moving from development

D.Use unmanaged solutions in production for easier modifications

E.Copy the entire development environment to test and production

AnswersA, B, C

Separate environments provide isolation and controlled deployment.

Why this answer

Microsoft best practices recommend using separate environments for development, test, and production to isolate changes, prevent accidental data loss, and support a structured application lifecycle management (ALM) process. Each environment can have its own data, security settings, and solution versions, ensuring that modifications are validated before reaching production.

Exam trap

The trap here is that candidates often confuse managed and unmanaged solutions, thinking unmanaged solutions are easier for production modifications, but Microsoft explicitly warns that unmanaged solutions in production lead to untracked changes and solution corruption.

Practice this question →

142

MCQhard

A Power Platform administrator is configuring a data loss prevention (DLP) policy for a production environment. The policy must block the use of the SharePoint connector but allow the use of the SQL Server connector. The administrator creates a policy and assigns it to the environment. However, users can still use the SharePoint connector. What is the most likely reason?

A.The policy was not assigned to the correct environment.

B.The users have the System Administrator role in the environment.

C.A tenant-level DLP policy allows SharePoint and is set to a higher priority.

D.The DLP policy has not been saved and published.

AnswerC

Environment policies can be overridden by tenant policies if configured.

Why this answer

Data loss prevention (DLP) policies can be configured at both the tenant level and the environment level. When both levels have policies, the tenant-level policy takes precedence if it is set to a higher priority. In this scenario, a tenant-level DLP policy that allows the SharePoint connector would override the environment-level policy that blocks it, explaining why users can still use SharePoint.

Option A is incorrect because the policy was assigned to the environment. Option B is incorrect because user roles do not bypass DLP policies. Option D is incorrect because saved and published policies take effect immediately.

Practice this question →

143

MCQhard

A global organization has multiple geographic regions and needs to comply with data residency requirements. Each region must have its own Power Platform environment with data stored locally. What is the recommended approach to manage these environments?

A.Use Microsoft Entra ID conditional access policies to enforce data location.

B.Create separate tenants for each region.

C.Create separate environments for each region within the same tenant.

D.Create a single environment and use data policies to restrict data access by region.

AnswerC

Each environment can be provisioned in a specific region to meet data residency.

Why this answer

Power Platform environments are the recommended isolation boundary for data residency. Each environment can be created in a specific geographic region (e.g., Australia, Europe) within the same tenant, ensuring data is stored locally per region while maintaining a single tenant for centralized administration and licensing.

Exam trap

The trap here is that candidates confuse data residency (physical storage location) with data access control (policies or conditional access), leading them to choose Option A or D, which address access restrictions but not storage location.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID conditional access policies control authentication and access to services, not the physical storage location of data; they cannot enforce where Power Platform data is stored. Option B is wrong because creating separate tenants for each region introduces unnecessary administrative overhead, breaks cross-region collaboration, and violates the principle of a single identity and management plane; Power Platform supports multiple environments per tenant for this exact purpose. Option D is wrong because a single environment stores all data in one geographic location, and data policies (e.g., DLP policies) only restrict how data flows between connectors, not where data is physically stored.

Practice this question →

144

MCQhard

A large enterprise uses Microsoft Power Platform with a centralized Center of Excellence (CoE). They have over 200 environments, each assigned to different business units. The security team requires that all environments enforce multi-factor authentication (MFA) for makers and admins. Additionally, they want to ensure that environment creation is limited to a specific security group. The current setup uses Microsoft Entra ID for identity. The admin needs to implement these requirements with minimal impact on existing users. What should the admin do?

A.Use the Power Platform admin center to assign the 'Environment Maker' role to the security group.

B.Configure a Conditional Access policy in Microsoft Entra ID requiring MFA for the Power Platform app registration.

C.Create a Power Automate flow to monitor environment creation and send alerts.

D.Enable MFA within each Power Platform environment's settings.

AnswerB

Conditional Access policies enforce MFA for all Power Platform access. Restricting environment creation is done via Admin Center.

Why this answer

MFA is enforced through Conditional Access policies in Microsoft Entra ID, not within Power Platform. To limit environment creation, the admin should use the Power Platform Admin Center settings to restrict creation to a security group.

Practice this question →

145

Multi-Selecteasy

Which TWO of the following are valid reasons to create multiple Power Platform environments?

Select 2 answers

A.To increase the total storage capacity available.

B.To isolate data for different business units or projects.

C.To improve performance of Power Automate flows.

D.To separate development, testing, and production workloads.

E.To reduce the cost of Power Apps licenses.

AnswersB, D

Isolation helps with data governance and security.

Why this answer

Power Platform environments act as security and data boundaries, allowing organizations to isolate data for different business units or projects. Each environment has its own Dataverse database, which prevents data leakage and enables role-based access control tailored to specific teams or initiatives.

Exam trap

The trap here is that candidates may confuse environment isolation with performance or cost benefits, but the PL-900 exam specifically tests the understanding that environments are primarily for data and workload separation, not for scaling or licensing savings.

Practice this question →

146

MCQmedium

An organization has several Power Platform environments used for development and testing. They want to prevent accidental deletion of important data. What strategy should they implement?

A.Regularly export all data to Excel files and store them in OneDrive.

B.Set environment capacity limits to prevent storage of excessive data.

C.Enable versioning on all SharePoint lists used by Power Apps.

D.Use the Power Platform admin center to configure environment backups and enable solution checker.

AnswerD

Backups allow recovery; solution checker helps enforce best practices to avoid data loss.

Why this answer

The Power Platform admin center provides automated daily backups (with a 28-day retention for production environments) and allows manual backups, which directly protects against accidental data loss. Enabling solution checker is a separate best practice for quality assurance, but the core strategy for preventing accidental deletion is leveraging the built-in backup and restore capabilities.

Exam trap

The trap here is that candidates may confuse data protection strategies (like backups) with data governance tools (like capacity limits or solution checker), or assume that manual exports to Excel are a sufficient enterprise-grade backup solution.

How to eliminate wrong answers

Option A is wrong because manually exporting data to Excel files stored in OneDrive is not a scalable or reliable strategy; it introduces human error, lacks automation, and does not provide point-in-time restore capabilities for the entire environment. Option B is wrong because setting environment capacity limits prevents storage of excessive data but does not protect against accidental deletion of existing important data; it only caps future growth. Option C is wrong because versioning on SharePoint lists only protects data within SharePoint lists used by Power Apps, not the entire Power Platform environment (including Dataverse tables, flows, and apps), and does not provide environment-level backup or restore.

Practice this question →

147

MCQmedium

Refer to the exhibit. The JSON shows a Power Platform environment's properties in an ARM template. Based on the exhibit, which statement about this environment is true?

A.This environment is a Standalone environment without any linked environments.

B.This environment is a Production environment linked to a Sandbox environment.

C.This environment is a Sandbox environment linked to a Dynamics 365 instance.

D.This environment is a Production environment with no data storage.

AnswerB

The environmentType is Production, and linkedEnvironmentMetadata shows a Sandbox.

Why this answer

The exhibit shows an ARM template with properties including 'environmentType': 'Production' and 'linkedEnvironmentId' referencing a Sandbox environment. This indicates the Production environment is linked to a Sandbox environment for data synchronization or development purposes, which is a common configuration in Power Platform for lifecycle management. The presence of a linked environment ID confirms it is not standalone, and the environment type is Production, not Sandbox.

Exam trap

The trap here is that candidates often assume a Production environment cannot be linked to a Sandbox environment, or they confuse the 'environmentType' value with the linked environment's type, leading them to incorrectly select Option C or D.

How to eliminate wrong answers

Option A is wrong because the ARM template includes a 'linkedEnvironmentId' property, which means this environment is linked to another environment, so it is not a Standalone environment. Option C is wrong because the 'environmentType' property is set to 'Production', not 'Sandbox', so this environment is not a Sandbox environment. Option D is wrong because the ARM template does not indicate any restriction on data storage; the 'linkedEnvironmentId' and 'environmentType' properties do not imply 'no data storage', and Production environments typically have data storage.

Practice this question →

148

Multi-Selecthard

An administrator is managing a Power Platform environment that uses Microsoft Entra ID for authentication. The company wants to enforce multi-factor authentication (MFA) for all users accessing Power Apps. Which TWO configurations should the administrator implement? (Choose two.)

Select 2 answers

A.Configure the environment's 'User authentication' setting to 'Require MFA' in Power Platform admin center

B.Disable security group membership for the environment

C.Enable MFA in the environment's security settings under 'Require MFA'

D.Create a conditional access policy in Microsoft Entra ID that requires MFA for all cloud apps

E.Assign the 'System Administrator' role to all users

AnswersA, D

Correct. The Power Platform admin center's 'User authentication' setting allows you to require MFA for users accessing the environment.

Why this answer

To enforce MFA for all users accessing Power Apps, two configurations should be implemented: enabling the 'Require MFA' setting in the Power Platform admin center (Option A) and creating a conditional access policy in Microsoft Entra ID (Option D). The admin center provides a direct setting under environment User Authentication to require MFA. Option D provides organization-wide enforcement by applying a conditional access policy to all cloud apps.

Option C is incorrect because there is no separate 'Require MFA' option under environment security settings; the only built-in MFA toggle is the User Authentication setting. Options B and E are irrelevant.

Exam trap

The trap is that candidates may think only one method works (e.g., only the Entra ID conditional access policy), but the Power Platform admin center also provides a setting to require MFA for the environment. The question asks for two configurations, so you must select both valid approaches.

Practice this question →

← PreviousPage 2 of 2 · 148 questions total

Ready to test yourself?

Try a timed practice session using only Manage the Microsoft Power Platform environment questions.

Start 20-question session