Microsoft Certified: Power Platform Developer Associate (PL-400)

B is correct.

Explanation: API Key authentication uses a parameter label, name, and location. The name must be code because it carries the key in each request, and the location must be Query so the URL contains code. This lets the connector send the key as the service expects.

A is incorrect: Header sends the key as a request header, such as X-API-Key, but this API expects code in the query string instead.

C is incorrect: The label is only the prompt text shown to users, while the parameter name must match code, so swapping them sends the wrong parameter.

D is incorrect: Basic authentication collects a user name and password, not an API key, so it does not send code in the query.

D is correct.

Explanation: When the service uses Cross-Origin Resource Sharing, the Azure API Management domains, usually azure-apim.net, should be on its CORS allow list. The other Microsoft Entra ID steps are already done, so the remaining documented step is the CORS setting on the service. This lets the service accept requests that come through the connector.

A is incorrect: Redirect URLs are added to the connector app registration, not to the service, and that step is already complete here.

B is incorrect: Basic authentication would remove Microsoft Entra ID identity pass-through and does not address the CORS configuration on the service.

C is incorrect: The resource URL is a required connector parameter for the service. Removing it does not configure CORS on the service.

A is correct.

Explanation: The client secret Value is displayed only when you create it, so you must copy and save it before leaving the page. You then paste it into the Client secret field, and paste the Application (client) ID into Client id when you create the connector. The Description is only a label.

B is incorrect: The Description is only a name for the secret, and the Value is not shown again, so it cannot be retrieved later.

C is incorrect: The client ID identifies the app and belongs in the Client id field. It is a different value from the client secret.

D is incorrect: The Redirect URI is entered when registering the app. It is not a credential for the connector.

C is correct.

Explanation: Connections can't be included in a solution. A connection reference can be included, and it points to a connection outside the solution. During import to the target environment, the user is prompted to provide a connection, and can create one if needed. The solution's apps and flows then use that connection.

A is incorrect: Connections can't be within a solution. Only a connection reference can be included, which points to a connection outside the solution.

B is incorrect: Sharing applies to standalone connectors. Access to connectors and connection references in solutions is controlled by Dataverse role-based security instead of sharing.

D is incorrect: Deleting a shared connector deletes all associated connections. It does not move connections to another environment.

B is correct.

Explanation: Windows authentication is available only for connections that use an on-premises data gateway. Set Connect via on-premises data gateway on the General tab, then select Windows authentication. No extra information is needed, and the user provides Windows credentials and selects an installed gateway when creating the connection.

A is incorrect: Windows authentication is available only with the on-premises data gateway, so the General tab gateway check box must be set first.

C is incorrect: OAuth 2.0 is only available for online connectors, so it does not fit an on-premises API reached through the gateway.

D is incorrect: API Key authentication sends a key in a header or query string. It is not the Windows authentication scheme that this API requires.

B is correct.

Explanation: Two actions cannot point to the same path. Give the new action a path that does not exist on the API, such as /ListBigInvoices. Then use the Route request policy template to send these action calls to /ListInvoices. Route request modifies the path, so both actions work without conflict.

A is incorrect: Set host URL changes the host, not the path, so it does not resolve the duplicate path conflict.

C is incorrect: Set property adds or updates properties on an object or collection in the body, not the action path.

D is incorrect: Set query string parameter adds or updates query parameters and cannot change the request path to /ListInvoices.

C is correct.

Explanation: The Skip option ensures that the existing value is not replaced. The policy therefore applies the value of 50 only when the maker does not provide a $top value. This configuration gives you control over when the value is used, making it the correct approach for providing default values.

A is incorrect: Override replaces the existing value, so the maker's $top value would be discarded and replaced with 50.

B is incorrect: Append adds the policy value to the existing value, which would change the maker's value instead of preserving it.

D is incorrect: Replace is not a listed option for this policy. The documented options are Override, Skip, and Append.

D is correct.

Explanation: Because the tags string is in the API output, the policy must run on the response. The Convert delimited string into an array of objects template parses the string and adds a new array, such as taglist, to the response. This improves usability for apps and flows.

A is incorrect: Convert an array to an object does not parse a delimited string, and the request does not carry this data.

B is incorrect: Convert an object to an array starts from an object, not a delimited string, so it does not create taglist from tags.

C is incorrect: The template is correct, but running on the request shapes data sent to the API, not the response output.

A is correct.

Explanation: Connection parameters configured in the apiProperties.json file build the connection dialog box that users fill out. After you manually add the billingCode input field there, the @connectionParameters('billingCode') expression accesses the value entered when the connection was created. You can then use this value in your policy template configurations.

B is incorrect: The @body() function reads the request or response body at runtime and does not collect values from the connection dialog box.

C is incorrect: The @headers expression reads header values at runtime. It does not define an input field that users complete when creating a connection.

D is incorrect: The @queryParameters expression reads request query values. It does not add a field to the connection dialog box for user input.

D is correct.

Explanation: When configuring a policy to run on all actions and triggers, you must ensure that any data paths used in the policy parameters are valid for all of them. Limiting the template to specific actions where the data path is valid prevents the runtime errors from occurring.

A is incorrect: The evidence does not support disabling a policy in the designer, and removing the policy would not fix the scope problem.

B is incorrect: API properties are stored separately from the API definition, so importing an updated definition does not overwrite configured policies.

C is incorrect: Policy order controls the sequence of application when using multiple templates. It does not make an invalid data path valid.