Demonstrate the capabilities of Power Apps →mediumMultiple ChoiceObjective-mapped

PL-900 Demonstrate the capabilities of Power Apps Practice Question

Exhibit

Refer to the exhibit.

{
    "name": "PowerAppPermissions",
    "type": "Microsoft.Authorization/roleDefinitions",
    "apiVersion": "2022-04-01",
    "properties": {
        "roleName": "Custom Power Apps User",
        "description": "Can use Power Apps",
        "type": "customRole",
        "permissions": [
            {
                "actions": [
                    "Microsoft.PowerApps/apps/read",
                    "Microsoft.PowerApps/apps/install"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ],
        "assignableScopes": [
            "/subscriptions/12345/resourceGroups/RG1"
        ]
    }
}

Refer to the exhibit. The Azure RBAC custom role definition shown is assigned to a user. What can this user do?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Read and install Power Apps in resource group RG1

The custom role includes 'Microsoft.PowerApps/apps/read' and 'Microsoft.PowerApps/apps/install' actions, which grant the user permission to read and install Power Apps in the assigned scope (resource group RG1). Therefore, option D is correct. Option A is incorrect because 'manage' implies full control (including write and delete), which is not granted. Option B is incorrect because creating new apps requires write permission, which is not included. Option C is incorrect because editing and deleting require write and delete permissions, which are not included.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Manage all Power Apps in the subscription
Why it's wrong here
Scope is limited to RG1 and only read/install.
✗
Create new Power Apps in resource group RG1
Why it's wrong here
No create action.
✗
Edit and delete Power Apps in resource group RG1
Why it's wrong here
No write or delete actions.
✓
Read and install Power Apps in resource group RG1
Why this is correct
The actions read and install are allowed.

Quick reference

Access Control Model Comparison

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

Go deeper

PL-900 Demonstrate the capabilities of Power Apps Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Access Control Model Comparison

Related to this question