AB-400: Extending Microsoft Power Platform Solutions with Code and AI Practice Exam

What the AB-400 exam covers

• Build Microsoft Power Platform solutions237 questions
• Extend the user experience161 questions
• Extend Microsoft Power Platform233 questions
• Develop integrations92 questions

Free AB-400 practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 723-question bank.

1. Question 1Build Microsoft Power Platform solutions

   Which solution type should be deployed to production (locked components)?

   • AA patch solution
   • BManaged solutionCorrect
   • CA solution segment
   • DUnmanaged solution
   ✓ Correct answer: B

   Managed solutions should be deployed to production environments because they lock components to prevent accidental or unauthorized modifications. Once deployed as a managed solution, components cannot be edited directly in production, ensuring stability and requiring all changes to flow through the proper development and testing lifecycle before promotion to production.

   Why the other options are wrong

   • AA patch is an incremental update to an existing solution, not the solution type that locks components for production deployment.
   • CA solution segment refers to selectively adding table assets to a solution; it is not a deployable, locked production solution type.
   • DUnmanaged solutions allow direct editing of components in the environment where they are installed, which is unsafe for production systems.
2. Question 2Build Microsoft Power Platform solutions

   A solution upgrade has to be imported now but applied later, after a data migration step completes. Which Power Platform CLI sequence achieves that?

   • Apac solution import --import-as-holding, then pac solution upgradeCorrect
   • Bpac solution import --stage-and-upgrade, then pac solution publish
   • Cpac solution import --force-overwrite, then pac solution version
   • Dpac solution clone --include general, then pac solution add-reference
   ✓ Correct answer: A

   The import command exposes --import-as-holding, with the short form -h, to import the solution as a holding solution. The staged version is installed beside the current one, appearing as a solution whose name ends in _Upgrade and forming a pending upgrade layer above the base and any patches. Work such as a data migration can then run before pac solution upgrade, which takes --solution-name and optionally --async and --max-async-wait-time, flattens the layers and creates a new base solution. Solution upgrades also delete components that existed in the previous version but are absent from the new one.

   Why the other options are wrong

   • BThe --stage-and-upgrade switch on import performs the import and the upgrade in one step, which is the opposite of holding the change back, and publish only publishes customizations.
   • CThe --force-overwrite switch forces an overwrite of unmanaged customizations during the import, and pac solution version edits build and revision numbers in a local solution file.
   • Dpac solution clone creates a local project from a solution in the organization and add-reference points that project at another one; neither touches an installed solution.
3. Question 3Extend Microsoft Power Platform

   What is the purpose of a plug-in's execution context/Target?

   • AIt defines the security roles a plug-in step needs before the platform will let the step run
   • BIt stores the compiled plug-in assembly bytes that the sandbox loads at execution time
   • CIt provides the input/state (e.g., the record being operated on) the plug-in code acts uponCorrect
   • DIt sets the asynchronous retry and back-off policy the platform applies when a step fails
   ✓ Correct answer: C

   When a registered message executes, the platform passes an IPluginExecutionContext to the plug-in. That context carries the InputParameters (including the Target entity being created or updated), pre/post entity images, the message name, the primary entity, depth, and the initiating user, which together describe exactly what operation is occurring. The plug-in reads this state to decide what to do and to access or modify the affected record. Without the context the plug-in would have no information about which record or message triggered it.

   Why the other options are wrong

   • APlug-in privileges come from the calling or impersonated user's roles, not the execution context object.
   • BThe assembly is stored as a registered PluginAssembly record, not inside the per-request context.
   • DAsync retry behavior is managed by the system job, not exposed through the execution context/Target.
4. Question 4Build Microsoft Power Platform solutions

   Northwind Traders wants staff at a partner company, who sign in through their own tenant, to use a Power Apps code app that shows order status. The partner staff hold guest accounts in Northwind's tenant. What does the code apps documentation say?

   • AThe partner staff can be given access to the app and reach it through Azure B2B, in the same way as canvas appsCorrect
   • BThe partner staff need the app rebuilt as a canvas app, because code apps serve only users of the home tenant
   • CThe partner staff can reach the app only once its assets are restricted to the partner's IP range with SAS IP binding
   • DThe partner staff can use the app without any license, because external users are exempt from Power Apps Premium
   ✓ Correct answer: A

   The managed platform capability table in the code apps overview lists Azure B2B external user access as supported. End users can share code apps and access them by using Azure B2B to reach resources in a tenant, similar to canvas apps. The usual licensing for code app end users still applies, such as Power Apps Premium, pay-as-you-go, an App Pass or auto-claim.

   Why the other options are wrong

   • BCode apps support Azure B2B external user access, similar to canvas apps.
   • CThe SAS IP Binding and Firewall setting doesn't apply to code apps, and external access is through Azure B2B.
   • DEnd users who run code apps need Power Apps Premium, pay-as-you-go, an App Pass or auto-claim.
5. Question 5Extend Microsoft Power Platform

   Contoso's elastic table contoso_sensordata uses a partitioning strategy in which partitionid holds the device ID. The row below was created with partitionid set to device-017. A developer sends this Web API request to change its reading: ```http PATCH [Organization URI]/api/data/v9.2/contoso_sensordatas(e61a662e-68d8-487e-94e7-ae3a22fd4bbd) Content-Type: application/json { "contoso_value": 41.7 } ``` A reviewer rejects the request because it doesn't identify the row the way the table requires. Which request line should be used?

   • APATCH .../contoso_sensordatas(e61a662e-68d8-487e-94e7-ae3a22fd4bbd)?partitionId='device-017' with the same body
   • BPATCH .../contoso_sensordatas(contoso_sensordataid=e61a662e-68d8-487e-94e7-ae3a22fd4bbd,partitionid='device-017')Correct
   • CPATCH .../contoso_sensordatas(partitionid='device-017') with the row's GUID added to the JSON request body
   • DPATCH .../contoso_sensordatas(e61a662e-68d8-487e-94e7-ae3a22fd4bbd) with an MSCRM.SessionToken header from the create
   ✓ Correct answer: B

   Every elastic table has an alternate key named KeyForNoSqlEntityWithPKPartitionId that combines the primary key with the partitionid column. When a table uses a partitioning strategy, you must use that alternate key to supply the partitionid value for Retrieve, Update or Delete. In the Web API the syntax is <entity set name>(<primary key name>=<primary key value>,partitionid='<partitionid value>'), with no quotes around the GUID and single quotes around the partitionid string.

   Why the other options are wrong

   • AThe partitionId parameter works only for Retrieve and Delete; it doesn't work with POST or PATCH requests and is ignored if it's sent.
   • CThe alternate key combines the primary key with partitionid, so partitionid alone in the URL doesn't identify a single row.
   • DMSCRM.SessionToken passes a session token on GET requests for session-level consistency; it doesn't supply the partitionid value.
6. Question 6Extend Microsoft Power Platform

   A Fabrikam developer is building a PCF control that sends a prompt to a Copilot Studio agent with @microsoft/agents-copilotstudio-client. The token and connection settings are valid, but the agent never receives the prompt. The relevant code is shown below. ```typescript const settings: ConnectionSettings = { environmentId: "aaaabbbb-0000-cccc-1111-dddd2222eeee", agentIdentifier: "cr123_FabrikamDedupAgent" }; const client = new CopilotStudioClient(settings, token); const msg = new Activity("message"); msg.text = prompt; for await (const reply of client.sendActivityStreaming(msg)) { processActivity(reply); } ``` What should the developer change?

   • APass the prompt to the CopilotStudioClient constructor in place of the token argument
   • BCreate the activity as an event named AgentAnswer instead of a message activity
   • CAdd agentIdentifier to msg.conversation so the activity is routed to the agent
   • DIterate startConversationStreaming first and set msg.conversation to its idCorrect
   ✓ Correct answer: D

   The reference architecture creates a CopilotStudioClient from ConnectionSettings with environmentId and agentIdentifier plus the token. It then iterates startConversationStreaming to read the conversation ID, creates a message activity with the prompt, sets its conversation to that ID and calls sendActivityStreaming. The code shown skips starting the conversation, so the message has no conversation to belong to.

   Why the other options are wrong

   • AThe constructor takes the connection settings and the token; the prompt goes in the text of a message activity.
   • BThe control sends its prompt to the agent as a message activity; changing it to an event doesn't address the missing conversation.
   • CagentIdentifier belongs in ConnectionSettings with environmentId, which the code already sets; the activity's conversation needs the conversation ID.
7. Question 7Build Microsoft Power Platform solutions

   Contoso is setting up Power Platform managed identity so a new Dataverse plug-in can call Azure resources without stored credentials. The certificate that signs the plug-in assembly has the subject CN=Contoso Plugin Signing. Which setup does the current Microsoft Learn article recommend?

   • AVersion 2, with the federated credential built from a hash of the certificate's full DNCorrect
   • BVersion 1, with the federated credential subject built from the certificate's CN value
   • CVersion 2, with the federated credential subject built from the certificate's CN value
   • DVersion 1, with the federated credential built from a hash of the certificate's full DN
   ✓ Correct answer: A

   The Set up Power Platform managed identity article describes the recommended version 2 setup, which builds the federated identity credential (FIC) from a hash of the certificate's full Distinguished Name, and says to use version 2 for all new and existing plug-ins. Version 2 produces a fixed-length, ASCII-only subject identifier, so it works with any certificate name. Version 1 is the older CN-based format, kept for plug-ins that still use it, and it fails on some names, such as a CN with non-ASCII characters or commas. With managed identity, Dataverse plug-ins can connect to Azure resources without managing credentials.

   Why the other options are wrong

   • BVersion 1 is the CN-based format, which the article keeps only for plug-ins that still use it; it says to use version 2 for all new and existing plug-ins.
   • CVersion 2 doesn't use the CN as the subject; it builds the federated credential from a hash of the full Distinguished Name.
   • DHashing the full Distinguished Name is the version 2 format; version 1 is described as the CN-based format, and new plug-ins should use version 2.
8. Question 8Build Microsoft Power Platform solutions

   A developer runs the following command against Contoso's environment: ``` pac solution list ``` The output doesn't include the solutions that Microsoft published. Which parameter adds them to the list?

   • A--json
   • B--environment
   • C--includeSystemSolutionsCorrect
   • D--managed
   ✓ Correct answer: C

   The pac solution list reference lists three optional parameters. --includeSystemSolutions includes system solutions like those published by Microsoft, --json returns the output as a JSON formatted string, and --environment targets a Dataverse environment other than the active one for the auth profile. --managed belongs to pac solution export, where it chooses managed or unmanaged export. Without the switch, the list shows only the environment's non-system solutions.

   Why the other options are wrong

   • AThe --json switch changes the output format to a JSON string; it doesn't add system solutions.
   • BThe --environment parameter specifies which Dataverse environment to query; it doesn't add Microsoft solutions to the output.
   • D--managed is a parameter of pac solution export; pac solution list doesn't take it.
9. Question 9Extend the user experience

   A classic command on a model-driven app's command bar has a CustomRule enable rule that calls a JavaScript function. For an inactive row the function returns false. How does the command appear to the user on that row?

   • AIt stays visible but is disabled and doesn't respond to events
   • BIt stays visible and enabled; enable rules apply only to the ribbon
   • CIt is hidden from the form's command bar for that inactive rowCorrect
   • DIt stays visible until a second enable rule on it also returns false
   ✓ Correct answer: C

   Enable rules control when a ribbon element is enabled, and a CustomRule calls a function in a JavaScript web resource that returns a Boolean or a Promise. The enable rules article defines what enabled means: with the command bar, commands that are disabled are hidden, while with the ribbon, commands that are disabled are visible but don't respond to events. When a command has more than one enable rule, all of them must evaluate as true for it to be enabled, so one false result is enough. A function that returns false for inactive rows therefore removes the button from the command bar on those rows.

   Why the other options are wrong

   • AVisible but unresponsive is how the classic ribbon shows a disabled command; on the command bar a disabled command is hidden.
   • BEnable rules are evaluated for the command bar too, where a command that the rule disables is hidden.
   • DAll enable rules on a command must evaluate as true for it to be enabled, so a single rule returning false already disables it.
10. Question 10Develop integrations

    Actions of an OAuth 2.0 custom connector work when tested, but flows that use it start failing with 401 Unauthorized after the same length of time on every new connection. Following the custom connector OAuth troubleshooting steps, what should the developer verify first?

    • AThat the redirect URI registered with the identity provider matches the per-connector redirect URI
    • BThat the client secret on the Security tab matches the one issued by the identity provider
    • CThat the provider returns a refresh token and the connector's Refresh URL matches its endpointCorrect
    • DThat the connector's host and base URL on the General tab point at the production API
    ✓ Correct answer: C

    The OAuth troubleshooting article lists "a connection is failing after X amount of time (where X is consistent)" and "401 unauthorized" as the symptoms. Its steps check whether the token endpoint returns a refresh token, call the refresh URL to confirm a new access token is issued, and then verify that the connector's client ID, client secret, token URL and refresh URL match the ones that worked. The Refresh URL is the endpoint used to refresh the access token once it has expired.

    Why the other options are wrong

    • AA redirect URI mismatch breaks sign-in when the connection is created; here connections are created and work until the access token expires.
    • BA wrong client secret fails the token exchange when the connection is created, so the actions would not have worked in testing.
    • DA wrong host or base URL makes every call fail from the start; it does not explain failures that begin after a consistent period.

Who this AB-400 practice exam is for

This practice set is for anyone preparing for the AB-400: Extending Microsoft Power Platform Solutions with Code and AI exam - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AB-400 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AB-400 exam.

Related Microsoft resources

• AB-400 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AB-620 practice examRelated
• AB-730 practice examRelated
• AB-731 practice examRelated

AB-400 practice exam FAQ