CertArea
All Microsoft exams

Free PL-400 practice test: 30 questions with answers

30 original questions for Microsoft Power Platform Developer, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

PL-400 exam guide: topics, cost and format

All 30 PL-400 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Extend the platform (15 questions)

  1. Question 1

    A plugin must validate a new account record before it is saved and cancel the operation if a required field is missing. Which plugin registration is correct?

    1. AAn asynchronous plugin on the PostOperation stage that runs after the save
    2. BA synchronous plugin on the PreValidation or PreOperation stage for the Create message
    3. CA plugin registered on the Retrieve message with no effect on Create, which just reads the row for display
    4. DA plugin that runs just in the background after the record already exists
    Show answer and explanation
    Correct answer: B

    A synchronous plugin in PreValidation or PreOperation can throw an exception to cancel the Create before it commits. Asynchronous post-operation plugins run after the record is saved, and Retrieve does not validate creation.

  2. Question 2

    A plugin performs a long-running calculation that does not need to block the user's save. Which execution mode should be used?

    1. ASynchronous execution in the PreValidation stage
    2. BSynchronous execution with an infinite loop in its body
    3. CA plugin registered on the Delete message as a sync step
    4. DAsynchronous execution in the PostOperation stage
    Show answer and explanation
    Correct answer: D

    Asynchronous execution in PostOperation runs in the background so the user does not wait, which suits long calculations. Synchronous steps block the save and risk timeouts, and Delete is unrelated to the calculation.

  3. Question 3

    A plugin must read the values of a record before an update and compare them with the new values. Which plugin image should be configured?

    1. AA plugin with no images, using a seeded random number at runtime
    2. BA pre-image registered on the step for the Update message
    3. CA post-image registered on the Delete message alone
    4. DA web resource that reads the record in the browser session alone
    Show answer and explanation
    Correct answer: B

    A pre-image contains the record's values before the update, which allows comparison with the target values. A post-image is for after the change, and a Delete step or browser-only logic does not provide the original values inside the plugin.

  4. Question 4

    A developer wants to prevent infinite recursion when a plugin updates a record that triggers the same plugin again. What is the best technique?

    1. AUsing a random delay before each update so that concurrent executions spread out in time on the same record in the queue
    2. BChecking the InputParameters or the execution context depth and skipping work when the plugin is already running for that record
    3. CCalling the update in a tight loop until it works, retrying on each failure with no delay between attempts and no retry limit configured in the plugin step
    4. DDisabling the active plugins on the organization by turning off plugin execution at the organization level for the environment during update
    Show answer and explanation
    Correct answer: B

    Checking execution context depth or a guard on the operation prevents the plugin from triggering itself endlessly. Loops, disabling all plugins and random delays do not solve the recursion safely.

  5. Question 5

    A plugin must run only when a specific column changes on the Account table, to avoid unnecessary executions. Which step configuration supports this?

    1. ARegistering the plugin on every message without filter values
    2. BRunning the plugin on the Create message alone for each new row
    3. CSetting the filtering attributes on the Update step to the specific column
    4. DChanging the column's data type to text across the Account table
    Show answer and explanation
    Correct answer: C

    Filtering attributes on the Update step limit execution to changes in the specified columns. Unfiltered registrations run too often, Create-only registration misses updates, and changing types is unrelated.

  6. Question 6

    A plugin needs to access the calling user's identity for auditing, not the identity of the system service that runs the plugin. Which property should be read?

    1. AThe computer name of the server
    2. BInitiatingUserId from the plugin execution context
    3. CThe current time zone of the Dataverse environment
    4. DThe plugin assembly's file size
    Show answer and explanation
    Correct answer: B

    InitiatingUserId identifies the user whose action triggered the plugin, which supports auditing. The server name, time zone and assembly size do not identify the user.

  7. Question 7

    A developer wants to use Dataverse from a plugin without consuming the calling user's permissions for a privileged change. Which approach is appropriate?

    1. ADisabling security roles for the whole environment so the plugin can write freely through every table it touches without audit
    2. BRunning the plugin under a random user account that is created on each request for the call
    3. CUsing the system administrator password stored in the plugin so the service can act as the admin for every outbound API call
    4. DImpersonating a specific system user through the organization service, with a documented justification
    Show answer and explanation
    Correct answer: D

    Impersonation through the organization service runs the operation as a defined user with documented justification, which keeps the change traceable. Hardcoded passwords, disabling security and random accounts are unsafe.

  8. Question 8

    A custom API is needed so that a canvas app and a cloud flow can call the same server-side business logic with a defined request and response. Which feature should be created?

    1. AA Dataverse custom API with request and response parameters
    2. BA static CSV file in the solution with sample data
    3. CA web resource with inline JavaScript that runs once
    4. DA canvas app component embedded in the screen for users
    Show answer and explanation
    Correct answer: A

    A custom API defines parameters and responses that apps, flows and integrations can call with the same server-side logic. Web resources and components run in the browser, and a CSV file has no executable logic.

  9. Question 9

    A plugin must be deployed to a test environment and then to production with the same configuration and version tracking. Which deployment approach is recommended?

    1. ACopying the DLL file manually into production by drag and drop with no version label
    2. BPackaging the plugin assembly and steps in a solution and deploying it through the pipeline
    3. CRegistering the plugin in the developer's personal environment from a local debug build of the DLL file
    4. DEditing production steps directly in the portal without a managed solution or a pipeline during peak hours
    Show answer and explanation
    Correct answer: B

    Packaging plugins in solutions and deploying them through pipelines gives repeatable, versioned releases. Manual copies, developer-only registrations and direct production edits are error prone and untracked.

  10. Question 10

    A plugin's execution fails in production with a timeout because it calls an external API that is slow. What is the best change?

    1. AMoving the external call to an asynchronous step or an Azure Function triggered with a queued message
    2. BCalling the API in every field's OnChange event on the form for each record in the list and retrying each timeout
    3. CIncreasing the synchronous timeout to infinity in the plugin registration for the step
    4. DRemoving error handling from the plugin so failures stay hidden from admins across the tenant
    Show answer and explanation
    Correct answer: A

    Asynchronous processing or queued functions prevent slow external calls from blocking user operations. Infinite timeouts are not supported as a fix, client-side repeated calls add load, and removing error handling hides failures.

  11. Question 11

    A developer needs to write code that queries Dataverse for accounts in a specific city from an external application. Which API should be used?

    1. AScreen scraping the model-driven app's HTML page
    2. BReading the Dataverse log files to locate accounts
    3. CA direct SQL connection to the Dataverse database
    4. DThe Dataverse Web API with an OData query and a secure token
    Show answer and explanation
    Correct answer: D

    The Dataverse Web API supports OData queries with secure token authentication, which is the supported integration path. Direct SQL access to Dataverse is not supported, screen scraping is fragile, and log files do not contain account data.

  12. Question 12

    An external application must receive a notification when a row changes in Dataverse, without polling. Which feature provides this?

    1. AA manual refresh button on the form that users press to reload the grid
    2. BA static file that the application downloads each day from a shared drive
    3. CA recurrence trigger that runs every second and polls the table each time
    4. DService endpoints with webhook steps that send messages when the registered event occurs
    Show answer and explanation
    Correct answer: D

    Webhook service endpoints push notifications to the external system when events occur, avoiding polling. A frequent recurrence trigger is polling in disguise, manual refresh requires people, and daily files are stale.

  13. Question 13

    A plugin should only run in a specific environment and must not run in other environments that share the same solution. Which mechanism lets the team configure this?

    1. AEnvironment variables or configuration records read by the plugin at run time
    2. BHardcoding the environment ID directly in the plugin's source code
    3. CUsing a different plugin name for every environment in the assembly
    4. DDisabling the plugin with a comment in the source and leaving the registration active
    Show answer and explanation
    Correct answer: A

    Environment variables or configuration records let the same solution behave differently per environment without code changes. Hardcoded IDs break portability, and comments do not control runtime behavior.

  14. Question 14

    A developer wants to monitor errors and performance of a custom plugin in production. Which tool should be connected?

    1. AApplication Insights through the plugin's telemetry
    2. BA spreadsheet that the developer edits by hand
    3. CA paper log book kept in a binder beside the server rack
    4. DA calendar reminder set for weekly reviews
    Show answer and explanation
    Correct answer: A

    Application Insights captures telemetry, exceptions and performance data from custom code, which supports production monitoring. Paper logs, manual spreadsheets and calendar reminders do not capture runtime behavior.

  15. Question 15

    A plugin uses a secret API key to call a third-party service. Where should the key be stored so that it is not visible in the solution file?

    1. AIn the solution's display name and in its description field shown to readers
    2. BIn the Dataverse audit log entries that record the old and new values
    3. CIn Azure Key Vault, referenced through a secure configuration
    4. DAs plain text in a field set by the plugin's constructor
    Show answer and explanation
    Correct answer: C

    Azure Key Vault holds secrets securely and is referenced at run time, which keeps keys out of solutions and code. Plain text in code, display names and audit logs expose the secret.

Extend the user experience (15 questions)

  1. Question 16

    A developer needs custom logic to run when a user changes a field on a model-driven app form, and the logic must update other fields on the same form before saving. Which extension point is most appropriate?

    1. AA server-side plugin registered on the Delete message for the Account
    2. BAn Azure Function with a timer trigger, called once a day overnight
    3. CA JavaScript web resource registered on the form's OnChange event for the field
    4. DA cloud flow with a Microsoft Teams trigger that fires when a channel message is posted to a team
    Show answer and explanation
    Correct answer: C

    Form JavaScript on the field OnChange event runs in the browser as the user edits and can update other fields immediately. A delete plugin, a Teams-triggered flow and a daily function do not run during form editing.

  2. Question 17

    A component must provide a custom rich control for a Dataverse column in a model-driven app, rendered with a modern front-end framework. Which technology should be used?

    1. AA SharePoint list web part added to a site page
    2. BA Power BI visual with no custom code
    3. CPower Apps component framework (PCF) control
    4. DA classic ASPX page hosted in the browser
    Show answer and explanation
    Correct answer: C

    PCF controls are the supported way to build custom UI components for model-driven and canvas apps using web technologies. SharePoint web parts, Power BI visuals and ASPX pages are not the component model for these apps.

  3. Question 18

    A developer wants a command bar button on a model-driven app that runs JavaScript and is shown only for records in a specific status. Which configuration is best?

    1. AA ribbon button using Command Designer with a JavaScript function and a display rule on the status value
    2. BA plugin registered on the Retrieve message that changes the button color in the ribbon when the status value is read
    3. CA button that users must add manually in the browser through the personal options page, so it resets on each new session
    4. DA canvas app button embedded in the model-driven form that opens a separate canvas screen through an iframe container
    Show answer and explanation
    Correct answer: A

    Command Designer lets developers add buttons with JavaScript actions and display rules such as status conditions. Browser-level manual buttons, plugins that change colors and canvas buttons do not meet the requirement in the form.

  4. Question 19

    A canvas app needs to call a custom API that requires a bearer token from Microsoft Entra ID. Which feature should the developer configure?

    1. AA formula that hardcodes the token in the OnStart property
    2. BA shared spreadsheet with the token in a column for users
    3. CA custom connector with OAuth 2.0 authentication settings for the API
    4. DA static API key pasted into a screen label as plain text
    Show answer and explanation
    Correct answer: C

    A custom connector with OAuth 2.0 settings handles token acquisition securely for the app. Hardcoded tokens, labels and spreadsheets expose credentials and break when tokens expire.

  5. Question 20

    A Power Pages site must display a list of records from Dataverse to authenticated partners only. Which combination provides secure access?

    1. AMaking the site public with no table permissions so anonymous visitors can browse records
    2. BExposing the Dataverse Web API key in the page source of the portal pages
    3. CGiving the partners the system administrator role across the environment
    4. DWeb roles and table permissions that grant read access to the partners' records
    Show answer and explanation
    Correct answer: D

    Web roles and table permissions grant the minimum access that partners need. System administrator roles, public access and exposed API keys all grant excessive or unsafe access.

  6. Question 21

    Which two practices improve the performance of a model-driven app with custom JavaScript? (Choose two.)

    1. ALimiting the number of web resources loaded on each form to what is needed
    2. BAvoiding synchronous web service calls that block the form while loading
    3. CLoading every library on every page regardless of need
    4. DRetrieving all records of a table on every form load
    5. EAdding delays to every field change event
    Show answer and explanation
    Correct answer: A, B

    Loading only needed resources and avoiding blocking synchronous calls keep forms responsive. Loading everything, retrieving whole tables and adding delays slow the user experience.

  7. Question 22

    Which two statements about PCF controls are accurate? (Choose two.)

    1. APCF controls can be used in model-driven and canvas apps
    2. BPCF controls run only inside Microsoft Excel
    3. CPCF controls require a desktop installation for each user
    4. DPCF controls cannot read Dataverse values
    5. EPCF controls are built with web technologies and packaged in solutions
    Show answer and explanation
    Correct answer: A, E

    PCF controls are web-based components packaged in solutions and usable in model-driven and canvas apps. They do not depend on Excel or desktop installs, and they can read bound Dataverse values.

  8. Question 23

    A developer wants to hide a section of a model-driven form when the user lacks a specific security role. Which approach is most appropriate?

    1. ARemoving the section from the solution permanently by deleting its entry from form XML
    2. BChecking the user's roles in JavaScript using the supported client API and hiding the section
    3. CHiding the section for every user regardless of role on the main form and tab layout
    4. DGiving every user the System Administrator role to avoid the check in the script
    Show answer and explanation
    Correct answer: B

    Checking roles with the client API and hiding the section for those users is a supported UI pattern, while security enforcement must still happen on the server. Hiding for everyone, granting roles to all and deleting sections do not meet the requirement.

  9. Question 24

    A developer wants a canvas app to display a list of records from an external API that changes often, with the list refreshed every time the screen opens. Which design is appropriate?

    1. ACaching the list once at build time without refreshing it in a local collection bundled in the app
    2. BAsking the user to press the browser's refresh button manually again on each visit to the screen
    3. CCopying the list into a static label and setting its Text property to the concatenated record values
    4. DCalling the connector or custom API on screen load and binding the gallery to the result
    Show answer and explanation
    Correct answer: D

    Loading the data on screen open keeps the list current with each visit. A build-time copy goes stale, static labels cannot hold lists, and manual browser refreshes are unnecessary.

  10. Question 25

    A PCF control needs to read the value of a Dataverse column and raise an event when it changes. Which part of the component lifecycle should handle this?

    1. AThe updateView method, which is called when the bound data changes
    2. BThe destroy method, which runs when data changes in the bound columns or views
    3. CThe init method, which runs once when the component is initially loaded
    4. DThe manifest file, which runs at runtime to bind properties and load web assets
    Show answer and explanation
    Correct answer: A

    updateView runs when the bound data changes, which is where the component reacts and renders updates. Init runs once and destroy runs at cleanup, and the manifest is metadata rather than runtime code.

  11. Question 26

    A PCF control must be reusable across several model-driven apps and solutions. Which packaging approach should be used?

    1. AEmbedding the control directly in a canvas app by placing it on one screen
    2. BSharing the control's build output folder by email to each developer
    3. CCopying the source code and its manifest into each app manually for each Dev environment
    4. DPackaging the control in a solution so that it can be imported to each environment
    Show answer and explanation
    Correct answer: D

    Packaging controls in solutions makes them deployable and version-controlled across environments. Manual copies, canvas-only embedding and emailed outputs are not reliable reuse methods.

  12. Question 27

    A Power Pages site must support sign-in for external users with their own identity provider. Which configuration is required?

    1. AEditing the site's CSS and Liquid templates to hide the sign-in button on the sign-in page
    2. BIdentity providers configured for the site, with the redirect and client settings from the provider
    3. CGiving every external user a shared system administrator account in the environment
    4. DDisabling authentication for the site so anonymous visitors can access records
    Show answer and explanation
    Correct answer: B

    Configuring identity providers for the site, including the client settings and redirects, enables external sign-in. Administrator accounts for external users, disabled authentication and CSS hiding do not provide secure identity federation.

  13. Question 28

    A Power Pages developer wants to customize a page's layout with HTML, CSS and Liquid templates. Which principle should guide the design?

    1. APutting the security checks in client-side JavaScript that runs in the browser
    2. BEmbedding secrets such as API keys directly in the HTML source of the portal template for anyone to read
    3. CKeeping business rules server side and using Liquid for presentation and simple data display
    4. DDisabling server-side rendering for every page and serving raw Liquid tags to the browser for client parsing
    Show answer and explanation
    Correct answer: C

    Server-side business rules and Liquid for presentation keep security and logic enforced where users cannot change them. Client-only checks, embedded secrets and disabled server rendering all weaken control.

  14. Question 29

    Which two practices improve the accessibility of a canvas app? (Choose two.)

    1. AHiding labels for form inputs
    2. BProviding meaningful labels or alternative text for images and controls
    3. CEnsuring sufficient color contrast between text and background
    4. DUsing color alone to communicate errors
    5. ERemoving keyboard focus indicators to simplify the design
    Show answer and explanation
    Correct answer: B, C

    Labels, alternative text and sufficient contrast help screen reader and low-vision users. Color-only errors, removed focus indicators and hidden labels reduce accessibility.

  15. Question 30

    A canvas app must show data from a SQL database through a custom connector. Which element defines the operations the app can call?

    1. AA screenshot of the database schema taken from the portal
    2. BA custom connector definition with the operations for the SQL-backed API
    3. CA static CSV file exported from the database and bundled in the app
    4. DA hardcoded list of sample records typed into the app's formula for offline testing
    Show answer and explanation
    Correct answer: B

    A custom connector definition describes the operations that the app can call, backed by the API over SQL. Screenshots, static files and hardcoded lists do not expose operations.