Question 10
At Timberline Foods, the supply-chain systems team is implementing a vendor onboarding project under requirements for continuous approved supplier status. After the proposed change, the release reviewer requires evidence for: A customer app uses a privileged application identity for every employee action and cannot attribute who accessed a confidential record. Which result BEST proves the intended fix is effective?
Explanation
Correct Answer
Access logs distinguish actual human or service principals and unprivileged users cannot retrieve restricted records. This directly tests whether the reported failure has been corrected: A customer app uses a privileged application identity for every employee action and cannot attribute who accessed a confidential record. The intended action was Design delegated or appropriately scoped app-only authentication with least-privilege identity and auditable authorization boundaries. The observed Timberline Foods outcome is stronger evidence than a completed ticket or a saved configuration alone.
Incorrect Answers
Load testing meets the required telemetry scale and retention needs while transactional records stay correctly modeled. Such evidence would validate a different change: A cross-department app must store high-volume short-lived telemetry that would overwhelm a standard transactional Dataverse table. It follows the separate remedy Evaluate an elastic table and its partitioning and consistency characteristics against the workload instead of defaulting to a standard table. The Timberline Foods scenario instead reports A customer app uses a privileged application identity for every employee action and cannot attribute who accessed a confidential record. The decisive observation must be: Access logs distinguish actual human or service principals and unprivileged users cannot retrieve restricted records.
The component invokes only approved tools and renders within the supported experience without broad cross-record access. Such evidence would validate a different change: A user interface needs an MCP-enabled interactive widget but the team proposes embedding an unrestricted third-party script in every record form. It follows the separate remedy Choose a supported MCP app widget or approved component surface with scoped permissions and safe interaction boundaries. The Timberline Foods scenario instead reports A customer app uses a privileged application identity for every employee action and cannot attribute who accessed a confidential record. The decisive observation must be: Access logs distinguish actual human or service principals and unprivileged users cannot retrieve restricted records.
A test agent requests authorization before any financial action and cannot call disallowed refund operations. Such evidence would validate a different change: A business wants an autonomous support assistant to trigger account refunds directly from loosely worded prompts. It follows the separate remedy Design a Copilot Studio or Foundry agent with bounded tools, explicit approval for refunds, and audit controls. The Timberline Foods scenario instead reports A customer app uses a privileged application identity for every employee action and cannot attribute who accessed a confidential record. The decisive observation must be: Access logs distinguish actual human or service principals and unprivileged users cannot retrieve restricted records.