PL 400 Security and Compliance 4

Question 1

A developer creates a custom API in Dataverse that should only be callable by other Dataverse processes, not external users. Which privilege controls this?

Accepted Answer

Mark the API as 'Is Private' in its definition

Answer

Setting a custom API as private prevents it from being discovered or called by external clients, limiting its use to internal Dataverse plugins and workflows.

Question 2

When configuring a Dataverse plugin to run in the context of a specific user rather than the calling user, which approach should the developer use?

Accepted Answer

Use IOrganizationService impersonation with the target user's ID

Answer

The Dataverse plugin SDK supports impersonation by passing the initiating user's ID to IOrganizationServiceFactory.CreateOrganizationService(), allowing operations to run in that user's security context.

Question 3

A company wants to prevent Power Platform users from exporting data from Dataverse to Excel. Which setting achieves this?

Accepted Answer

Disable the Export to Excel privilege in all security roles

Answer

Removing the 'Export to Excel' miscellaneous privilege from security roles prevents users from exporting Dataverse data to Excel directly from model-driven apps.

Question 4

In Power Platform, what is the purpose of 'Environment Security Groups' in the Power Platform admin center?

Accepted Answer

To restrict who can access the environment by limiting it to group members

Answer

Setting a security group on an environment restricts environment access so only members of that Azure AD group can log in and use apps within it.

Question 5

A developer needs to ensure that a Power Automate flow's service principal has the minimum required Dataverse permissions. Which role should be assigned to an application user for read-only reporting flows?

Accepted Answer

A custom security role with only Read privileges on required tables

Answer

Creating a custom security role with only the necessary read privileges follows least privilege principles and limits the blast radius of a compromised service principal.

(PL 400) Microsoft Certified Power Platform Developer Associate Practice Test

(PL 400) Microsoft Certified Power Platform Developer Associate Practice Test

PL 400 Security and Compliance 4