PL-900 Demonstrate the capabilities of Power Apps Practice Question
Your organisation has a Power Apps canvas app that uses a custom connector to call an external API. The API key is stored in a global variable. What is the security concern with this approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The API key can be exposed to end users in the app code.
Storing an API key in a global variable within a Power Apps canvas app is insecure because the app's code is accessible to end users. Anyone with access to the app can view the global variable's value through the App object or by inspecting the app's formulas, potentially exposing the API key. The correct answer is D. Option A is incorrect because custom connectors can be used with Power Apps. Option B is incorrect because global variables in Power Apps are writable, not read-only. Option C is incorrect because API keys typically do not expire quickly; the security concern is exposure, not expiration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The custom connector cannot be used with Power Apps.
Why it's wrong here
Custom connectors are supported in Power Apps.
- ✗
Global variables cannot store API keys because they are read-only.
Why it's wrong here
Global variables can store any value, including API keys.
- ✗
The API key will expire quickly.
Why it's wrong here
Expiry is not the primary security concern.
- ✓
The API key can be exposed to end users in the app code.
Why this is correct
Global variables are part of the app code and can be seen by users with edit permissions or through debugging tools.
Go deeper
Related to this question
About these practice questions
This PL-900 question is part of Courseiva's 904-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PL-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-900 exam.