PL 400 Security and Compliance 5 — Questions and Answers
Question 1: A Power Platform developer needs to comply with GDPR requirements by enabling users to request deletion of their personal data from Dataverse. Which built-in capability supports this?
- Dataverse audit log purge tool
- Microsoft Purview Data Subject Request (DSR) in the compliance center (Correct answer)
- Power Platform admin center Data Policies section
- Azure Data Factory pipeline for Dataverse record deletion
Correct answer: Microsoft Purview Data Subject Request (DSR) in the compliance center
Microsoft Purview's Data Subject Request feature allows administrators to find and delete personal data across Microsoft 365 services including Dataverse in response to GDPR requests.
Question 2: When a Power Apps canvas app is shared using 'Can Edit' permissions, what additional risk does this create compared to 'Can Use'?
- Edit users can bypass DLP policies
- Edit users can see and modify the app's data connections including credentials (Correct answer)
- Edit users gain System Administrator access to Dataverse
- Edit users can publish the app to all users in the tenant
Correct answer: Edit users can see and modify the app's data connections including credentials
Users with 'Can Edit' permissions can open the app in Power Apps Studio and view or modify embedded connection credentials and data source configurations.
Question 3: A Dataverse plugin needs to securely retrieve a password to call an external service. Which approach is most secure?
- Hardcode the password in the plugin assembly
- Store the password in a Dataverse table record with column-level security
- Use a Secure Configuration string in the plugin step registration (Correct answer)
- Pass the password via an input parameter on the plugin message
Correct answer: Use a Secure Configuration string in the plugin step registration
Plugin step Secure Configuration stores encrypted values that are only accessible to the plugin code at runtime and are not visible in the plugin registration UI after saving.
Question 4: A developer configures a Power Automate flow that sends emails with sensitive data. To comply with company policy, all emails must be encrypted in transit. What ensures this for Office 365 Outlook connector emails?
- Enable DLP policies for the Outlook connector
- Configure S/MIME certificates in Microsoft 365 and use the Encrypt option in the Send Email action (Correct answer)
- Set the flow environment to a GCC High region
- Use a custom connector with TLS 1.3 enforcement
Correct answer: Configure S/MIME certificates in Microsoft 365 and use the Encrypt option in the Send Email action
S/MIME or Microsoft 365 Message Encryption (OME) can be applied to emails sent via Power Automate using the Outlook connector's sensitivity and encryption options.
Question 5: In the Power Platform, what is the effect of enabling 'Cross-tenant inbound restrictions' in the tenant isolation settings?
- Prevents users from creating environments in other Azure regions
- Blocks connectors from establishing connections originating from other tenants into your tenant (Correct answer)
- Prevents guest users from accessing Power Apps in your tenant
- Disables all third-party connector usage across all environments
Correct answer: Blocks connectors from establishing connections originating from other tenants into your tenant
Cross-tenant isolation inbound restrictions block connections where the connector authenticates using credentials from an external tenant to access resources in your tenant.
Question 6: A developer needs to ensure Power Pages (portals) forms do not expose Dataverse table names or column schema to anonymous web users. Which setting prevents schema exposure?
- Disable the Dataverse Web API for the portal
- Configure table permissions to deny global read and restrict the OData endpoint (Correct answer)
- Set all Dataverse tables to private in the maker portal
- Enable Azure Front Door WAF rules for the portal
Correct answer: Configure table permissions to deny global read and restrict the OData endpoint
Properly configured table permissions prevent the portal's OData endpoint from exposing table schemas or returning unauthorized records to anonymous users.
Question 7: Which Power Platform governance feature allows administrators to detect when users are creating flows that connect to unapproved data sources before the flows are published?
- Power Platform CoE Starter Kit with DLP Editor and compliance components (Correct answer)
- Azure Defender for Cloud Apps integration with Power Platform
- Power Platform activity logging in Microsoft Sentinel
- Environment-level flow approval workflows
Correct answer: Power Platform CoE Starter Kit with DLP Editor and compliance components
The CoE Starter Kit includes compliance and DLP audit components that alert administrators to policy violations and unapproved connector usage in flows across environments.
PL 400 Security and Compliance 5
A Power Platform developer needs to comply with GDPR requirements by enabling users to request deletion of their personal data from Dataverse.
Which built-in capability supports this?