CertArea
All Microsoft exams

Free AB-400 practice test: 30 questions with answers

30 original questions for Extending Microsoft Power Platform Solutions with Code and AI, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

AB-400 exam guide: topics, cost and format

All 30 AB-400 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Extend the platform (10 questions)

  1. Question 1

    A plug-in must run only once for each record update, even when the same update triggers the plug-in through another step. Which technique helps prevent duplicate execution?

    1. AChecking the execution context and a guard value such as a depth or correlation check before processing
    2. BDisabling the Organization service for the plug-in assembly, which breaks the record update pipeline in production
    3. CRegistering the plug-in twice on the same message with identical filtering attributes and different execution stages
    4. DRunning the plug-in in a loop until it succeeds and retrying each failed attempt without a limit
    Show answer and explanation
    Correct answer: A

    Guards based on execution context prevent duplicate or recursive processing. Double registration duplicates work, loops amplify problems, and disabling the service breaks plug-ins.

  2. Question 2

    A Dataverse custom API should accept a request with input parameters and return a result that other apps can use. Which configuration is required?

    1. AA flow that runs every minute with no outputs and writes logs to a SharePoint list
    2. BA custom API message with defined request and response parameters bound to a plug-in
    3. CA web resource that returns static HTML and renders a page for each caller
    4. DA canvas app that exports a CSV file from a Dataverse table when pressed
    Show answer and explanation
    Correct answer: B

    A custom API with defined parameters and a bound plug-in gives a reusable, contract-based server operation. Static HTML, CSV exports and minute-level flows do not form an API contract.

  3. Question 3

    A plug-in must reference an external secret, such as an API key, and the key must be rotated without redeploying the plug-in. Which approach fits best?

    1. ARetrieving the secret at run time from a secure store such as Azure Key Vault using a managed identity
    2. BHardcoding the secret in the assembly and redeploying the signed build after each rotation with a version bump in every tenant
    3. CStoring the secret in the plug-in step description so that it is visible to every user with access
    4. DSharing the secret in a public repository and committing it to a shared branch so that CI builds can read it across teams
    Show answer and explanation
    Correct answer: A

    A secure store with managed identity lets secrets change without code changes. Hardcoding, descriptions and public repositories expose or complicate secrets.

  4. Question 4

    A plug-in must authenticate to an Azure service without storing credentials. Which identity mechanism should be used?

    1. AA managed identity granted the required role on the target resource
    2. BAn anonymous connection with no authorization header sent to the service endpoint
    3. CA shared service password in the plug-in configuration kept in source control
    4. DThe developer's personal account used in the plug-in step
    Show answer and explanation
    Correct answer: A

    Managed identities provide authentication without stored credentials and can be granted narrow permissions. Shared passwords, anonymous access and personal accounts are weaker or inappropriate.

  5. Question 5

    A plug-in performs several Dataverse operations that must succeed or fail together. Which approach ensures atomic behavior?

    1. ASplitting the operations across unrelated flows so each runs in its own transaction
    2. BRetrying the entire plug-in until it appears to work and logging each attempt
    3. CUsing an ExecuteTransactionRequest so the operations are processed in one transaction
    4. DRunning each operation separately and ignoring partial failures silently
    Show answer and explanation
    Correct answer: C

    ExecuteTransactionRequest groups operations so they commit or roll back together. Separate operations and ignored failures leave partial updates, and unrelated flows do not provide atomicity.

  6. Question 6

    An integration makes thousands of Dataverse calls and receives throttling responses. Which practice follows API limit retry guidance?

    1. AStopping further calls permanently after the first throttle response and marking the integration as failed
    2. BIgnoring throttle responses and reporting success from each batch so dashboards show no errors today
    3. CRetrying immediately in a tight loop without reading the Retry-After header and logging nothing across parallel threads
    4. DRetrying after the indicated wait time with exponential backoff and a maximum number of attempts
    Show answer and explanation
    Correct answer: D

    Retrying with the indicated wait and backoff respects service limits and recovers gracefully. Tight loops, permanent stops and ignored throttles all harm reliability.

  7. Question 7

    Which two practices help make a Dataverse plug-in reliable in production? (Choose two.)

    1. AIgnoring all exceptions to prevent user interruptions
    2. BCalling external services synchronously on every record change
    3. CHardcoding environment-specific URLs in the assembly
    4. DHandling exceptions with clear messages and tracing for diagnostics
    5. EKeeping synchronous work short and moving long operations to asynchronous processing
    Show answer and explanation
    Correct answer: D, E

    Clear exceptions, tracing and short synchronous work keep plug-ins reliable and diagnosable. Ignored exceptions, synchronous external calls on every change and hardcoded URLs create failures and maintenance problems.

  8. Question 8

    Which two statements about Dataverse business events are accurate? (Choose two.)

    1. AThey allow integration without polling the Dataverse table repeatedly
    2. BThey replace all plug-ins and flows entirely
    3. CThey can only be used inside canvas apps
    4. DThey cannot include any details about the record
    5. EBusiness events can notify external systems when specific events occur in Dataverse
    Show answer and explanation
    Correct answer: A, E

    Business events publish occurrences to external systems and avoid polling. They do not replace all automation, are not limited to canvas apps, and can carry record details.

  9. Question 9

    A custom connector must authenticate with OAuth 2.0 to a third-party API. Which configuration item defines the authorization endpoint and scopes?

    1. AThe connector's icon image, which is a PNG file and background color shown in the connector gallery listing
    2. BThe environment's display name, its unique environment ID, and the region-specific hostname shown in the portal
    3. CThe flow's name, its description text, and the owner's display label shown in the cloud flow list view pane
    4. DThe connector's security definition for OAuth 2.0 with authorization URL, token URL, and scopes
    Show answer and explanation
    Correct answer: D

    The OAuth security definition in the connector specifies endpoints and scopes that the platform needs for sign-in. Icons, flow names and display names do not configure authentication.

  10. Question 10

    A custom connector imports an OpenAPI definition, but one operation returns a field that the flow needs as a number, while the API returns it as a string. Which approach fixes this?

    1. AExtending the OpenAPI definition with a schema that describes the field type, or transforming it in the connector code
    2. BChanging the API's data to images that the flow can parse as binary attachments, with the value stored in the image's header
    3. CEditing the flow to ignore the field in the Power Automate designer by deleting the dynamic content token from the Compose action
    4. DDeleting the operation from the OpenAPI definition and republishing the connector without re-importing the schema changes in the flow
    Show answer and explanation
    Correct answer: A

    Adjusting the schema or transforming data in connector code corrects the type mismatch. Ignoring the field, changing data to images and deleting the operation do not solve the problem cleanly.

Extend the user experience (10 questions)

  1. Question 11

    A model-driven app form needs to show or hide a field based on the value of another field without a server round trip. Which approach is recommended?

    1. AA plug-in that runs on every read and returns field visibility from the server
    2. BA scheduled batch that updates the form nightly and writes results to the record
    3. CClient scripting using the Client API on the form's OnChange event
    4. DA flow triggered by a button in the browser after each click
    Show answer and explanation
    Correct answer: C

    Client scripting on OnChange reacts immediately in the browser without a server round trip. Plug-ins on read, browser-triggered flows and nightly batches do not provide immediate form behavior.

  2. Question 12

    A developer wants a command bar button that is visible only for records in an approved status. Which configuration supports this?

    1. AA ribbon button with a display rule based on the status column value
    2. BA button that remains visible and hides itself with CSS through a custom stylesheet
    3. CA canvas app button embedded in a model-driven form with an OnSelect formula
    4. DA flow that deletes the button when the status changes and rebuilds the ribbon XML
    Show answer and explanation
    Correct answer: A

    Display rules on ribbon buttons control visibility based on record values. CSS-only hiding is cosmetic, canvas buttons do not appear in the model-driven command bar, and flows do not manage button display.

  3. Question 13

    A PCF code component must read a value from a bound column and update the display when that value changes. Which lifecycle method handles the update?

    1. Ainit only
    2. Bdestroy
    3. CgetOutputs only
    4. DupdateView
    Show answer and explanation
    Correct answer: D

    updateView runs when bound data changes, so the component can re-render. init runs once at startup, destroy runs at cleanup, and getOutputs returns values rather than rendering updates.

  4. Question 14

    A Power Apps code app must call a Dataverse table and a cloud flow. Which configuration is required for these calls to authorize correctly?

    1. AMaking the table public for the code app and granting anonymous read access to every record in the environment
    2. BConfiguring connections for Power Platform services used by the code app, so calls run with the signed-in user's permissions
    3. CEmbedding a shared administrator password in the code so that sessions authenticate as the tenant admin
    4. DDisabling authentication in the code app and allowing unauthenticated requests to reach Dataverse tables
    Show answer and explanation
    Correct answer: B

    Configuring connections so calls run with appropriate permissions keeps authorization correct and secure. Embedded admin passwords, public tables and disabled authentication are unsafe.

  5. Question 15

    A Power Apps code app must display a list of records from Dataverse that changes frequently. Which design keeps the list current without overloading the service?

    1. AQuerying the table on load with needed columns and refreshing on a sensible interval or user action
    2. BRefreshing the page every second by re-running the full query and re-rendering the entire grid on each tick
    3. CCaching the full list permanently in browser memory and reusing it without server checks
    4. DLoading every table in the environment on each click and keeping results in the form cache
    Show answer and explanation
    Correct answer: A

    Targeted queries with reasonable refresh patterns keep data current and efficient. Permanent caches go stale, loading everything is wasteful, and second-level refreshes overload the service.

  6. Question 16

    Content Security Policy settings are configured for a code app that loads external scripts. What is the purpose of the policy?

    1. AMaking the app load scripts from an unrestricted list of origins, including inline and third-party sources at runtime
    2. BHiding the app from search engines by adding a robots noindex meta tag and blocking crawlers in robots.txt
    3. CRemoving authentication from the app so that anonymous visitors reach app data directly
    4. DRestricting which sources the browser can load scripts and resources from to reduce injection risk
    Show answer and explanation
    Correct answer: D

    CSP limits resource origins, which reduces cross-site scripting and injection risks. Allowing any source, removing authentication and hiding from search engines are not CSP purposes.

  7. Question 17

    A client script must navigate the user to a related record and show a notification when a save completes. Which Client API capability provides these?

    1. AThe browser's print dialog for the open form
    2. BNavigation and notification methods in the Client API
    3. CThe server's log viewer in the admin center
    4. DA static HTML page with a link that opens a new tab later
    Show answer and explanation
    Correct answer: B

    The Client API provides navigation and notification methods for model-driven apps. Print dialogs, log viewers and static links do not integrate with the app's client-side behavior.

  8. Question 18

    Which two practices improve the performance of a Power Apps code app? (Choose two.)

    1. ARequesting only the columns needed for each view
    2. BLazy loading components and assets that are not needed on first load
    3. CLoading the entire environment's metadata on every page view
    4. DMaking a server call for every keystroke
    5. EDisabling caching for static assets
    Show answer and explanation
    Correct answer: A, B

    Selective queries and lazy loading reduce data transfer and initial load time. Loading all metadata, per-keystroke calls and disabled caching slow the app.

  9. Question 19

    A form script must read the value of a lookup field and the name of the related record. Which Client API approach reads this?

    1. AReading the lookup attribute through the form context, which returns the referenced record's id and name
    2. BParsing the lookup value from the IIS server log file that records each HTTP request
    3. CReading the lookup value from the browser's history panel, which lists previously visited pages and cached form entries
    4. DReading the lookup value from the printer spool queue, which holds pending print jobs sent from the network printer driver
    Show answer and explanation
    Correct answer: A

    The lookup attribute value through the form context returns the referenced record's identifier and name. Logs, browser history and printer queues do not contain form data.

  10. Question 20

    A client script registered on a form event should run only after the form is fully loaded and should not be attached to every field. Which registration approach is recommended?

    1. ARegistering the script on every field's OnChange event with an inline anonymous function
    2. BRegistering the script on the form's OnLoad event with a named function
    3. CRegistering the script inside an HTML comment block in the form's header section
    4. DRunning the script manually from the browser console each time the form is opened
    Show answer and explanation
    Correct answer: B

    OnLoad runs after the form loads, and a named function registered there is the standard event handler approach. Per-field registrations, comments and console runs do not follow the handler registration model.

Build Microsoft Power Platform solutions (10 questions)

  1. Question 21

    A team must decide whether a requirement can be met with out-of-the-box functionality or needs custom code. Which factor should be evaluated first?

    1. AThe color of the app's logo in the header, since branding choices decide whether custom code is needed
    2. BThe name of the solution publisher and its prefix, since naming conventions do not affect the design
    3. CWhether a built-in feature such as a model-driven app view, business rule, or flow already meets the requirement
    4. DThe number of developers available for the project and their experience with C#, since staffing levels determine the build approach
    Show answer and explanation
    Correct answer: C

    Evaluating whether built-in features meet the requirement avoids unnecessary custom code. Logo colors, team size and publisher names do not determine the design.

  2. Question 22

    A plug-in and a cloud flow could both implement a business rule. The rule must block saving a record when a condition fails, before the save completes. Which option is correct?

    1. AA cloud flow with a synchronous trigger, because it can block a save at the pre-operation stage
    2. BA synchronous plug-in, because cloud flows run after the save and cannot block it
    3. CA canvas app button that runs validation formulas before saving the record in the Patch statement
    4. DA scheduled flow that runs nightly and checks records for the failing condition
    Show answer and explanation
    Correct answer: B

    Synchronous plug-ins can stop a save, while flows run after the change. Canvas buttons and nightly schedules do not enforce save-time validation.

  3. Question 23

    A solution uses environment variables and connection references for values that differ between development and production. Why is this recommended?

    1. AEach environment can supply its own values at deployment without changing the solution code
    2. BIt removes the need for security configuration, because environment variables encrypt connection credentials
    3. CIt makes the solution impossible to deploy, because the import fails on load
    4. DIt stores secrets in the solution display name, so the display name is exported
    Show answer and explanation
    Correct answer: A

    Environment variables and connection references let the same solution deploy to different environments with appropriate values. The other statements are incorrect.

  4. Question 24

    A team wants to deploy a solution from development through test to production with approvals between stages. Which feature supports this?

    1. AEditing production components manually after each release to fix defects missed in testing
    2. BDeploying directly from a personal environment into the production org
    3. CCopying exported solution files by email between environments manually
    4. DPower Platform Pipelines or CI/CD automation using Power Platform Build Tools
    Show answer and explanation
    Correct answer: D

    Pipelines and build tools automate and govern deployments across environments. Email copies, manual production edits and personal-environment deployments are not controlled processes.

  5. Question 25

    A solution depends on another solution that must be installed first. What should the developer manage to ensure the installation succeeds?

    1. AThe size of the source code file in the unpacked solution folder
    2. BThe user's favorite font in the theme editor during export
    3. CThe color of the required solution's icon in the Maker portal before import
    4. DSolution dependencies so the required solution is present before import
    Show answer and explanation
    Correct answer: D

    Managing solution dependencies ensures prerequisites are in place. Icon colors, file sizes and fonts do not affect dependency resolution.

  6. Question 26

    When should a team use a virtual table rather than copying data into Dataverse?

    1. AWhen the data should be deleted every night and rebuilt from a nightly copy
    2. BWhen the data is only needed in a spreadsheet for one-time reporting by finance staff
    3. CWhen data must stay in an external system and be accessed in place without storing a copy
    4. DWhen no users need access to the data during the migration window at this time
    Show answer and explanation
    Correct answer: C

    Virtual tables expose external data in place, which avoids copying it into Dataverse. Nightly deletion, spreadsheets and no-access scenarios do not describe the use case.

  7. Question 27

    Which Azure service is commonly used to monitor a Power Apps code app or extension in production with logs and telemetry?

    1. AAzure Bastion Standard
    2. BAzure Cost Management
    3. CAzure Application Insights
    4. DAzure Lighthouse Portal
    Show answer and explanation
    Correct answer: C

    Application Insights collects telemetry, logs and performance data for custom code. The other services provide access, costs and delegated management rather than app telemetry.

  8. Question 28

    A business rule for data validation must be applied consistently to records created from the model-driven app, the API, and integrations. Which place is most appropriate to enforce it?

    1. AIn a canvas app screen with Power Fx formulas on submit
    2. BOn the server, through a plug-in or Dataverse business logic
    3. CIn the browser through a form script for each field
    4. DIn a PowerPoint slide deck used for stakeholder review
    Show answer and explanation
    Correct answer: B

    Server-side logic applies to every channel, including the API and integrations. Browser-only scripts and canvas screens are bypassed by other clients, and slides are unrelated.

  9. Question 29

    Which two items should be included in the design of an automated deployment pipeline? (Choose two.)

    1. ADeployment settings specific to each environment
    2. BSkipping version control for the solution
    3. CApproval gates between environments
    4. DAutomated tests executed as part of the pipeline
    5. EManual changes made directly in production after each deploy
    Show answer and explanation
    Correct answer: C, D

    Approval gates and automated tests make deployments controlled and verified, and environment-specific settings keep releases correct. Manual production changes and skipped version control undermine the pipeline.

  10. Question 30

    Which two items should be documented for a solution's environment variables? (Choose two.)

    1. AThe default and per-environment values
    2. BThe developer's shoe size
    3. CThe room number of the team lead
    4. DThe company's holiday schedule
    5. EThe variable name and its purpose
    Show answer and explanation
    Correct answer: A, E

    The name, purpose and per-environment values let deployers configure the solution correctly. Personal details and schedules are not configuration documentation.