Q01 - Question
Users report slowness when they add data to the SalesTable. A developer wants to use SQL Server Profiler to see all long-running queries on the SQL server system, not only the long-running queries in finance and operations apps. Which constraint must the developer plan for?
Domain: Implement security and optimize performance (10–15%) Type: Single choice
- A. SQL Server Profiler requires the System tracing user role for the user who performs the task.
- B. SQL Server Profiler can be used only in tier-2 or higher sandbox environments.
- C. SQL Server Profiler can be used only on tier 1 Dynamics 365 instances.
- D. SQL Server Profiler traces must be uploaded to Lifecycle Services before analysis.
C is correct.
Explanation: SQL Server Profiler can be used only on tier 1 Dynamics 365 instances. Also, SQL Trace and SQL Server Profiler are deprecated, so use Extended Events for new diagnostic work.
A is incorrect: The System tracing user role is required to capture traces in the finance and operations user interface for Trace parser, not for SQL Server Profiler.
B is incorrect: Tier-2 or higher sandbox environments are a prerequisite for multi-user Performance SDK tests, not for SQL Server Profiler.
D is incorrect: You open SQL Server Profiler from the Tools menu in SQL Server Management Studio, and you review the trace results there after you stop the trace.
Q02 - Question
A company has an existing environment that still uses the Performance SDK. A developer completed a single-user test and now plans to run a multi-user load test for a sales order process. Which two prerequisites must the developer verify before running the multi-user test? Each correct answer presents part of the solution.
Domain: Implement security and optimize performance (10–15%) Type: Multi-select
- A. The development environment includes Visual Studio Enterprise Edition.
- B. The certificates are installed only on the development environment and not on the sandbox AOS machines.
- C. A tier-2 or higher sandbox environment uses the same application and platform update as the development environment.
- D. The multi-user test runs against a tier-1 environment that uses a different platform update.
A and C are correct.
Explanation: Multi-user testing requires Visual Studio Enterprise Edition in the development environment. It also requires a tier-2 or higher sandbox environment that uses the same application and platform update as the development environment.
B is incorrect: You must install the same certificates that you created for the development environment on all Application Object Servers (AOS) in the tier-2 or higher sandbox.
D is incorrect: Multi-user testing requires a tier-2 or higher sandbox, and the application and platform update must match the development environment.
Q03 - Question
A company stores data for several business units in a shared table. Users in a specific security role must see only the rows for their business unit. The restriction must also apply when users access the data through SQL Server Reporting Services (SSRS) reports. You plan to use the extensible data security (XDS) framework. Which two steps are part of the XDS policy flow? Each correct answer presents part of the solution.
Domain: Implement security and optimize performance (10–15%) Type: Multiple choice
- A. Assign the data security policy directly to each individual user.
- B. Start with a query that defines the filters to place on the primary table.
- C. Create a separate data security policy that applies only to SSRS reports.
- D. Define the list of constrained tables that store related data from the primary table.
B and D are correct.
Explanation: The extensible data security (XDS) framework policy flow starts with a query to define the filters or limits that should be placed on the primary table. It also requires you to define the list of constrained tables, which are related tables that store data from the primary tables.
A is incorrect: You assign data security policies to security roles by using the XDS framework, not directly to individual users.
C is incorrect: XDS policies are enforced regardless of whether data is being accessed through the finance and operations apps cloud-based application, an SQL Server Reporting Services (SSRS) report, or other services. A separate policy is not required.
Q04 - Question
A developer with an existing Lifecycle Services project opens the Activity tab on the Environment Monitoring page to review user load for the last week. No data appears on the page. What should the developer do?
Domain: Implement security and optimize performance (10–15%) Type: Single choice
- A. Select a time duration, and then select Submit time.
- B. Wait for the next daily data collection, and then reload the page.
- C. Submit a request to the Microsoft Service Engineering team to release the activity data.
- D. Open the Health metrics tab, and then select a time duration of 60 days.
A is correct.
Explanation: The Activity tab doesn't load any data by default. Select a time duration, and then select Submit time to show the data.
B is incorrect: Daily data collection applies to Performance Metrics on the SQL Insights tab. The Activity tab requires you to submit a time duration.
C is incorrect: Some health checks are reported to the Microsoft Service Engineering team, but you don't request activity data from that team to view it.
D is incorrect: The activity monitoring tool retains data for only 30 days, and the Health metrics tab is in maintenance mode and no longer receives support.
Q05 - Question
A developer is configuring an external system to call OData endpoints in finance and operations apps by using OAuth 2.0. The developer registered the app in Microsoft Entra ID, created a client secret, and added the Dynamics ERP delegated permissions. What should the developer do in finance and operations apps before generating an authentication token?
Domain: Implement security and optimize performance (10–15%) Type: Single choice
- A. Add the client ID as a rule in System administration > Security > Assign users to roles.
- B. Go to System Administration > Setup > Microsoft Entra ID Applications, enter the client ID, a name, and a user ID, and then select Save.
- C. Turn on the client ID as a feature in System administration > Feature management.
- D. Create a new security privilege in Visual Studio that stores the client secret.
B is correct.
Explanation: To set up finance and operations apps for OAuth 2.0, you must go to System Administration > Setup > Microsoft Entra ID Applications, enter the client ID from the app registration, enter a name and a user ID, and then select Save.
A is incorrect: The Assign users to roles page is used to manually or automatically assign users to security roles, not to register an application client ID.
C is incorrect: Feature management is used to turn on features like User security governance, not to configure OAuth 2.0 client IDs.
D is incorrect: Security privileges are composed of permissions and represent tasks. The client secret value should be copied to a text document during app registration because you will not be able to copy it later; it is not stored in a security privilege.
Q06 - Question
A sandbox environment has performance issues. A developer opens the SQL Insights tab in Lifecycle Services and runs a predefined query on the Queries tab to retrieve metrics on demand. The query returns a time-out error. What should the developer do next?
Domain: Implement security and optimize performance (10–15%) Type: Single choice
- A. Use the Performance Metrics tab and wait for the next daily data collection.
- B. Use the Actions tab to rebuild all indices, and then rerun the query.
- C. Use the Live View tab to download the query run plan.
- D. Turn off Use Fast Query, and then rerun the query.
D is correct.
Explanation: Most predefined queries run synchronously to return results quickly. When performance issues cause a time-out error, turn off Use Fast Query and rerun the query.
A is incorrect: Performance Metrics data is pulled once daily, so it doesn't provide the on-demand result that the predefined query provides.
B is incorrect: Actions mitigate issues such as fragmented indices or blocking statements. They don't address a predefined query time-out.
C is incorrect: Live View shows the current DTU and running and blocking statements. You download a query run plan from the Statement tab in Performance Metrics.
Q07 - Question
A company uses an existing security role that has view-only access to a page in finance and operations apps. Users in that role now need to edit records on the page. The developer wants to reuse the existing security elements instead of rebuilding the role. What should the developer do?
Domain: Implement security and optimize performance (10–15%) Type: Single choice
- A. Create a new permission for the page in Security configuration in the production environment.
- B. Assign the edit privilege directly to each user who needs to edit records.
- C. Create an extension of the existing privilege in Visual Studio and change the view-only access to edit access.
- D. Create a separate user group for each company that needs edit access to the page.
C is correct.
Explanation: The evidence states that you can create an extension of an existing role, duty, or privilege in Visual Studio. This allows you to change a view-only privilege to an edit privilege for a certain page in finance and operations apps.
A is incorrect: Permissions can only be created or modified in the development environment, not in the production environment.
B is incorrect: Access to finance and operations apps is not granted to individual users, but to security roles to which users are assigned.
D is incorrect: A single set of roles applies across all companies and organizations. An administrator no longer must create and maintain separate user groups for each company.
Q08 - Question
Contoso USA users report that posting a payment journal takes too long. A developer who has the System tracing user role captures a trace while posting the journal. The developer wants to store the trace in the cloud and import it into Trace parser on the development environment later in the week. What should the developer do after selecting Stop trace?
Domain: Implement security and optimize performance (10–15%) Type: Single choice
- A. Select Download trace, and then upload the file from the Captured traces page later.
- B. Select Upload trace, and then import the trace into Trace parser within seven days.
- C. Select Upload trace, and then wait for the trace to appear in the SQL Insights tab in Lifecycle Services.
- D. Select Download trace, and then import the file into Trace parser in a Demo topology environment.
B is correct.
Explanation: Upload trace stores the trace in the cloud so that you can download it at a different time. The uploaded trace is automatically deleted after seven days, so import it into Trace parser before then.
A is incorrect: Download trace stores the trace on your local machine, and that trace can't be uploaded later.
C is incorrect: Uploaded traces appear on the Captured traces page. You analyze them in Trace parser, not on the SQL Insights tab.
D is incorrect: Trace parser is available only on DevTest topology environments. It isn't available in Demo topology environments.
Q09 - Question
A system administrator wants users who meet the criteria of a query to be assigned to the Accounts payable clerk role without manual assignment for each user. The administrator opens System administration > Security > Assign users to roles and selects the Accounts payable clerk role. What should the administrator do next?
Domain: Implement security and optimize performance (10–15%) Type: Single choice
- A. Select Add rule under Rules for dynamically assigning users to role, select the query, and then select Run automatic role assignment.
- B. Go to System administration > Security > Security configuration and create a new duty for the role.
- C. Go to System administration > Feature management and turn on the User security governance feature.
- D. Go to System Administration > Setup > Microsoft Entra ID Applications and enter the query name.
A is correct.
Explanation: To assign users to roles automatically, you select Add rule beneath the Rules for dynamically assigning users to role heading, select the query name, and then select Run automatic role assignment.
B is incorrect: Security configuration is used to review and customize the security elements themselves. Creating a new duty does not assign users to a role.
C is incorrect: The User security governance feature provides reporting about segregation of duties and license indicators. It does not automatically assign users to roles based on a query.
D is incorrect: The Microsoft Entra ID Applications page is used to set up OAuth 2.0 authentication for integrations, not to assign users to roles.
Q10 - Question
An organization has several cloud-hosted finance and operations apps environments that are connected to Microsoft Entra ID and the Power Platform admin center. A licensing manager needs one tenant-wide view that compares required, purchased, and assigned licenses and highlights under-licensed users. What should the licensing manager use?
Domain: Implement security and optimize performance (10–15%) Type: Single choice
- A. The License usage summary page in System administration > Security > Security governance in each environment.
- B. The Microsoft 365 admin center license assignment pages.
- C. The Security analysis report in user security governance.
- D. The User License Consumption report in the Power Platform admin center.
D is correct.
Explanation: The User License Consumption report in the Power Platform admin center provides a tenant-wide view that compares required, purchased, and assigned licenses per product and highlights unlicensed, under-licensed, and over-licensed users.
A is incorrect: The License usage summary page focuses on a single environment, not a tenant-wide view.
B is incorrect: Licenses are assigned in the Microsoft 365 admin center, but the User License Consumption report in the Power Platform admin center is used to compare required, purchased, and assigned licenses.
C is incorrect: The Security analysis report is used to find every role that includes a problematic entry point, not to compare license consumption across the tenant.