PL 400 Security and Compliance 2 — Questions and Answers
Question 1: A Power Platform developer needs to restrict a canvas app so only users in a specific Azure AD security group can access it. What is the correct approach?
- Share the app directly with each individual user
- Share the app with the Azure AD security group (Correct answer)
- Set an environment variable to restrict access
- Create a custom connector with OAuth restrictions
Correct answer: Share the app with the Azure AD security group
Canvas apps can be shared with Azure AD security groups, granting access to all members of that group at once.
Question 2: Which Dataverse security concept allows you to grant a user access to records they own plus records shared with their business unit?
- Organization-level access
- Business unit-level access (Correct answer)
- Team-level access
- User-level access
Correct answer: Business unit-level access
Business unit-level access in Dataverse allows users to access their own records and those belonging to their business unit.
Question 3: A developer wants to ensure a Power Automate flow cannot access a specific SharePoint site outside the approved list. Which feature enforces this?
- Conditional Access policies
- Data Loss Prevention (DLP) policies (Correct answer)
- Azure AD App Registrations
- Power Platform admin center environment restrictions
Correct answer: Data Loss Prevention (DLP) policies
DLP policies can classify connectors and block flows from connecting to unapproved data sources like specific SharePoint sites.
Question 4: When implementing column-level security in Dataverse, what must be true before a user can read a secured column?
- The user must have a System Administrator role
- The user must be assigned to a Column Security Profile that grants read access (Correct answer)
- The user's security role must include the entity read privilege
- The user must be the record owner
Correct answer: The user must be assigned to a Column Security Profile that grants read access
Column security profiles explicitly grant read, create, or update permissions on secured columns independent of table-level security roles.
Question 5: A Power Platform solution includes a PCF control that calls an external API. Which mechanism should be used to store the API key securely within the solution?
- Hardcode it in the PCF TypeScript code
- Store it in an environment variable of type Secret (Correct answer)
- Store it in a canvas app global variable
- Add it to the solution's connection references
Correct answer: Store it in an environment variable of type Secret
Environment variables of type Secret store sensitive values in Azure Key Vault and are the recommended approach for secrets in Power Platform solutions.
Question 6: In Dataverse, which access mode allows an application to authenticate and perform operations without requiring a licensed user account for every API call?
- Delegated user access
- Non-interactive access
- Application user (S2S) access (Correct answer)
- Service principal with impersonation
Correct answer: Application user (S2S) access
Application users (S2S/server-to-server) authenticate via Azure AD app registrations and can perform Dataverse operations without a per-user license.
Question 7: A developer is building a model-driven app and wants to hide a specific form field for all users except members of a security group. What is the recommended approach?
- Use JavaScript to hide the field on form load
- Use column-level security with a Column Security Profile (Correct answer)
- Modify the security role to remove field access
- Use a business rule to hide the field conditionally
Correct answer: Use column-level security with a Column Security Profile
Column-level security profiles are the proper mechanism to restrict visibility and access to specific Dataverse columns based on group membership.
PL 400 Security and Compliance 2
A Power Platform developer needs to restrict a canvas app so only users in a specific Azure AD security group can access it.
What is the correct approach?