TL;DR
These 12 scenario questions follow the four AB-400 domains in order, two to four per domain, roughly mirroring the exam's weighting. Each one names the Microsoft skills-measured bullet it tests, marks the correct choice, and explains why each of the other three fails.
AB-400 is Microsoft's Power Platform Developer Associate exam, introduced on October 16, 2026 as the replacement for PL-400. The questions below are drawn from the 500-question AB-400 bank we maintain and check against Microsoft Learn. Treat them as a diagnostic: if the reasoning in a rationale surprises you, that skills-measured bullet is where your study hours should go.
MSCertQuiz sells practice-exam access for AB-400 and other Microsoft/GitHub certifications; this question set is written by the same team that builds and maintains that question bank.
Domain 1: Build Microsoft Power Platform solutions (15–20%)
Architecture choices and application lifecycle management, where the answer is usually the one that fits a stated constraint.
B1 · Implement and extend Microsoft Power Platform Pipelines
1. A team wants a governed pipeline with four stages that many makers can use, with approvals added through Power Automate. Which setup fits?
Why B works: A custom host supports governed pipelines that can be extended, shared, and run across more than two target environments, which is what a four-stage pipeline with approvals needs.
Why A fails: Personal pipelines in the platform host allow one development and two target environments, so four stages are not possible there.
Why C fails: Personal pipelines cannot be shared or extended, so the role does not help and approvals cannot be attached.
Why D fails: Using one environment as both the development environment and the host is not supported.
B2 · Design Dataverse code components, including plug-ins and custom APIs
2. A custom API must only read data and return a result, and callers want to invoke it with an HTTP GET that passes parameters in the URL. How should the custom API be defined?
Why D works: A Function does not change data, is invoked with HTTP GET, and takes its parameters in the URL, which matches every requirement in the stem.
Why A fails: An Action is invoked with POST and a body, so it cannot satisfy the GET-with-URL-parameters requirement.
Why B fails: A custom process action is always an Action, so it carries the same POST-only behavior.
Why C fails: The private setting only affects whether the message is discoverable; it does not change the HTTP method.
Domain 2: Extend the user experience (25–30%)
Client scripting, PCF code components, and code apps. Expect questions about which event or command is correct, not about writing the script.
U1 · Package, deploy, and consume a component
3. A developer runs pac pcf push without specifying --solution-unique-name. What is the result?
Why A works: Without the solution option, pac pcf push uses a temporary unmanaged PowerAppsTools solution tied to the publisher prefix. It is a development shortcut, not a release package.
Why B fails: The push command does not produce a managed solution; managed packaging belongs to a proper solution build.
Why C fails: No cdsproj project is required for the command to run.
Why D fails: The command does not target a managed default solution; it creates the temporary unmanaged one.
U2 · Determine an event handler registration approach
4. A business process flow must run validation before its status changes, and the status change must be cancelled when validation fails. Which registration and call are correct?
Why C works: The pre-process-status event fires before the status changes, and calling preventDefault on its event arguments leaves the process in its original stage and state.
Why A fails: The post-change event fires after the status has moved, so there is nothing left to cancel.
Why B fails: stopPropagation is not the supported cancellation mechanism for this event.
Why D fails: Returning false from a stage-change handler does not roll back a transition that has already happened.
U3 · Troubleshoot code apps by using Monitor and other browser-based debugging tools
5. A code app will not launch for users in an environment whose data loss prevention policy places two of the app’s connectors in different groups. Which statement explains the behavior?
Why B works: The managed platform capabilities for code apps include enforcing data loss policy at app launch, so a policy that splits the app’s connectors stops it from starting.
Why A fails: Enforcement happens at launch, so a policy change after publishing still affects the app.
Why C fails: Code apps are covered by the managed platform capabilities; using a client library does not exempt them.
Why D fails: Conditional Access governs sign-in. It is not the mechanism that checks connector groups.
Domain 3: Extend Microsoft Power Platform (35–40%)
The heaviest domain: plug-ins, platform APIs, Azure Functions, and flow configuration.
E1 · Develop a plug-in that uses the execution context
6. A PreValidation plug-in on Create stores a risk score in SharedVariables. A PostOperation plug-in on the same Create reads context.SharedVariables["RiskScore"] and gets a missing-key error, although the stored value is serializable. How should the PostOperation plug-in read the value?
Why A works: For Create, Update, Delete, and RetrieveExchangeRate, a PreOperation or PostOperation plug-in reaches the shared variables set in PreValidation through ParentContext.SharedVariables.
Why B fails: InputParameters carry the request itself; they are not a store for values written by earlier plug-ins.
Why C fails: Images are snapshots of table columns registered by alias, not a place for computed values.
Why D fails: Shared variables are not cleared at each stage boundary, so a Retrieve call is not the fix.
E2 · Implement API limit retry policies
7. A bulk loader uses 100 parallel threads against the Web API and receives frequent 429 responses. The team wants high throughput without hitting the limits repeatedly. What should they do?
Why D works: The server states how long to pause through Retry-After, and x-ms-dop-hint recommends a degree of parallelism, which also keeps the client under the default limit of 52 concurrent requests.
Why A fails: Immediate retries ignore Retry-After and make the throttling period longer; 100 threads also exceeds the 52 concurrent request default.
Why B fails: More threads raise the concurrent load and lengthen the Retry-After period instead of finishing sooner.
Why C fails: The remaining-request headers are for debugging, not for computing a send rate.
E3 · Process long-running operations by using Azure Functions for Microsoft Power Platform solutions
8. A Power Automate flow calls a custom connector backed by an HTTP-triggered Azure Function that enriches Dataverse records for about 20 minutes. The flow owner wants the call to succeed without relying on a long-lived synchronous request. Which design should the developer implement?
Why C works: Durable Functions implements the polling consumer pattern: the starter returns 202 Accepted with a Location header the caller polls until it gets 200, so no single request approaches the 230-second HTTP limit.
Why A fails: An unbounded host timeout on Premium does not lift the 230-second HTTP response limit.
Why B fails: A longer timeout on the flow side cannot extend the function’s own response window.
Why D fails: A synchronous plug-in would hold the user’s save open for the full 20 minutes.
E4 · Configure trigger filter and retry policies
9. A flow should start only when an expense amount is greater than 100 or the status is Escalated. The designer needs the condition to be evaluated before any run is created. Which trigger condition configuration is correct?
Why B works: Trigger conditions are evaluated before a run starts, each must begin with @, and several conditions combine with AND, so an OR requirement needs one condition that uses @or(...).
Why A fails: Two separate conditions would both have to be true, which is AND, not OR.
Why C fails: An expression without the leading @ is not a valid trigger condition.
Why D fails: A Condition action runs after the trigger has already created a flow run, so it does not reduce runs.
Domain 4: Develop integrations (10–15%)
Dataverse events, endpoint registration, data synchronization, and custom connectors.
I1 · Register service endpoints including webhooks, Azure Service Bus, and Azure Event Hub
10. A Service Bus endpoint is registered with a one-way contract, and no listener is running when a user creates an account row that triggers the registered step. What does Dataverse do?
Why C works: A one-way contract needs an active listener, so the post fails when none is present. Dataverse retries with longer intervals until the asynchronous system job is aborted and shows Failed.
Why A fails: Holding messages until a listener connects is queue behavior, not one-way contract behavior.
Why B fails: Dataverse does not report a skipped post as Succeeded.
Why D fails: No default fallback queue is created for the environment.
I2 · Publish a Dataverse event by using the Plug-in Registration Tool
11. A webhook step registered in asynchronous mode on the account Create message is not producing results at the external endpoint. Administrators must find the failure reason and keep database growth low for successful runs. Which approach meets both needs?
Why A works: Asynchronous webhook steps create a System Job that records the failure with a Failed status reason and details, and the registration offers deleting the job on success to save space.
Why B fails: The plug-in trace log is for plug-in code, and switching to synchronous mode does not answer the storage requirement.
Why C fails: Auditing records data changes, not webhook delivery attempts.
Why D fails: A webhook does not use a Service Bus dead-letter queue.
I3 · Develop code that uses alternate keys
12. An alternate key on an order table uses an order reference such as EU/2026/114. Web API PATCH upserts that use the key in the URL fail for these rows, while uniqueness is still enforced. What should the developer do?
Why D works: When key data contains characters such as the slash, retrieve, update, and upsert actions stop working, so integration keys should sit on columns free of those characters.
Why A fails: Encoding tricks are not a documented fix for this limitation.
Why B fails: A second key does not change how the first key behaves.
Why C fails: Columns that use column security cannot be part of an alternate key at all.
How do the wrong answers in these questions get built?
Wrong choices on a developer exam are rarely random. In these 12 questions, each distractor falls into one of four patterns, and recognizing the pattern is faster than recalling the documentation.
| Distractor pattern | What it looks like | Seen in |
|---|---|---|
| Right tool, wrong timing | A post-change event or a post-trigger step offered for something that must be stopped beforehand | U2, E4 |
| Limit you can't raise | A larger timeout or more threads offered against a fixed platform limit | E2, E3 |
| Adjacent feature, different behavior | A neighboring option that sounds equivalent but behaves differently, such as a queue versus a one-way contract | B1, B2, U1, I1 |
| Right name, wrong place | A context property, trace log, audit history, or Conditional Access offered for a value or problem that lives elsewhere | E1, U3, I2 |
Ready to sit all four domains under a clock?
The exam readiness quiz runs timed AB-400 sets weighted like the real domains, and the full bank behind it holds 500 questions.
Take the AB-400 readiness quiz →Questions about these AB-400 samples
Are these questions from the real exam?
No. Microsoft does not release exam items. These are original questions written against the AB-400 skills-measured list, and each one cites the bullet it targets so you can check it against the official study guide.
Why do plug-in and limits questions dominate?
Domain 3, Extend Microsoft Power Platform, carries 35–40% of the exam, and plug-ins, Web API limits, and Azure Functions sit inside it. The AB-400 study guide turns those weightings into a week-by-week plan.
I missed most of the Domain 3 questions. What next?
Re-read each rationale, then review the plug-in pipeline stages and service protection limits in the AB-400 cheat sheet before attempting another set.
Does AB-400 test new Foundry and agent topics?
Yes. The skills-measured list includes building Microsoft Foundry agents that integrate with Power Platform, and connecting to Copilot Studio agents. Those topics rest on documentation that is still changing, so the 12 samples here stick to behavior that is stable and well documented.
Can I still prepare with PL-400 material?
Much of the plug-in, PCF, and integration content carries over, but AB-400 adds code apps, agents, and Python SDK topics. Our PL-400 practice questions still help with the shared foundation.
More AB-400 preparation
A six-week plan built around the four domain weightings.
AB-400 Cheat SheetReference tables for plug-ins, limits, endpoints, and keys.
AB-400 Practice ExamsQuestion bank details, domain coverage, and free questions.
All Microsoft CertificationsBrowse every certification MSCertQuiz covers.