Microsoft Certified: Power Platform Developer Associate — Set 1

Question 1

A developer needs to prevent duplicate Contact records based on a composite key of email address and company name. This validation must execute even when records are created directly through the Dataverse API by an external integration. The logic includes a custom lookup against an external identity service. Which implementation approach is most appropriate?

Accepted Answer

A Dataverse plug-in registered on the Pre-Operation stage executes synchronously within the database transaction before the write occurs, and it fires for all operations including direct API calls from external integrations. Form-scoped business rules (A) only execute in the model-driven app UI. Power Automate flows (B) execute asynchronously after the record is created, so they cannot prevent the creation. Canvas app formulas (D) only run within that specific app.

Question 2

A company stores employee performance reviews in an external SAP system. These records must be accessible in Power Apps model-driven apps, must respect Dataverse security roles, and must always reflect real-time data from SAP. Due to data sovereignty requirements, no copies of this data may be stored in Dataverse. Which table type should the developer recommend?

Accepted Answer

Virtual tables (virtual entities) in Dataverse project data from external sources in real-time without persisting it in Dataverse storage, while fully supporting Dataverse security roles, views, and model-driven app integration. Standard tables with synchronization (A) create stored copies, violating data sovereignty. Elastic tables (C) are designed for high-volume IoT/event-sourcing scenarios, not real-time external data projection. Canvas apps with custom connectors (D) do not integrate with Dataverse security roles.

Question 3

A developer is assessing the impact of Data Loss Prevention (DLP) policies on a planned Power Platform solution. Which THREE of the following statements accurately describe how DLP policies work? (Choose 3)

Accepted Answer

DLP policies enforce connector data group boundaries (A) — a flow cannot mix Business and Non-Business connectors. They can be scoped to a specific environment or the entire tenant (C). Connectors are classified into exactly three groups: Business, Non-Business, and Blocked (D). DLP policies do NOT apply to server-side code like plug-ins (B is wrong — plug-ins bypass connector infrastructure). Custom connectors ARE subject to DLP policies (E is wrong). DLP is enforced both at save time and at runtime (F is wrong).

Question 4

A developer exports a managed solution from a development environment and deploys it to production. After deployment, a production administrator directly customizes a field on the same table that the managed solution contains. The developer then deploys an updated version of the managed solution to production. What happens to the administrator's customization?

Accepted Answer

Power Platform uses a solution layering model where unmanaged customizations always exist in the highest layer and take precedence over managed solution layers beneath them. When a new version of the managed solution is redeployed, the administrator's unmanaged customization layer remains on top, overriding the managed layer for that specific property. The deployment succeeds; no merge or deletion of the unmanaged layer occurs automatically.

Question 5

A developer is building a solution that connects to different SharePoint sites across development, test, and production environments. The SharePoint site URL must be configurable per environment and must not require the solution to be modified when deployed to a new environment. What is the recommended approach?

Accepted Answer

Environment variables are the recommended mechanism in Power Platform solutions for storing configuration values that differ per environment. A String environment variable holds the SharePoint URL and is packaged in the solution. When deploying to a new environment, an administrator sets the current value without modifying the solution content. Connection references (B) manage connector authentication credentials, not URL configuration. Storing in a Dataverse table (D) works but is not the purpose-built ALM feature for this pattern.

Question 6

A development team uses Azure DevOps to automate Power Platform ALM. They need to export a solution from a development environment, store it in source control, then deploy a managed version to a test environment. Which sequence of Power Platform Build Tools tasks is correct?

Accepted Answer

The recommended ALM pipeline is: (1) Export Solution from the development environment as unmanaged, (2) Unpack Solution to decompose it into source-control-friendly individual files, (3) Pack Solution to reassemble as a managed solution for promotion to non-development environments, (4) Import Solution into the target environment. Skipping the Unpack/Pack steps (D) bypasses source control benefits and does not produce a managed solution. The other options have incorrect ordering.

Question 7

A canvas app developer connects to an Azure SQL Server table with 50,000 rows. The formula `Filter(SQLTable, StartsWith(Title, "Project") && Year(CreatedDate) = 2024)` returns incomplete results — only a subset of matching records. What is the most likely cause?

Accepted Answer

Delegation pushes filter and sort logic to the data source server. While `StartsWith` is delegable for SQL Server, `Year()` is a local Power Fx function that cannot be translated into a SQL query. When a compound filter contains a non-delegable function, Power Apps retrieves only the data row limit (default 500, max 2000 via settings) and applies the non-delegable part in-memory, producing incomplete results. The fix is to replace `Year(CreatedDate) = 2024` with a delegable date range: `CreatedDate >= Date(2024,1,1) && CreatedDate < Date(2025,1,1)`.

Question 8

A canvas app has a 5–8 second startup delay. The app loads 200 customer records from Dataverse on the first screen, and additional Dataverse queries run for several other screens. Which TWO actions are most likely to reduce the app's startup time? (Choose 2)

Accepted Answer

Two effective startup optimizations: (A) Enabling Delayed Load defers initialization of screens not immediately visible, reducing the work done before the first screen appears. (D) Moving data loading for non-initial screens from App.OnStart (which blocks all startup) to each screen's OnVisible means data for those screens loads only when the user navigates to them. Pre-loading everything in OnStart (C) makes startup worse, not better. Increasing the row limit (B) transfers more data, harming performance. Control type (E) does not address the data loading bottleneck.

Question 9

A developer reports that a JavaScript client script registered on a model-driven app form is not executing as expected. The developer needs to diagnose the issue in real-time without modifying the production environment. Which tool should be used?

Accepted Answer

The Monitor tool in Power Apps provides real-time diagnostics for both canvas and model-driven apps without requiring changes to the application in production. It captures form load events, control changes, client-side JavaScript errors, network calls, and event handler execution, making it the right choice for diagnosing client scripting issues. Plug-in Trace Logs (C) capture server-side plug-in execution, not client-side JavaScript. Azure Application Insights (D) requires explicit SDK instrumentation added to the app code.

Question 10

A PCF code component is bound to a text column on a model-driven app form. When a business rule on the same form programmatically changes the value of that bound column, which PCF lifecycle method does the framework call to notify the component of the updated value?

Accepted Answer

The `updateView()` method is called by the PCF framework whenever the component's context changes — including when the bound property's value is modified programmatically by a business rule, client script, or any other mechanism. `init()` is called only once when the component first loads. `getOutputs()` is called by the framework to retrieve the component's current output values after user interaction. `destroy()` is called when the component is removed from the DOM during navigation or form close.

Question 11

A developer must write client-side JavaScript for a model-driven app Account form that hides the 'Credit Limit' field whenever the 'Customer Type' field value is 'Internal'. The field visibility must be evaluated both when the form first loads and whenever a user changes the Customer Type field value. Which registration approach is correct?

Accepted Answer

The Client API supports both form-level events (OnLoad, OnSave) and field-level events (OnChange). Registering only on OnLoad (A) means the logic runs on form open but misses live user edits to the Customer Type field. The OnSave event (C) fires when the user saves — too late for a real-time visibility response. Client scripting absolutely can hide fields via `formContext.getControl(fieldName).setVisible(false)` (D is incorrect). The correct pattern is dual registration: form OnLoad for initial state and field OnChange for reactive updates.

Question 12

A developer is creating a PCF code component manifest. The component will bind to a Dataverse whole number column so users can interact with a custom slider control. Which value should be specified for the `of-type` attribute of the `<property>` element in the manifest?

Accepted Answer

In the PCF component manifest, `Whole.None` is the correct `of-type` value for a property bound to a Dataverse whole number (integer) column with no special formatting. `SingleLine.Text` binds to text columns. `Decimal` binds to decimal number columns. `Integer` is not a valid PCF manifest type identifier — the correct token for whole number is `Whole.None`. Using the wrong type will cause a manifest validation error or a runtime binding failure.

Question 13

A developer needs to implement a Dataverse plug-in that validates incoming data, can cancel the operation by throwing an exception, and requires access to the record's state before the current operation (Pre-Image). Which pipeline stage is most appropriate?

Accepted Answer

The Pre-Operation stage runs within the database transaction after platform validation but before the database write. It supports cancellation via `InvalidPluginExecutionException` and provides access to Pre-Images (the record's state before the current operation). Pre-Validation (A) runs before the transaction and outside the platform validation; Pre-Images are NOT available here. Post-Operation (C) runs after the database write, so cancellation cannot undo the committed change. Asynchronous Post-Operation (D) runs outside the transaction entirely.

Question 14

A developer is building a Dataverse plug-in registered on the Post-Operation stage of the Update message for the Contact entity. The plug-in must detect when the Email field has changed and, if so, write an audit record to a custom table. To access the previous email value before the update, what must the developer do?

Accepted Answer

Pre-Images capture the complete state of the record before the Update operation. They must be explicitly registered in the Plug-in Registration Tool for the specific message step, specifying a name (e.g., 'PreImage') and selecting the Email column. At runtime, the previous value is available via `context.PreEntityImages`. The `Target` InputParameter (A) only contains the fields explicitly included in the update request, not all field values. A Retrieve call inside the plug-in (C) would return the already-updated value, not the previous one. Post-Images contain the record state after the operation.

Question 15

A developer is reviewing a Dataverse plug-in that causes performance degradation in a high-volume environment. Which THREE of the following practices will most improve the plug-in's performance? (Choose 3)

Accepted Answer

(A) Limiting ColumnSet to only needed fields reduces data transfer and memory allocation per execution — critical in high-volume scenarios. (B) Registering non-critical plug-ins as asynchronous removes them from the synchronous user transaction path, reducing perceived latency. (D) Per-execution expensive initialization (e.g., building HTTP clients or loading large data) multiplies cost at scale — use lazy/static initialization guarded by null checks. (C) Both Organization service and Web API have comparable performance in plug-ins; the choice is contextual. (E) Increasing timeout does not improve performance and may mask underlying issues. (F) Early-bound classes improve code readability but the performance delta vs. late-bound is negligible.

Question 16

A developer is creating a custom connector for an internal REST API that uses OAuth 2.0 Authorization Code flow. Each user must authenticate with their own identity, and the API enforces per-user permissions. Which authentication type should be configured in the custom connector definition?

Accepted Answer

When the backend API uses OAuth 2.0 Authorization Code flow for per-user delegated access, the custom connector must be configured with OAuth 2.0 authentication. This enables each user to authenticate individually via their identity provider, obtaining their own access token that is passed with each API call — enforcing per-user permissions correctly. API Key (A) and Basic Authentication (B) are shared credentials that cannot enforce per-user permissions. Windows Authentication (D) is not a supported authentication type in Power Platform custom connectors.

Question 17

An Azure Function in a Power Platform solution needs to read records from Dataverse and write results to Azure Blob Storage. The security team requires that absolutely no credentials, secrets, or connection strings be stored anywhere in the function's configuration or source code. Which approach satisfies this requirement?

Accepted Answer

Managed identities eliminate all credential storage. A system-assigned managed identity is automatically provisioned and managed by Azure for the Function — it can be granted a Dataverse application user role (for Dataverse access) and the Storage Blob Data Contributor RBAC role (for blob access). The function authenticates to both services using its identity token, with no secrets stored anywhere. Option A still requires a Key Vault URI stored in app settings. Options C and D both involve storing secrets, violating the security requirement.

Question 18

A Power Automate cloud flow calls an HTTP action that may return a 429 (Too Many Requests) response. The developer wants the flow to automatically retry the action up to 3 times with exponentially increasing delays before failing. Which configuration achieves this?

Accepted Answer

Power Automate supports configuring retry policies directly on individual action steps via the action's Settings pane. The 'Exponential Interval' policy automatically retries with progressively longer delays between attempts. Setting Count to 3 limits retries to three attempts before the action fails. This is the built-in, recommended approach for handling transient errors like rate limiting. The Scope/Run-After approach (A) requires custom logic to count retries. Do Until loops (C) are a manual workaround that lack built-in backoff. Trigger retry policies (D) control trigger polling, not action execution.

Question 19

A developer is writing external .NET code that needs to perform bulk updates on 5,000 Contact records in Dataverse. Which approach provides the best performance for this bulk operation?

Accepted Answer

ExecuteMultipleRequest allows batching up to hundreds of create/update/delete operations into a single round trip to Dataverse, dramatically reducing the number of HTTP requests and cumulative network latency for bulk operations. Sequential individual API calls (A and B) each incur separate HTTP overhead and will hit service protection API limits quickly at 5,000 records. Power Automate flows (D) introduce orchestration overhead and are not designed for high-volume programmatic bulk operations from external code.

Question 20

An integration application calling the Dataverse Web API at high frequency starts receiving HTTP 429 responses with a `Retry-After: 15` header. The application must handle this gracefully without losing data or crashing. Which implementation correctly handles Dataverse service protection API limits?

Accepted Answer

Dataverse service protection limits return HTTP 429 with a `Retry-After` header specifying the minimum seconds to wait before the next attempt. The correct pattern is to honor this value — sleep for that duration and retry the same request. Immediate retries without delay (C) will continue receiving 429 responses and waste resources. Service protection limits apply equally to both the Web API and the Organization service (D is incorrect — no bypass exists). Failing without retry (A) causes data loss in integration scenarios.

Question 21

A developer has defined a Dataverse Custom API named `new_calculateDiscount` with input parameters for a customer tier and order amount, and an output parameter for the calculated discount percentage. After creating the Custom API definition, users calling the API report that it always returns an empty discount value. What is the most likely cause?

Accepted Answer

A Dataverse Custom API defines the message contract (input/output parameters) but contains no business logic itself. The actual calculation logic must be implemented in a plug-in that is explicitly bound to the Custom API's main operation step. When the API is called, Dataverse routes execution to that bound plug-in, which reads input parameters from the execution context and writes the result to the output parameter. Without a bound plug-in, the Custom API executes but returns empty/default output values. No parameter count minimums exist (A), and auto-invocation of existing plug-ins does not occur (D).

Question 22

A developer needs to configure a Dataverse service endpoint so that when an Account record is created, the event payload is delivered to an external web application as an HTTP POST request with a JSON body. Which service endpoint type should be selected?

Accepted Answer

Webhooks are the correct endpoint type when the external system expects incoming HTTP POST requests with a JSON payload. Dataverse sends the event message as an HTTP POST directly to the configured URL when the registered event occurs. Azure Service Bus Queue and Topic (A, D) and Azure Event Hub (B) are message broker services where Dataverse publishes messages that the external system then polls or subscribes to — they do not deliver HTTP POST requests directly to the external application.

Question 23

A developer is building an integration that runs every 15 minutes to synchronize Dataverse Contact records to an external CRM. The integration must only transfer records that were created or modified since the last sync run, and must handle large volumes efficiently. Which Dataverse feature should the developer use?

Accepted Answer

Dataverse change tracking, when enabled on a table, maintains a log of all create, update, and delete operations. Using `RetrieveEntityChanges` (Organization service) or the `$deltatoken` OData parameter (Web API), the integration retrieves only the exact set of records that changed since the last synchronization — identified by a server-generated delta token returned at the end of each sync. This is more efficient than timestamp queries (A), which can miss records in edge cases and require full-table scans. Power Automate flows (C) can miss events if disabled or throttled. Audit logs (D) are a compliance tool, not an efficient sync mechanism.

Question 24

An integration needs to synchronize customer records from an external system into Dataverse Contacts. Each customer has a unique `ExternalCustomerId` stored in a custom column `new_externalcustomerid`. The integration should create the Contact if no match exists, or update the existing Contact if one does, using this external ID as the lookup key. What is the most efficient approach?

Accepted Answer

Alternate keys allow Dataverse records to be identified by business-meaningful columns instead of system GUIDs. When combined with `UpsertRequest`, the integration performs an atomic create-or-update: if a Contact with the matching `new_externalcustomerid` exists it is updated; if not, a new Contact is created — in a single API call. The retrieve-then-create-or-update pattern (A) requires two round trips and has a race condition risk under concurrent load. Duplicate detection (C) blocks duplicates but does not handle updates. The Merge operation (D) is for deduplication after the fact, not synchronization.

Question 25

A developer needs to recommend mechanisms for an external application to receive notifications when Dataverse Contact records are updated. Which THREE of the following are valid, supported options for receiving Dataverse event notifications in an external system? (Choose 3)

Accepted Answer

Dataverse natively supports three service endpoint types for publishing events to external systems: Webhooks (HTTP POST to a URL), Azure Service Bus (Queue, Topic, or Relay), and Azure Event Hub (high-throughput streaming). These are registered using the Plug-in Registration Tool or programmatically via IServiceEndpointNotificationService in a plug-in. Audit log queries (D) are a pull-based compliance tool and cannot trigger external notifications. PCF components (E) run in the browser client and cannot subscribe to server-side Dataverse events for external system delivery. Business rules (F) do not support outbound HTTP calls to external endpoints.

PL-400 — Power Platform Developer Associate