PL 400 Security and Compliance 3 — Questions and Answers
Question 1: A company requires that Power Platform environments only allow connections to Microsoft 365 connectors and block all third-party connectors. How should DLP policies be configured?
- Set all Microsoft 365 connectors to Business and all others to Blocked (Correct answer)
- Set all connectors to Non-business to prevent data mixing
- Create separate environments for each connector type
- Use Azure AD Conditional Access to block third-party apps
Correct answer: Set all Microsoft 365 connectors to Business and all others to Blocked
DLP policies support a Blocked classification that prevents connectors from being used in any flow or app within the policy scope.
Question 2: Which Dataverse feature allows a developer to automatically share records with specific users or teams when a record meets defined criteria?
- Access Teams (Correct answer)
- Owner Teams
- Record sharing rules via Power Automate
- Cascading security roles
Correct answer: Access Teams
Access Teams allow dynamic sharing of individual records with specific users without changing ownership, ideal for scenario-based record access.
Question 3: A Power Automate flow uses an HTTP connector to call an internal API that requires OAuth 2.0. The token must be refreshed automatically. Which approach is most appropriate?
- Store the access token in a flow variable and manually refresh it
- Use a custom connector with OAuth 2.0 authentication configured (Correct answer)
- Hardcode the bearer token in the HTTP action header
- Use a connection reference pointing to a generic HTTP connector
Correct answer: Use a custom connector with OAuth 2.0 authentication configured
Custom connectors support OAuth 2.0 configuration that handles token acquisition and refresh automatically, abstracting credential management from the flow.
Question 4: In Power Platform, what does the 'Minimum Privilege' principle mean when assigning Dataverse security roles?
- Users should receive the highest role to avoid access issues
- Users should receive only the permissions necessary to perform their job functions (Correct answer)
- All users should share a single role for simplicity
- Roles should be assigned at the organization level only
Correct answer: Users should receive only the permissions necessary to perform their job functions
The principle of least privilege requires granting only the minimum permissions needed for a user to accomplish their intended tasks.
Question 5: A developer needs to audit which users accessed sensitive Dataverse records over the past 30 days. Which feature provides this capability?
- Power Platform admin center activity log
- Dataverse auditing with audit log queries (Correct answer)
- Azure Monitor diagnostic settings
- Microsoft 365 compliance center audit search
Correct answer: Dataverse auditing with audit log queries
Dataverse auditing tracks read, create, update, and delete operations on tables and can be queried through the audit log in the Power Platform admin center.
Question 6: Which Azure AD feature can be used to require MFA for users accessing Power Apps in a specific environment based on their location?
- Azure AD Privileged Identity Management
- Azure AD Conditional Access policies (Correct answer)
- Azure AD Identity Protection risk policies
- Azure AD B2B collaboration settings
Correct answer: Azure AD Conditional Access policies
Conditional Access policies can enforce MFA requirements for Power Platform applications based on conditions like user location, device compliance, or risk level.
Question 7: A Power Apps portal (Power Pages) needs to allow anonymous users to submit forms but restrict record viewing to authenticated users. Which feature controls this?
- Table permissions with anonymous access scope
- Web roles with Entity permissions for authenticated users (Correct answer)
- DLP policies restricting portal connectors
- Azure AD B2C authentication profiles
Correct answer: Web roles with Entity permissions for authenticated users
Power Pages uses web roles and table permissions to control access; authenticated web roles can grant read access to records while anonymous users only submit.
PL 400 Security and Compliance 3
A company requires that Power Platform environments only allow connections to Microsoft 365 connectors and block all third-party connectors.
How should DLP policies be configured?