CertSafari

    Free Microsoft Power Platform Developer (PL-400) Sample Questions

    35 free sample questions from our bank of 344+, covering every exam domain, with answers and detailed explanations. Updated August 2026.

    Practice all 344 questions in quiz mode

    Domain 1: Create a technical design

    Subdomain 1.2: Design solution components

    1.An integration design requires that, after Dataverse posts a data context to Azure Service Bus, the external listener application returns a string value back to the Dataverse plug-in that triggered the post. Which Service Bus contract type meets this requirement?

    1. A.Two-way
    2. B.Queue
    3. C.One-way
    4. D.Topic
    Show answer & explanation

    Correct answer: A — Two-way

    • A. A two-way contract behaves like a one-way contract except that it allows a string value to be returned from the listener to the plug-in or workflow activity that initiated the post.
    • B. A queue contract lets a listener read a message without needing to actively listen and supports destructive or nondestructive reads, but it has no mechanism for returning a value to the caller.
    • C. A one-way contract requires an active listener and retries the post with exponential backoff, but it never returns data back to the originating plug-in.
    • D. A topic contract is like a queue but supports multiple subscribing listeners; it does not provide a return path for a value back to Dataverse.

    Subdomain 1.2: Design solution components

    2.Which authentication methods does the custom connector platform natively support for securing calls to a backend REST API? (Select all that apply.)(Select 3)

    1. A.OAuth 2.0, including Microsoft Entra ID
    2. B.API key
    3. C.Basic authentication
    4. D.Kerberos
    5. E.NTLM
    6. F.SAML 2.0
    Show answer & explanation

    Correct answers: A, B, C — OAuth 2.0, including Microsoft Entra ID; API key; Basic authentication

    • A. Generic OAuth 2.0, including OAuth 2.0 for Microsoft Entra ID and other specific services, is one of the standard authentication methods documented for custom connectors.
    • B. API key is one of the standard authentication types listed for securing a custom connector's backend API.
    • C. Basic authentication is explicitly listed as a supported standard authentication method for custom connectors.
    • D. Kerberos is a Windows-integrated authentication protocol that is not among the standard custom connector authentication types documented for this platform.
    • E. NTLM is a legacy Windows authentication protocol and is not one of the supported custom connector authentication methods.
    • F. SAML 2.0 is an assertion-based federation protocol used elsewhere but is not listed as a supported custom connector authentication type.

    Subdomain 1.2: Design solution components

    3.A developer designing a custom API needs to decide whether the operation must return data using an HTTP GET request or can pass parameters in an HTTP POST body. This decision is controlled by the custom API's ___ property.

    1. A.Is Function
    2. B.Is Private
    3. C.Binding Type
    Show answer & explanation

    Correct answer: A — Is Function

    • A. The Is Function property is exactly what decides whether the custom API is invoked as a GET-based Function returning data, or a POST-based Action.
    • B. Is Private controls whether other developers can discover the message in $metadata; it has no effect on whether the operation uses GET or POST.
    • C. Binding Type controls whether the operation is tied to a table, a table collection, or nothing at all; it doesn't determine the HTTP verb used.

    Subdomain 1.1: Design technical architecture

    4.___ tables are the correct choice when a Power Apps solution must display data that lives in an external system in real time, without replicating it into Dataverse.

    1. A.Virtual
    2. B.Elastic
    3. C.Standard
    Show answer & explanation

    Correct answer: A — Virtual

    • Virtual. Virtual is correct because virtual tables retrieve their data dynamically from an external source through a data provider at runtime, with no replication into Dataverse.
    • Elastic. Elastic is incorrect because elastic tables store their own rows in Dataverse on Azure Cosmos DB rather than reading live from an external system.
    • Standard. Standard is incorrect because standard tables persist rows directly in the Dataverse database, which would require replicating the external data rather than reading it live.

    Subdomain 1.1: Design technical architecture

    5.A ___ policy classifies connectors as business, non-business, or blocked to control which connectors can be used together in the same app or flow.

    1. A.security role
    2. B.data loss prevention (DLP)
    3. C.environment variable
    Show answer & explanation

    Correct answer: B — data loss prevention (DLP)

    • security role. Security role is incorrect because roles govern user privileges on tables and operations, not which connectors can be combined.
    • data loss prevention (DLP). Data loss prevention is correct because DLP policies are exactly the mechanism that classifies connectors and restricts which classifications can appear together in a single app or flow.
    • environment variable. Environment variable is incorrect because environment variables store configuration values used by solution components, not connector classification rules.

    Subdomain 1.1: Design technical architecture

    6.To grant a user access to a specific record they don't own, and that their security role and business unit don't already cover, an administrator can use record ___ rather than changing the user's security role.

    1. A.sharing
    2. B.auditing
    3. C.delegation
    Show answer & explanation

    Correct answer: A — sharing

    • sharing. Sharing is correct because it grants access to an individual record as a targeted exception without altering the user's overall security role or business unit assignment.
    • auditing. Auditing is incorrect because auditing only tracks and logs changes to data; it does not grant any access to records.
    • delegation. Delegation is incorrect because it is not a Dataverse record-level access mechanism; it is unrelated to granting exception access to a specific record.

    Domain 2: Build Power Platform Solutions

    Subdomain 2.1: Configure and troubleshoot Microsoft Power Platform

    7.A development team needs an isolated, admin-provisioned environment for building and testing customizations, with the ability to copy and reset the environment during the test cycle, kept separate from production. Which environment type fits this need?

    1. A.Sandbox
    2. B.Trial
    3. C.Default
    4. D.Dataverse for Teams
    Show answer & explanation

    Correct answer: A — Sandbox

    • A. This nonproduction environment type specifically supports copy and reset operations and is designed for development and testing separate from production.
    • B. This environment type is meant for short-term evaluation, automatically expires after 30 days, and is capped at one per user, which doesn't fit an ongoing team development cycle.
    • C. This environment is shared tenant-wide for lightweight experimentation and offers no backup guarantees, making it unsuitable for a controlled dev/test cycle.
    • D. This environment type is auto-created for a Teams app and offers limited administrative control, with no option to customize security roles the way a dev/test cycle requires.

    Subdomain 2.1: Configure and troubleshoot Microsoft Power Platform

    8.A manager owns a single opportunity record and wants to give a colleague temporary access to just that record without changing the colleague's assigned security role. Which of the following would achieve this? (Select all that apply.)(Select 3)

    1. A.Using the Share privilege on the Opportunity table to grant record-level access without altering the colleague's role
    2. B.Adding the colleague to an access team associated with the record
    3. C.Assigning the colleague a new security role scoped to Business Unit access
    4. D.Sharing the record directly with the colleague from the record's Share dialog
    5. E.Raising the colleague's privilege depth on Opportunity to Organization
    Show answer & explanation

    Correct answers: A, B, D — Using the Share privilege on the Opportunity table to grant record-level access without altering the colleague's role; Adding the colleague to an access team associated with the record; Sharing the record directly with the colleague from the record's Share dialog

    • A. The Share privilege exists specifically so a record owner can extend access to another user on a single record while their underlying security role stays untouched.
    • B. Adding the colleague to an access team tied to that record grants access scoped to that team's records without any change to the colleague's own security role.
    • C. Assigning a new security role changes the colleague's overall access across every record of that type, which is a broader and different action than granting access to one record.
    • D. The Share dialog on an individual record is the direct mechanism for giving another user access to that one record while leaving their role unchanged.
    • E. Changing the privilege depth on the table affects the colleague's access to every record of that type, not just the single record in question.

    Subdomain 2.1: Configure and troubleshoot Microsoft Power Platform

    9.A ____ environment is created by an individual user holding a Power Apps Developer Plan license and is intended only for that owner's use.

    1. A.Developer
    2. B.Sandbox
    3. C.Trial
    Show answer & explanation

    Correct answer: A — Developer

    • A. This environment type is specifically tied to an individual's Developer Plan license and remains available only while that license stays active for the owner.
    • B. This environment type is a shared, admin-provisioned space for team development and testing, not a personal license-tied environment for one owner.
    • C. This environment type is a short-term evaluation environment that expires after 30 days, unrelated to an ongoing Developer Plan license.

    Subdomain 2.2: Implement application lifecycle management (ALM)

    10.A developer applies a patch to a managed solution, then later imports an upgrade for the same solution. Which outcome accurately reflects how the upgrade affects the existing patch and base layers?

    1. A.The upgrade deletes the existing patches and the previous base layer, then installs a new layer immediately above where the base layer was
    2. B.The upgrade merges with the patch to form a single combined layer without deleting anything
    3. C.The upgrade is rejected until the patch is manually uninstalled first
    4. D.The upgrade is applied as an additional layer above the patch, leaving the original base layer and patch intact underneath
    Show answer & explanation

    Correct answer: A — The upgrade deletes the existing patches and the previous base layer, then installs a new layer immediately above where the base layer was

    • A. Applying a solution upgrade removes all existing patches and the prior base layer, then installs a fresh layer in their place; this also means components removed from the new version are deleted, unlike a patch or update.
    • B. An upgrade does not merge with the patch into one combined layer; it explicitly removes the patch layers as part of installing the new base layer.
    • C. Manually uninstalling the patch first is not required; the upgrade process itself handles removal of existing patches automatically as part of applying the new version.
    • D. An upgrade does not simply stack above the patch while preserving it; it replaces the base layer and deletes the patches rather than leaving them intact underneath.

    Subdomain 2.2: Implement application lifecycle management (ALM)

    11.Which statements about environment variables in Power Platform are accurate?(Select 3)

    1. A.The environment variable definition is a managed solution component while its value is treated as an unmanaged record
    2. B.A single environment variable can be referenced by multiple solution components of different types, such as both a canvas app and a flow
    3. C.Environment variable values should generally be excluded from the solution and supplied during deployment instead
    4. D.Environment variables can only ever be created manually and are never generated automatically by the platform
    5. E.Dataverse validates environment variable values server-side before saving, blocking invalid data from being entered through the Web API
    6. F.Environment variable values have no maximum character length, since they are stored as unstructured text
    Show answer & explanation

    Correct answers: A, B, C — The environment variable definition is a managed solution component while its value is treated as an unmanaged record; A single environment variable can be referenced by multiple solution components of different types, such as both a canvas app and a flow; Environment variable values should generally be excluded from the solution and supplied during deployment instead

    • A. This is correct: the definition ships as part of the managed solution, but the value record is treated as an unmanaged customization so it can differ per environment without being overwritten on upgrade.
    • B. This is correct: one environment variable can back many different component types at once, which is the main benefit cited for centralizing configuration changes to a single place.
    • C. This is correct: best practice is to include the definition in the solution but leave the value out so a fresh value is supplied for each target environment during import or pipeline deployment.
    • D. This is incorrect: Power Apps can automatically create environment variables when a maker adds certain data sources, such as SharePoint, to a canvas app if that setting is enabled.
    • E. This is incorrect: validation of environment variable values happens within user interfaces and the components that consume them, not within Dataverse itself, so values entered through code must be validated by the caller.
    • F. This is incorrect: environment variable values are limited to a maximum of 2,000 characters, so they are not unbounded.

    Domain 3: Implement Power Apps improvements

    Subdomain 3.1: Implement advanced canvas apps features

    12.Which Power Fx function lets a maker define short-lived named values from a record and use them within a single formula, without creating global variables?

    1. A.With
    2. B.Concurrent
    3. C.Sequence
    4. D.Switch
    Show answer & explanation

    Correct answer: A — With

    • A. With takes a record of named values and evaluates a second formula using those names as local scope, avoiding the need for global variables, which is exactly this pattern.
    • B. Concurrent runs multiple formulas in parallel rather than defining named local values from a record.
    • C. Sequence generates a table of sequential numbers for use in loops such as ForAll, unrelated to scoped named values.
    • D. Switch compares a value against a list of matches and returns a corresponding result; it does not create a local record scope.

    Subdomain 3.1: Implement advanced canvas apps features

    13.A canvas app's App.OnStart property loads data from four different SharePoint lists using four separate ClearCollect calls chained with semicolons. Users report the app takes a long time to open. Which change reduces load time by running the four data calls at the same time instead of one after another?

    1. A.Wrap the four ClearCollect calls inside a Concurrent function
    2. B.Move the ClearCollect calls into four separate Screen.OnVisible properties
    3. C.Replace ClearCollect with Collect in each call
    4. D.Add a Wait function before each ClearCollect call
    Show answer & explanation

    Correct answer: A — Wrap the four ClearCollect calls inside a Concurrent function

    • A. Concurrent evaluates the formulas supplied to it at the same time rather than waiting for each to finish before starting the next, so total wait time drops to roughly the longest single call instead of the sum of all four.
    • B. Splitting the calls across separate screens still runs them one at a time as each screen loads and does not make the original calls run in parallel.
    • C. Collect adds records to an existing collection instead of resetting it first, but it still executes sequentially when chained with semicolons; it introduces no parallelism.
    • D. Adding a delay before each call makes the app slower, not faster, since it forces the app to pause before continuing.

    Subdomain 3.2: Optimize and troubleshoot apps

    14.In Live monitor, a maker sees intermittent HTTP 429 responses while records are being added through a canvas app. Each createRow call is followed by several getRows calls against unrelated tables, and the app's ProgressCount.Text property calls CountRows across those tables. What is causing the extra requests and throttling?

    1. A.CountRows is not delegated for Dataverse, so each formula evaluation triggers additional row-fetch requests against every table it references
    2. B.The createRow calls are being retried automatically because of a missing primary key
    3. C.The app is missing a connection reference, so every table lookup falls back to a cached copy that must be refreshed constantly
    4. D.ProgressCount.Text is bound to a collection instead of a data source, which forces a full table reload on every keystroke
    Show answer & explanation

    Correct answer: A — CountRows is not delegated for Dataverse, so each formula evaluation triggers additional row-fetch requests against every table it references

    • A. CountRows isn't delegated for Dataverse, so every time the formula re-evaluates it has to pull rows back to count them locally, generating extra getRows calls per entity referenced and triggering throttling under load.
    • B. There's no indication of a missing primary key in the scenario; Dataverse generates record identifiers automatically, so this wouldn't explain the repeated getRows calls.
    • C. A missing connection reference would typically cause a connection error rather than intermittent 429 throttling paired with extra getRows calls tied to a specific formula.
    • D. The extra calls are tied to record creation and formula re-evaluation across Dataverse tables, not to keystroke-driven collection reloads.

    Subdomain 3.2: Optimize and troubleshoot apps

    15.To reduce the wait time caused by several independent connector calls in an app's OnStart property, a maker wraps them in the ___ function so they run at the same time instead of one after another.

    1. A.Concurrent
    2. B.With
    3. C.ForAll
    Show answer & explanation

    Correct answer: A — Concurrent

    • A. Concurrent evaluates multiple formulas within the same property simultaneously, so independent connector or Dataverse calls no longer wait on each other in sequence.
    • B. With evaluates a formula for a single record and is used to create readable named subformulas; it doesn't cause independent calls to run at the same time.
    • C. ForAll is a sequential function that processes one record at a time, which would not reduce the wait time from independent, unrelated connector calls.

    Domain 4: Extend the user experience

    Subdomain 4.1: Apply business logic in model-driven apps using client scripting

    16.A maker wants a custom page to open as a narrow panel docked to the side of the screen, not as a full page and not as a centered popup, when a user selects a command button. Which navigationOptions configuration achieves this?

    1. A.target set to 2 with position set to 2
    2. B.target set to 2 with position set to 1
    3. C.target set to 1 with no position specified
    4. D.target set to 2 with no width specified
    Show answer & explanation

    Correct answer: A — target set to 2 with position set to 2

    • A. Correct. Target 2 opens the page as a dialog, and position 2 renders that dialog as a side panel docked to the edge of the screen.
    • B. Incorrect. Position 1 with target 2 renders a centered dialog rather than a docked side panel.
    • C. Incorrect. Target 1 opens the page inline as a full page, which doesn't produce a docked side panel at all.
    • D. Incorrect. Omitting width doesn't change whether the dialog is centered or side-docked; position is what controls that placement.

    Subdomain 4.1: Apply business logic in model-driven apps using client scripting

    17.When building the pageInput object for Xrm.Navigation.navigateTo to open a custom page, the pageType property must be set to ___.

    1. A."custom"
    2. B."webresource"
    3. C."entityrecord"
    Show answer & explanation

    Correct answer: A — "custom"

    • A. Correct. The pageType value custom identifies the pageInput object as targeting a custom page rather than a form or web resource.
    • B. Incorrect. webresource is not the pageType value used for navigating to a custom page; custom pages use their own dedicated pageType.
    • C. Incorrect. entityrecord is the pageType used to open a table record's form, not a custom page.

    Subdomain 4.2: Create a Power Apps component framework (PCF) code component

    18.A code component's bound column value changes when a user edits a different field on the form and the form autosaves. Which lifecycle method does the framework call so the component can refresh what it displays?

    1. A.updateView
    2. B.init
    3. C.destroy
    4. D.getOutputs
    Show answer & explanation

    Correct answer: A — updateView

    • A. This method is invoked whenever any value in the property bag changes, including field values, dataset contents, or container size, so it is where the component re-renders to reflect the new data.
    • B. This method only executes once, at control creation time, so it does not run again in response to later data changes.
    • C. This method is only called when the component is being torn down from the DOM and does not handle ongoing data refreshes.
    • D. This method is called by the framework to collect updated output values from the component; it does not drive re-rendering of the view itself.

    Subdomain 4.2: Create a Power Apps component framework (PCF) code component

    19.To declare that a component wants to use the Device.getBarcodeValue capability, a developer must add a uses-feature element inside the ____ element in ControlManifest.Input.xml.

    1. A.feature-usage
    2. B.external-service-usage
    3. C.resources
    Show answer & explanation

    Correct answer: A — feature-usage

    • A. This element acts as the wrapper for uses-feature nodes, and the documented example specifically includes Device.getBarcodeValue as one of the declared features inside it.
    • B. This element is used to flag a component as premium because it connects to an external service domain, not to declare Device API feature usage.
    • C. This element lists the code, css, and resx files the component needs to render, not the runtime features it wants permission to use.

    Domain 5: Extend the platform

    Subdomain 5.2: Create custom connectors

    20.A developer is configuring Microsoft Entra ID authentication on the Security page of a custom connector that calls the Azure Resource Manager API. What value should be entered for Resource URL?

    1. A.https://management.core.windows.net/
    2. B.https://login.windows.net/common
    3. C.https://graph.microsoft.com/
    4. D.https://global.consent.azure-apim.net/
    Show answer & explanation

    Correct answer: A — https://management.core.windows.net/

    • A. The Azure Resource Manager tutorial specifies this exact resource URL, including the trailing slash, so tokens are issued for the correct target audience.
    • B. This endpoint is the OAuth authorization/token endpoint used during sign-in, not the resource identifier the token is issued for.
    • C. This is the resource URL used for Microsoft Graph calls, which is a different API than Azure Resource Manager.
    • D. This domain is used for the connector's generated consent redirect URL, not as the Resource URL security setting.

    Subdomain 5.2: Create custom connectors

    21.A connector was originally built against a test API endpoint, but the developer now needs every request the connector sends to be redirected to the production endpoint without changing the underlying OpenAPI definition. Which capability should the developer configure?

    1. A.A policy template that sets the host URL at runtime
    2. B.An x-ms-dynamic-values extension on the request parameter
    3. C.A new securityDefinitions entry in the OpenAPI file
    4. D.The x-ms-trigger extension on the operation
    Show answer & explanation

    Correct answer: A — A policy template that sets the host URL at runtime

    • A. Policy templates can override the connector's behavior at runtime, and a Set Host URL style template lets every outgoing call be redirected to a new endpoint without editing the OpenAPI definition.
    • B. This extension populates a dropdown of selectable values for a parameter; it has no effect on which host the connector calls.
    • C. Adding a security definition changes how requests are authenticated, not which server they are sent to, and it would also require editing the OpenAPI definition.
    • D. This extension marks an operation as a trigger and is unrelated to redirecting outbound request traffic to a new host.

    Subdomain 5.2: Create custom connectors

    22.A developer plans to add custom code to a connector to handle complex payload transformations. Which constraints apply to that custom code? (Select all that apply.)(Select 3)

    1. A.Only one script file is supported per custom connector
    2. B.The script must complete execution within 2 minutes
    3. C.The script file size cannot exceed 1 MB
    4. D.The script can use any .NET namespace without restriction
    5. E.The script can be tested through the on-premises data gateway
    6. F.Multiple Script classes can be registered per operation
    Show answer & explanation

    Correct answers: A, B, C — Only one script file is supported per custom connector; The script must complete execution within 2 minutes; The script file size cannot exceed 1 MB

    • A. Custom connectors support only a single script file, so all operation-specific logic must live inside that one Script class.
    • B. Custom code must finish running within a 2-minute limit, and requests that exceed it will time out.
    • C. The uploaded script file is capped at 1 MB in size, matching the same kind of hard limit applied elsewhere in the connector platform.
    • D. Only a specific, limited set of .NET namespaces is supported for custom code, so arbitrary namespace usage will fail to compile.
    • E. Custom code is explicitly not supported when a connector is used with the on-premises data gateway.
    • F. Only one Script class is supported per connector; branching between operations must be handled inside that single class, not through multiple classes.

    Subdomain 5.1: Create a Dataverse plug-in

    23.Which two statements correctly describe how to obtain and use IOrganizationService within a plug-in? (Choose 2.)(Select 2)

    1. A.Call CreateOrganizationService on an IOrganizationServiceFactory obtained from the service provider
    2. B.Use the resulting service to submit SDK requests such as create, update, retrieve, and delete against Dataverse
    3. C.Authenticate the calling user's credentials again before invoking any request through the service
    4. D.Use the Dataverse Web API client library inside the plug-in instead of the Organization service for table operations
    5. E.Instantiate IOrganizationService directly using its public constructor inside the Execute method
    Show answer & explanation

    Correct answers: A, B — Call CreateOrganizationService on an IOrganizationServiceFactory obtained from the service provider; Use the resulting service to submit SDK requests such as create, update, retrieve, and delete against Dataverse

    • A. The factory pattern obtained via GetService is the documented way to create an organization service instance scoped to a specific user inside a plug-in.
    • B. Once obtained, the organization service is the supported way to perform table operations from server-side plug-in code.
    • C. The calling user is already preauthenticated by the platform before the plug-in executes, so re-authenticating inside the plug-in is unnecessary and not the documented pattern.
    • D. The Web API is not supported for use inside plug-ins; server-side code must use the Organization service instead.
    • E. IOrganizationService is an interface obtained through the service factory, not a class with a public constructor that plug-in code instantiates directly.

    Subdomain 5.1: Create a Dataverse plug-in

    24.Which two practices are recommended to optimize the performance of Dataverse plug-ins? (Choose 2.)(Select 2)

    1. A.Configure entity images to include only the specific columns the plug-in logic requires
    2. B.Write plug-in classes so they remain stateless and don't cache execution-specific data as instance properties
    3. C.Use ExecuteMultipleRequest inside the plug-in to batch several SDK calls together
    4. D.Store the IOrganizationService instance as a static field so it can be reused across invocations
    5. E.Enable parallel threads within the Execute method to process independent operations concurrently
    Show answer & explanation

    Correct answers: A, B — Configure entity images to include only the specific columns the plug-in logic requires; Write plug-in classes so they remain stateless and don't cache execution-specific data as instance properties

    • A. Selecting only the needed columns for an image avoids retrieving and transferring unnecessary data, which is a documented performance recommendation.
    • B. Because the platform caches and reuses plug-in class instances, keeping the class stateless avoids thread-safety issues and unpredictable behavior across invocations.
    • C. Microsoft's guidance explicitly advises against using ExecuteMultipleRequest or ExecuteTransactionRequest inside plug-ins or workflow activities.
    • D. Service references and context data change with every invocation and should never be cached as class-level state, since doing so can apply stale data to later executions.
    • E. Multi-threaded or parallel execution within plug-ins and custom workflow activities is explicitly unsupported.

    Subdomain 5.3: Use platform APIs

    25.An integration sends an unusually large burst of Web API requests within a short period, and Dataverse begins rejecting further requests from that user. Which HTTP status code does the Web API return to signal this condition?

    1. A.429
    2. B.503
    3. C.401
    4. D.409
    Show answer & explanation

    Correct answer: A — 429

    • A. Dataverse returns 429 Too Many Requests when a user's traffic exceeds the number of requests, execution time, or concurrency service protection limits within the sliding window.
    • B. 503 signals general service unavailability rather than the specific per-user throttling behavior service protection limits are designed to produce.
    • C. 401 indicates the request lacks valid authentication credentials, which is unrelated to a user sending too much traffic.
    • D. 409 indicates a conflict, such as a concurrency violation on a specific record, not a volume-based throttling condition.

    Subdomain 5.3: Use platform APIs

    26.A high-volume client is designing its threading model and needs to stay under Dataverse's default concurrency ceiling. The default service protection limit for concurrent requests per user, per web server, is ___ or higher.

    1. A.52
    2. B.6,000
    3. C.20
    Show answer & explanation

    Correct answer: A — 52

    • A. 52 is the default number of concurrent requests per user, per web server, that Dataverse allows before returning a concurrency-related service protection error.
    • B. 6,000 is the default limit on the total number of requests within the five-minute window, not the concurrency ceiling this scenario is asking about.
    • C. 20 is lower than the documented default concurrency ceiling and would cause the client to under-utilize the available parallelism.

    Subdomain 5.4: Process workloads by using Azure Functions

    27.Before an Azure Function using a managed identity can successfully call the Dataverse Web API, what must an administrator configure in the target Dataverse environment?

    1. A.An application user linked to the identity's application ID, with a security role granting the needed privileges
    2. B.A new business unit dedicated exclusively to Azure Functions traffic
    3. C.A custom connector registered in the default solution
    4. D.A field-level security profile applied to every table the function will read
    Show answer & explanation

    Correct answer: A — An application user linked to the identity's application ID, with a security role granting the needed privileges

    • A. Dataverse authenticates the managed identity as an application user, so an administrator must create that application user record using the identity's application (client) ID and assign a security role that grants the privileges the function needs. Without this, the token presented by the function has no corresponding, authorized identity in the environment.
    • B. Creating a separate business unit organizes records and users but does nothing to establish or authorize the managed identity itself in Dataverse. It isn't a required or sufficient step for this authentication scenario.
    • C. Custom connectors are used for calling external APIs from Power Automate or Power Apps, not for granting an Azure Function's managed identity access to Dataverse. This addresses a different integration pattern entirely.
    • D. Field-level security profiles restrict access to specific columns for existing users and roles; they don't establish the application user's identity or its base access to the environment. This step would only matter after the application user already exists.

    Subdomain 5.4: Process workloads by using Azure Functions

    28.According to the guidance for writing a custom Azure-aware Dataverse plug-in, which practices are recommended when the plug-in posts the execution context to Azure for long-running processing? (Select all that apply.)(Select 3)

    1. A.Register the plug-in step to execute asynchronously for the best system performance
    2. B.Avoid adding extra business logic beyond modifying the context and posting it, since a retried async job re-executes the whole plug-in
    3. C.Use a synchronous registration so the external service update happens within the same transaction as the Dataverse change
    4. D.Run the plug-in outside the sandbox so it can spawn long-lived background threads
    5. E.Rely on the service endpoint notification service to initiate the post to the Service Bus
    Show answer & explanation

    Correct answers: A, B, E — Register the plug-in step to execute asynchronously for the best system performance; Avoid adding extra business logic beyond modifying the context and posting it, since a retried async job re-executes the whole plug-in; Rely on the service endpoint notification service to initiate the post to the Service Bus

    • A. The documented guidance recommends registering the plug-in to run asynchronously, since this gives the best overall system performance compared to a synchronous registration for this kind of work. Asynchronous execution also avoids holding up the triggering transaction.
    • B. Because a failed asynchronous post causes the entire plug-in logic to re-execute on retry, guidance warns against adding any logic beyond modifying the context and posting it, to avoid unintended side effects from repeated execution. Keeping the plug-in minimal limits the blast radius of retries.
    • C. Synchronous registration is specifically discouraged for updating an external service, since problems with an unavailable external service or large data volumes can hold up all users, and a rollback of the core operation would leave systems out of sync. This contradicts the documented recommendation.
    • D. Azure-aware custom plug-ins must run in the sandbox, which restricts them to calling organization service methods, Azure solution methods, or network access via a web client; spawning long-lived background threads outside this constraint isn't supported. The sandbox requirement is a hard restriction, not optional.
    • E. The plug-in uses the service endpoint notification service to notify the asynchronous service to post the current request's data context to the Azure Service Bus. This is the documented mechanism plug-ins use to initiate the Azure post.

    Subdomain 5.4: Process workloads by using Azure Functions

    29.A managed identity that is created and deleted along with the single Azure resource it is attached to, rather than existing as an independent, shareable resource, is called a ____ managed identity.

    1. A.user-assigned
    2. B.system-assigned
    3. C.federated
    Show answer & explanation

    Correct answer: B — system-assigned

    • A. A user-assigned managed identity is created as its own independent Azure resource and can be attached to multiple resources, persisting even if one of those resources is deleted. This is the opposite lifecycle behavior from what the statement describes.
    • B. A system-assigned managed identity is tied directly to the lifecycle of the single resource it was enabled on, so it is automatically created and deleted along with that resource. This matches the described one-to-one, non-shareable lifecycle exactly.
    • C. Federated is not a managed identity type; it describes a broader trust mechanism, such as federated identity credentials, rather than a category of managed identity with its own lifecycle. This option does not fit the terminology being tested.

    Subdomain 5.5: Configure Power Automate cloud flows

    30.A flow that must run for longer than the maximum single cloud flow run duration of ____ should be redesigned using a relay pattern that passes state between separate flow runs.

    1. A.30 days
    2. B.24 hours
    3. C.7 days
    Show answer & explanation

    Correct answer: A — 30 days

    • A. Correct. Cloud flows have a maximum run duration of 30 days, and processes needing to exceed that must be split into multiple runs with state shared through storage such as Dataverse or a file.
    • B. 24 hours is not the documented maximum run duration for a single cloud flow run; the actual limit is considerably longer.
    • C. 7 days is not the maximum single flow run duration; the platform allows a longer maximum of 30 days before a relay pattern becomes necessary.

    Subdomain 5.5: Configure Power Automate cloud flows

    31.When a Dataverse trigger's Scope is set to ____, the flow runs only for rows owned by the specific user who created the flow, rather than the wider business unit or organization.

    1. A.User
    2. B.Organization
    3. C.Parent: Child business unit
    Show answer & explanation

    Correct answer: A — User

    • A. Correct. The User scope restricts the trigger to rows owned by that individual user, the narrowest of the available scope options.
    • B. Organization scope is the broadest option, covering rows owned by anyone across the entire environment, which is the opposite of restricting to a single user.
    • C. Parent: Child business unit scope covers rows owned by anyone in the user's business unit or its child business units, which is broader than a single-user restriction.

    Domain 6: Develop integrations

    Subdomain 6.1: Publish and consume Dataverse events

    32.A developer opens the Plug-in Registration Tool to add new integrations that will let external systems consume Dataverse events outside of the standard plug-in pipeline. Which of the following are registered there as service endpoints for this purpose? (Select all that apply.)(Select 3)

    1. A.Webhook
    2. B.Azure Service Bus
    3. C.Azure Event Hub
    4. D.Power Automate cloud flow
    5. E.Custom Connector
    6. F.Logic App HTTP trigger
    Show answer & explanation

    Correct answers: A, B, C — Webhook; Azure Service Bus; Azure Event Hub

    • A. A webhook is registered directly in the tool as a service endpoint that posts execution context data to an external HTTP endpoint.
    • B. Azure Service Bus is registered as a service endpoint in the tool, defining the contract and authorization used to post data to the bus.
    • C. Azure Event Hub is registered as a service endpoint in the tool using the Event Hub contract type and a SAS connection string.
    • D. Cloud flows are configured and triggered from Power Automate itself, not registered as a service endpoint inside the Plug-in Registration Tool.
    • E. Custom Connectors are built and managed in the Power Platform maker experience, not registered as Dataverse service endpoints in this tool.
    • F. A Logic App trigger is configured in Azure Logic Apps; it is not one of the service endpoint types registered through the Plug-in Registration Tool.

    Subdomain 6.1: Publish and consume Dataverse events

    33.When the total HTTP payload posted to an Azure Service Bus service endpoint exceeds ___ KB, properties such as InputParameters, PreEntityImages, and PostEntityImages are removed from the message before it is sent.

    1. A.128
    2. B.192
    3. C.256
    Show answer & explanation

    Correct answer: B — 192

    • A. This is not the documented threshold at which Service Bus payload properties are trimmed; the actual limit is higher.
    • B. This is the documented size threshold for Azure Service Bus postings; past this size, specific properties are stripped and, if still too large, the message fails to send.
    • C. This figure is the threshold documented for webhook payloads, not for Azure Service Bus postings, so it does not apply here.

    Subdomain 6.2: Implement data synchronization with Dataverse

    34.A developer is choosing which columns on the Product table can be included in a new alternate key definition. Which of the following column types are valid choices? (Select all that apply.)(Select 3)

    1. A.Single line of text
    2. B.Multiple Lines of Text
    3. C.Lookup
    4. D.Currency
    5. E.Option Set
    Show answer & explanation

    Correct answers: A, C, E — Single line of text; Lookup; Option Set

    • A. Single line of text is one of the explicitly supported column types for alternate keys because it stores a discrete, indexable value.
    • B. Multiple Lines of Text isn't a supported alternate key column type; it isn't part of the documented list of valid key attribute types.
    • C. Lookup columns are explicitly supported for alternate keys, allowing a key to reference another record indirectly.
    • D. Currency columns aren't in the supported list of alternate key column types.
    • E. Option Set (picklist) columns are explicitly supported as alternate key column types.

    Subdomain 6.2: Implement data synchronization with Dataverse

    35.Before enabling change tracking, a developer wants to check the current status for several Dataverse tables using the Web API. Which approaches correctly determine whether change tracking is already enabled? (Select all that apply.)(Select 2)

    1. A.Query EntityDefinitions and filter on the ChangeTrackingEnabled property
    2. B.Request the $metadata document with annotations and look for the Org.OData.Capabilities.V1.ChangeTracking annotation
    3. C.Call the $count endpoint on the table's entity set
    4. D.Check only the CanChangeTrackingBeEnabled managed property, since it reflects the current enabled state
    5. E.Send a GET request with the Prefer: odata.track-changes header and check for a 200 response
    Show answer & explanation

    Correct answers: A, B — Query EntityDefinitions and filter on the ChangeTrackingEnabled property; Request the $metadata document with annotations and look for the Org.OData.Capabilities.V1.ChangeTracking annotation

    • A. Querying EntityDefinitions with a filter on ChangeTrackingEnabled directly reports which tables currently have the feature turned on.
    • B. The $metadata service document exposes an OData capability annotation for entity sets where change tracking is enabled, giving a metadata-based way to check status.
    • C. The $count endpoint reports a record count and has no bearing on whether change tracking is configured for the table.
    • D. CanChangeTrackingBeEnabled only reports whether the table is eligible to have the feature turned on, not whether it currently is enabled.
    • E. A 200 response to a tracked GET only confirms the request succeeded; it doesn't specifically confirm change tracking was enabled versus the header being silently ignored, so it isn't a reliable check compared to querying metadata directly.

    Want the full experience?

    These are just samples. Practice the full Microsoft Power Platform Developer (PL-400) question bank in quiz mode — free, no signup, with domain practice and exam simulation.

    Practice all 344 questions in quiz mode