Free Extending Microsoft Power Platform Solutions with Code and AI (AB-400) Sample Questions

Correct answer: A — True

• A. True is correct: a business rule applies a fixed, deterministic formula to the input columns, so identical inputs always produce the identical output the audit requirement demands.
• B. False is incorrect: the proposed rule-based approach is deterministic by design, which is exactly what is required here, so the solution does meet the stated goal.

Correct answer: B — Create an environment variable with data type Secret, and configure it to retrieve the value from Azure Key Vault rather than storing it directly in the environment variable value table.

• A. Text values are stored in Dataverse in the environment variable value table, and a manual per-environment update process doesn't provide vault-backed protection, so the key would sit as plain text between imports.
• B. The Secret data type integrates with Azure Key Vault so the value is stored in a vault rather than in Dataverse directly, satisfying both the portability and the no-plain-text requirement.
• C. JSON environment variables are structured text stored the same way as Text variables; wrapping a secret inside a JSON object does not trigger any additional encryption or vault integration.
• D. A connection reference stores a link to an existing connection's authentication, not an arbitrary application secret like a third-party API key, so it cannot hold this kind of value.

Correct answers: A, C, E — Components inside a managed solution can't be edited directly; they must first be added to an unmanaged solution to be customized.; An unmanaged solution can be exported as either unmanaged, for source control, or managed, to produce a deployable build artifact.; Uninstalling a managed solution removes all the customizations and extensions it added, including any custom tables and their data.

• A. A managed component can't be customized in place; making a change requires adding it to an unmanaged solution first, which creates a dependency that blocks uninstalling the managed solution until it's removed.
• B. A managed solution can't be imported into the same environment that contains the unmanaged solution it originated from; a separate environment is needed to test the managed version.
• C. Exporting an unmanaged solution as either unmanaged, for source control, or managed, as a build artifact, is exactly how the two solution types support ALM.
• D. Deleting an unmanaged solution only removes the solution container; the customizations remain in effect and are attributed to the default solution, unlike deleting a managed solution.
• E. Uninstalling a managed solution removes everything it added, including custom tables and the data stored in their columns, which is why this is a destructive operation.
• F. Managed solutions can't be exported at all; only an unmanaged solution can be exported, and it can be exported as either unmanaged or managed.

Correct answer: A — Define a custom API on the table's Create message, implemented by a plug-in running synchronously in the pre-operation stage.

• A. A custom API gives a single, reusable message that the Web API, flows, and client scripts can all invoke the same way, and implementing it as a synchronous pre-operation plug-in lets the logic run inside the same transaction as the create request.
• B. A flow that reacts after the record is created runs outside the original transaction, so it can only clean up afterward rather than block the creation itself, which does not meet the synchronous requirement.
• C. Client-side script only runs in the model-driven form client, so it cannot be invoked from the Web API or from a flow, failing the cross-surface reuse requirement.
• D. An asynchronous post-operation plug-in runs after the record has already been committed and outside the original transaction, so deleting the record afterward is not equivalent to preventing its creation.

Correct answer: A — Configure an on-premises data gateway so the custom connector can route requests to the private API without exposing it publicly.

• A. An on-premises data gateway provides the network path for custom connectors to reach a private, non-internet-facing API without requiring the API itself to be exposed publicly or modified.
• B. Certification controls whether a connector is shared broadly across tenants and has nothing to do with letting the connector reach a private, on-premises API.
• C. Rebuilding the API with a public endpoint contradicts the requirement that the API remain non-internet-facing and that no code changes to it be made.
• D. Copilot Studio still needs an underlying connection mechanism such as a custom connector to reach an API, and importing an OpenAPI definition alone does not provide network access to a private API.

Correct answer: A — True

• A. Enabling the Dataverse MCP server exposes tools such as searching and creating records over the model context protocol at that server URL, so a non-Microsoft MCP client can connect and issue natural-language tool calls without a custom API.
• B. This option would apply if the MCP server did not expose search and create tools to non-Microsoft clients, but the Dataverse MCP server is explicitly documented to support clients such as Claude desktop.

Correct answer: B — Register an asynchronous post-operation plug-in that calls an Azure Function, which performs the REST API call and updates the quote once the response arrives.

• A. Dataverse enforces a strict synchronous plug-in execution time limit, and blocking the create transaction on an eight-second external call risks timeouts and unnecessarily locks the record for the duration of the wait.
• B. Offloading the long-running external call to an Azure Function from an asynchronous step keeps the plug-in pipeline fast and updates the quote once the freight API responds, matching the architecture guidance to push long-running work to a cloud service.
• C. Business rules and calculated columns can only operate on data already present in the record and related tables; neither can call an external REST API.
• D. Calling the API from the user's browser exposes credentials to the client and only runs when a user happens to have the form open, so it cannot guarantee every quote gets a rate.

Correct answer: A — Call `Xrm.WebApi.online.createRecord("task", taskData)`, passing the regarding lookup and subject inside the `taskData` object.

• A. createRecord is the Web API method for creating a new table row from client script, so passing task field values here creates the related Task without any postback.
• B. updateRecord only modifies the opportunity itself; it has no mechanism for generating an unrelated Task row as a side effect of the update call.
• C. openForm opens a form for manual entry, which fails the requirement of creating the Task automatically without extra user interaction.
• D. save() persists the current record's own changes; calling it twice does not create a second, different entity type like Task.

Correct answers: A, B, D — `Self.Selected.Item` returns Blank when zero records are selected in the grid, and `IsBlank` on it correctly detects that empty state.; `Self.Selected.AllItems` returns an empty table when nothing is selected, so `IsEmpty` on it reports true rather than throwing an error.; With AutoSave left at its default enabled setting, the form buffer is saved on the user's behalf before the command's formula begins executing.

• A. This is correct: when no row is selected, Item resolves to Blank, and IsBlank correctly detects that there is currently no selected record to act on.
• B. This is correct: with nothing selected, AllItems resolves to an empty table rather than an error, and IsEmpty on it reports true.
• C. This is incorrect: Item is documented as always blank whenever SelectionMax is not exactly 1, specifically to stop formulas from silently acting on only one of several selected rows.
• D. This is correct: with the default AutoSave setting, the form buffer is saved on the maker's behalf before the command formula runs, and any save problems are surfaced through the form's own UI.
• E. This is incorrect: State is documented as an enum representing Edit, New, or View mode for the selected control, not a text field holding a form's display name.
• F. This is incorrect: Dataverse is currently the only supported data source for model-driven app commanding, so a SharePoint-sourced row cannot appear as a Selected item here.

Correct answer: B — False

• A. This would only be true if alternate keys and FetchXML were listed among the supported Dataverse scenarios, but the documentation explicitly places both of them in the unsupported scenarios list alongside polymorphic lookups and entity metadata CRUD.
• B. The documentation's unsupported scenarios list explicitly names alternate key support and FetchXML support as not yet available for Dataverse table data sources in code apps, so this statement about direct support is false.

Correct answer: A — @microsoft/applicationinsights-web

• A. This is the package the documented setup steps install with `npm install` to initialize an Application Insights client inside a code app.
• B. This package name does not exist in the documented setup; the telemetry SDK used for code apps is the general-purpose Application Insights web package.
• C. This is a different Azure Monitor OpenTelemetry package; it is not the package referenced in the code apps Application Insights setup guidance.
• D. This package name does not exist in the documented setup; the Power Apps client library exposes a logger interface, but the telemetry SDK itself is a separate Microsoft package.

Correct answers: A, B, C — Simplify the Power Fx logic in App.OnStart and move formulas that do not depend on runtime state into App.Formulas instead.; Reduce the number of other screens that the affected screen depends on loading before it can become interactive for users.; Reduce the number of controls placed directly on the screen that is showing the elevated time to interactive measurement.

• A. The recommendation for high App.OnStart latency is to simplify its Power Fx and move formulas that do not need to run at startup into App.Formulas, reducing what has to complete before the app becomes interactive.
• B. The recommendation for elevated dependent screen counts is to reduce cross-screen dependencies, since loading additional screens before navigation completes adds to the wait time for interactivity.
• C. A high control count on a screen is called out as a factor in longer time to interactive, so reducing the number of controls on that screen directly addresses the flagged condition.
• D. Solution version numbers are metadata for ALM tracking and have no effect on runtime performance metrics or how the platform measures time to interactive.
• E. Application Insights telemetry collection happens after the app has already loaded and is not part of App.OnStart execution, so disabling it would not address elevated startup latency.

Correct answer: A — A virtual control renders through the platform's React-based pipeline and is the appropriate choice because it provides platform-managed rendering infrastructure supporting complex, high-volume interactive dataset visualizations overall.

• A. Virtual controls are built on the platform's own React rendering pipeline, which is designed to efficiently support dataset-heavy, interactive visualizations like a virtualized Kanban board, making it the fitting choice for this scenario's scale and interactivity requirements.
• B. Standard controls do render directly to a provided DOM container, but drag-and-drop interactions can be implemented in either control type through standard browser event handling, so DOM access alone is not the deciding factor for this scenario.
• C. The two control types differ meaningfully in their rendering approach, with virtual controls using the platform's managed React pipeline and standard controls managing their own DOM directly, so the choice is not purely a manifest-permission distinction.
• D. Virtual controls are commonly used for dataset-type grid and Kanban-style components specifically because of the virtualization and rendering efficiency they provide at scale, so they are not restricted to single-column field-type components.

Correct answer: A — Call `AccountsService.getMetadata({ schema: { columns: 'all' } })` at startup, cache the result, and read each attribute's `DisplayName.UserLocalizedLabel.Label` and `AttributeTypeName.Value` to drive labels and control types.

• A. The getMetadata method requesting all columns returns attribute metadata whose DisplayName carries the user-localized label and whose AttributeTypeName identifies the column's type, letting the form adapt automatically to customization or localization changes as documented.
• B. A manually maintained local file requires someone to remember to update it every time Dataverse customization changes, which is exactly the hardcoding problem the metadata-driven approach is designed to avoid.
• C. Deriving a label by capitalizing the logical name produces a made-up string that does not reflect the actual configured display name or its localized translation, so it would not adapt to real label changes.
• D. Retrieving a record only reveals which fields have values and their runtime shape, not the table's configured display names, attribute types, or localization, so it cannot reliably drive form labels.

Correct answer: A — The `feature-usage` node in `ControlManifest.Input.xml` omits a `uses` element with `name="WebAPI"`, so the platform blocks the component from accessing the Web API surface entirely.

• A. Component logic that calls Device, Utility, or Web API features must declare that usage in the manifest's feature-usage node, and a missing WebAPI declaration is exactly the kind of manifest omission that surfaces as a permissions-style failure when the code tries to invoke context.webAPI at runtime.
• B. The bound versus input usage attribute determines whether a property is tied to a column value or can also accept a static value from the maker, and it has no bearing on whether the component may call the Web API.
• C. External-service-usage domains matter for components calling out to services beyond the user's own Dataverse organization, but calling the built-in context.webAPI against the same organization does not depend on that node, so a mismatch there would not cause this symptom.
• D. Type-group definitions constrain which column data types a bound or input property can accept, which is unrelated to whether the runtime authorizes calls through the context.webAPI object.

Correct answers: A, B, C — Call GetService(typeof(IPluginExecutionContext)) to obtain the execution context describing the message, entity, and images for the current operation.; Call GetService(typeof(IOrganizationServiceFactory)) and then call CreateOrganizationService with the context's UserId to obtain an Organization service instance.; Call GetService(typeof(ITracingService)) to obtain a service that writes diagnostic messages to the PluginTraceLog table for later review.

• A. IPluginExecutionContext is the documented service to retrieve from IServiceProvider to access contextual data such as InputParameters, OutputParameters, and entity images for the current operation.
• B. The correct pattern for obtaining an Organization service instance is to get IOrganizationServiceFactory from the provider and call CreateOrganizationService with the desired user ID, typically the context's UserId.
• C. ITracingService is the documented service used to write trace messages that are stored in the PluginTraceLog table so a developer can review plug-in execution details.
• D. IServiceProvider does not expose a directly castable IOrganizationService type; attempting this cast throws an exception, which is why the factory pattern exists instead.
• E. IServiceProvider does not expose an IWebProxy service, and plug-ins are not supposed to call the Dataverse Web API from within plug-in code in the first place.
• F. IServiceEndpointNotificationService is used to post event data to registered service endpoints such as Azure Service Bus, not to read or modify entity images on the execution context.

Correct answers: A, B, C — Setting Is Private to true blocks the custom API from appearing in the $metadata service document, but a caller who already knows the message name can still invoke it.; Setting Is Function to true means the operation is invoked with a GET request and must include at least one response property to be valid.; The Enabled for Workflow property allows a custom API to be called from the classic workflow designer, but the custom API cannot be a function while this is enabled.

• A. Is Private hides the custom API from the metadata document and code generation tools, signaling that the publisher does not support outside use, but it does not technically block a caller who already knows the message name and composes a request manually.
• B. A Function is invoked with a GET request and must return data, so Dataverse requires at least one response property for the function definition to be considered valid.
• C. Enabled for Workflow lets the custom API be called as a workflow action from the classic designer, but this option cannot be combined with Is Function, since functions are not supported in that designer.
• D. There is currently no supported way to create a new privilege scoped only to a single custom API; publishers must reuse an existing privilege or one generated for a custom entity instead.
• E. Is Private only removes the API from discovery surfaces like the metadata document; it does not enforce a runtime block, so a caller who already knows the message name can still successfully invoke it.
• F. The Status and Status Reason columns exist on the custom API record but have no effect on whether the custom API is available; a custom API record cannot be activated or deactivated to change its availability.

Correct answer: A — Read the wait duration from the Retry-After value in ErrorDetails instead of sleeping a fixed five seconds, because the server calculates that duration from recent load.

• A. The Retry-After duration in the fault's error details reflects the server's own assessment of how long to wait based on recent request volume, so reading it produces the correct delay instead of a guess.
• B. Swapping the synchronous wait for an asynchronous one changes how the thread blocks but does not fix the underlying problem of using a fixed guessed duration instead of the server-provided value.
• C. The error code -2147015902 specifically identifies the number-of-requests service protection fault, so removing that check would retry on unrelated errors instead of targeting the throttling condition.
• D. The Retry-After duration varies with how demanding recent requests were, so hardcoding sixty seconds either wastes time when a shorter wait would do or still fails when a longer wait is required.

Correct answer: A — Replace InteractiveBrowserCredential() with ClientSecretCredential(tenant_id, client_id, client_secret), since it authenticates as the application itself.

• A. The message names the combined execution-time limit specifically, so the fix is to shrink how demanding each batch is — smaller or simpler batches — since this limit tracks total processing time, not just request count.
• B. The number-of-requests limit has its own distinct error message about exceeding 6,000 requests; this message instead names execution time, so throttling request count alone doesn't target the limit that was actually hit.
• C. The concurrent-requests limit has its own separate error citing the number of simultaneous calls; this message is about cumulative execution time over the window, not how many requests were open at once.
• D. Larger, more complex batches increase the total execution time counted against the window rather than reducing it, so growing the batch size further would make this specific error more likely, not less.

Correct answers: A, B, C — Every operation inside a single change set is treated as atomic, so a failure in one rolls back the others in that same change set.; GET requests are not permitted inside a change set, because a change set only groups operations that modify data.; A change set can include a Content-ID header so a later operation in it can reference an entity created earlier in the same set.

• A. Operations grouped in a change set are atomic: if any one fails, Dataverse rolls back the completed operations in that same change set rather than leaving a partial result.
• B. GET requests don't change data, so the OData specification and Dataverse both exclude them from change sets, which exist specifically to group write operations into one transaction.
• C. A Content-ID header lets a later request in the same change set reference the URI of an entity created earlier in it, using a $1-style reference in the request body or URL.
• D. A $batch request can contain up to 1,000 individual requests in total, so change sets inside it are bounded by that overall limit rather than being unlimited.
• E. Change sets are about transactional grouping, not deferred execution; the client still waits for the batch response, and asynchronous background processing is a separate mechanism using the respond-async preference.
• F. A change set defines its own multipart boundary distinct from the outer batch's boundary, and items inside it are delimited using that change set's own boundary value, not the batch's.

Correct answer: A — The child flow is missing a `Respond to a PowerApp or flow` action at the end, which is required to send output values back to whatever called the flow.

• A. This is correct: a child flow must end with a Respond to a PowerApp or flow action to send data back to its caller, and without it the child flow returns nothing regardless of what a Compose action stored internally.
• B. The Manually trigger a flow trigger is precisely the trigger type that supports being called as a child flow with input parameters and a paired response action, so this is not the underlying problem.
• C. The scenario states the parent already uses the Run a Child Flow step, so an HTTP-based call is not what is being described, and the missing response action is the actual cause of the empty output.
• D. Parent and child flows are documented to work best when created directly in the same solution for maintainability, but Dataverse does not have a rule that specifically blocks output values from crossing separate solutions at run time.

Correct answer: A — Microsoft Dataverse is the standard connector documented to natively support service principal sign-in for its triggers and actions.

• A. This is correct: documentation specifically calls out that the Dataverse connector supports service principal connections for both its triggers and actions, distinguishing it from many other standard connectors.
• B. Native service principal sign-in is specifically highlighted as a Dataverse connector capability rather than something available identically across all standard connectors.
• C. The requirement for a service principal connection is an application user with sufficient Dataverse security privileges, not a specific per-user premium license assignment tied to that application user.
• D. The Dataverse connector documentation states service principal connections work for both triggers and actions, so triggers such as row creation or modification are supported, not excluded.

Correct answer: A — No application user exists in Dataverse for the managed identity, or the application user has not been assigned a security role granting the needed privileges.

• A. A valid token proves authentication succeeded, but Dataverse still authorizes the caller separately through an application user record and its assigned security roles; without that mapping, the identity is authenticated but has no privileges.
• B. The Consumption plan supports managed identities and token acquisition the same as other hosting plans, so the plan choice does not block Entra ID token issuance.
• C. `DefaultAzureCredential` is designed to work non-interactively inside Azure resources by falling back to the managed identity credential automatically, which is exactly the scenario described.
• D. Dataverse's Web API accepts Entra ID tokens regardless of whether they came from a managed identity or a delegated sign-in, as long as the caller has a matching application user and security role.

Correct answers: A, B, C — Renew the Service Bus message lock periodically while processing continues, so it is not redelivered before the function finishes.; Use a `CancellationToken` so the function can stop gracefully if the host signals a shutdown mid-processing.; Route messages that repeatedly fail processing to a dead-letter queue for investigation instead of retrying indefinitely.

• A. Lock renewal keeps the message invisible to other consumers for as long as processing legitimately continues, preventing the duplicate delivery caused by an expired lock.
• B. A cancellation token lets the function respond to a host shutdown or timeout signal cleanly, avoiding partial or corrupted writes when processing is interrupted.
• C. Dead-lettering a message after repeated failures prevents it from looping indefinitely and gives engineers a queue to inspect for the underlying cause.
• D. There is no configurable execution ceiling for the Dataverse sandbox to raise, and the Service Bus message lock is unrelated to any plug-in's execution allowance.
• E. Disabling message locking removes the mechanism that prevents duplicate processing altogether, making the reliability problem worse rather than solving it.

Correct answers: A, B, C — Function chaining, to run a sequence of long-running steps where each step's output feeds the next step's input.; Fan-out/fan-in, to run multiple long-running sub-tasks in parallel and then aggregate their results once all complete.; The human interaction pattern, to pause an orchestration until an external event, such as an approval, is raised back to it.

• A. Function chaining is a documented Durable Functions pattern for running ordered steps where each step's result becomes the input to the next, well suited to a multi-stage workload.
• B. Fan-out/fan-in is a documented Durable Functions pattern for dispatching parallel sub-tasks and waiting for all of them to finish before continuing, which fits parallel long-running stages.
• C. The human interaction pattern lets an orchestration suspend itself until an external event such as an approval is raised, without consuming compute while it waits.
• D. Holding a Dataverse transaction open for an orchestration to finish reintroduces the exact synchronous timeout problem that moving work to Durable Functions is meant to avoid.
• E. Durable Functions persists orchestration state in its own configured storage account, not inside a plug-in's encrypted configuration field, which is not a mechanism Durable Functions uses.

Correct answer: A — https://contoso.crm.dynamics.com/api/mcp

• A. The Dataverse MCP remote server URL follows the pattern `https://{orgName}.crm.dynamics.com/api/mcp`, so substituting `contoso` for the organization name produces exactly this address. This is the endpoint any conforming MCP client, including Claude Code, points at to reach the tool surface.
• B. This host name mixes the Dataverse organization prefix with the generic `powerplatform.com` domain, which is not how the MCP endpoint is published. Dataverse MCP traffic is served from the org's own `crm.dynamics.com` host, not a shared platform domain.
• C. Placing `mcp` as a subdomain in front of the organization name reverses the actual URL structure, where the organization name is the subdomain and `/api/mcp` is the path. A client configured with this host would fail to resolve to the tenant's Dataverse instance.
• D. Swapping the order of the `mcp` and `api` path segments does not match the documented path `/api/mcp`. Even though the host portion is correct, the path mismatch means requests would not reach the MCP handler.

Correct answers: A, B, C — The Foundry agent must have the Activity protocol endpoint enabled, since it is not exposed by default.; The Foundry agent must have been created in the current (new) Microsoft Foundry portal, not a legacy one.; The maker must supply the Foundry agent's Agent Id when configuring the connection in Copilot Studio.

• A. Correct: a newly created Foundry agent exposes only the Responses and A2A protocol endpoints by default, so the Activity protocol endpoint must be enabled before Copilot Studio can connect to it.
• B. Correct: connecting to Microsoft Foundry agents from Copilot Studio is documented as only working for agents created in the new Microsoft Foundry portal.
• C. Correct: configuring the connection in Copilot Studio requires entering the Agent Id of the Microsoft Foundry agent being connected to.
• D. Incorrect: there is no documented requirement to re-publish the Foundry agent as a Copilot Studio template; the agent remains a Foundry agent that Copilot Studio connects to directly.
• E. Incorrect: there is no requirement to disable the Responses endpoint; the requirement is that the Activity protocol endpoint specifically be enabled, not that other endpoints be turned off.
• F. Incorrect: there is no documented requirement tying the Copilot Studio environment to the same Azure subscription hosting the Foundry project.

Correct answer: A — True

• A. This is correct. The A2A protocol is designed for exactly this case: delegating tasks with multi-turn support and rich structured metadata to an externally hosted agent built on its own framework, using an authentication method matched to how the target endpoint is secured.
• B. This is incorrect as an assessment. An A2A connection configured with an authentication method appropriate to the partner endpoint is the documented approach for delegating multi-turn, metadata-rich tasks to an externally hosted, framework-independent agent.

Correct answer: A — Register an Azure Service Bus service endpoint using the queue contract, so messages persist in the queue until the listener is ready to read them.

• A. A queue contract does not require an actively listening application at the moment Dataverse posts the message; the message is held in the queue, including in a persistent variant with a long but finite availability duration, until a listener performs a read.
• B. A webhook sends a synchronous HTTP POST with a 60-second timeout and has no built-in durable queue, so the listener must already be reachable at the moment the event fires or the request simply fails.
• C. A one-way contract requires an active listener at post time; without one, Dataverse retries with exponential backoff for a period and then aborts the related system job as failed rather than holding the message indefinitely.
• D. Event Hub is built for high-throughput streaming with a bounded retention window rather than guaranteed per-message delivery to a specific listener that may not yet exist when the event is published.

Correct answers: A, B — Event Hub is registered as a service endpoint contract distinct from the Service Bus queue, one-way, two-way, and REST contracts, and targets streaming scenarios rather than request/response messaging.; Event data posted to an Event Hub can be consumed by multiple independent downstream readers without Dataverse needing to know how many consumers exist.

• A. Event Hub is its own contract type alongside queue, one-way, two-way, and REST, and it is intended for streaming event data to be processed downstream rather than for synchronous request/response calls.
• B. Event Hub is designed so multiple independent consumers can read the stream, and Dataverse simply posts to the hub without tracking or limiting how many downstream readers exist.
• C. Returning a value to the calling plug-in is a feature of the two-way contract, not of Event Hub, which is a one-way streaming destination with no response channel back to Dataverse.
• D. Event Hub is registered as its own Azure integration endpoint type, not through the Register New WebHook command, and WebhookKey is a webhook authentication option rather than an Event Hub connection setting.
• E. Event Hub retains published events for a configured window so consumers can read them later; a message processing step still executes and posts the event regardless of whether a consumer happens to be actively reading at that moment.
• F. A message processing step still must be registered on the relevant message and table combination; Dataverse does not automatically forward every table's events to an Event Hub without that registration.

Correct answer: B — False

• A. A webhook sends a synchronous HTTP POST with a 60-second timeout and no built-in message queue, so this claim that it tolerates a temporarily offline listener is incorrect regardless of which authentication option is chosen.
• B. Because a webhook requires the listener to be reachable at the moment the event fires and provides no durable queuing, an offline listener causes the delivery to fail; a queue contract on Azure Service Bus would be needed to tolerate that downtime instead.

Correct answer: A — Apply the "Convert delimited string into array of objects" policy to the response of the Get Invoice action, targeting the tags property.

• A. This policy template runs on the response, splits a delimited string field into a new array, and requires no backend or code changes, which matches both stated constraints.
• B. Changing the backend API's response shape is a real fix but requires the Contoso Invoicing team to modify their service, which the maker explicitly wants to avoid.
• C. Custom code can perform this transformation, but it requires writing and maintaining a script, which is more effort than configuring an existing policy template for the same result.
• D. This extension is meant to populate an input parameter's list of selectable values from another operation, not to reshape an existing response field into an array.

Correct answer: B — False

• A. This statement would be incorrect: the chosen policy does not turn an array into a delimited string, so it cannot produce the outcome the goal describes.
• B. The chosen policy template converts a delimited string into an array, which is the opposite direction from what the goal requires, so it does not turn the invoice line item array into a comma-delimited string.

Correct answer: A — Add an `If-Match: *` request header, because including it turns the `PATCH` request into an update-only operation that returns `404 Not Found` when no record matches the alternate key in the URL.

• A. The `If-Match: *` header makes the `PATCH` request update-only, so Dataverse returns `404 Not Found` instead of creating a record when no row matches the alternate key in the URL.
• B. `If-None-Match: *` is used to block an update and only allow record creation, which is the opposite of the update-only behavior this scenario requires.
• C. Duplicating the alternate key value in the request body has no effect on whether the operation is treated as create-only or update-only, and the documented guidance is to omit key values from the body entirely.
• D. The Web API's `Upsert`/`Update` distinction is controlled by the `If-Match` header on a `PATCH` request, not by switching the HTTP method to `PUT`.

Correct answer: A — The values contain characters such as `/` and `&`; retrieve, update, and upsert requests fail when a key column holds `/`, `<`, `>`, `*`, `%`, `&`, `:`, `\`, `?`, or `+`.

• A. Dataverse documents that retrieve, update, and upsert operations don't work correctly when an alternate key column's value contains characters such as `/`, `<`, `>`, `*`, `%`, `&`, `:`, `\`, `?`, or `+`, which matches the IDs causing failures here.
• B. A whole number column would reject non-numeric input outright rather than silently truncating characters, and the described symptom matches the documented character restriction instead.
• C. A key whose index build is still in progress would cause uniqueness enforcement issues rather than failures isolated to values containing specific punctuation characters.
• D. The 900-byte total key size limit is a constraint on the overall key definition, not something that fails only for a subset of values containing particular characters like these.