Exam MS-600: Building Applications and Solutions with Microsoft 365 Core Services Practice Test
MS-600 concerns building applications and solutions that connect with Microsoft 365 services. Practice topics include Microsoft Graph requests, authentication flows, application permissions, and SharePoint Framework extensions. These areas involve choosing how an app obtains access, sends authorized requests, and adds functionality within Microsoft 365 experiences.
Exam overview
About the Exam MS-600: Building Applications and Solutions with Microsoft 36… Exam
Application developers need to distinguish delegated access, which acts on behalf of a signed-in user, from app-only access used by services without a user present. Work also involves selecting an appropriate authentication flow, handling redirect URIs, and protecting credentials in server-side deployments. Microsoft Graph skills include forming requests, setting headers such as Content-Type for JSON, using access tokens in authorized calls, and tracking resource changes without repeatedly downloading full collections. SharePoint Framework work can involve using the current user's context for service calls and selecting extension points such as document-library toolbar commands. Teams integrations may also require linking an interaction to a destination in an app's hosted site. The practice-bank examples focus on these implementation choices and the reasoning behind them.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
A Microsoft 365 app needs to call Microsoft Graph on behalf of a signed-in user. Which authentication flow is appropriate for a web app that can securely store a client secret and handle a redirect URI?
Show answer
Correct answer: BThe authorization code flow is designed for applications that authenticate users through a redirect and exchange an authorization code for tokens. A confidential web app can authenticate to the identity platform using its client credential during that exchange.
A Microsoft 365 app must let an administrator review and approve access requests for an application before users can use it. Which Microsoft Entra application feature is most directly associated with this workflow?
Show answer
Correct answer: AThe admin consent workflow supports routing user requests for application permissions to an administrator for review and approval. The other features concern password management, location conditions, or directory synchronization.
A developer is building a SharePoint Framework solution and wants to add a command to the toolbar of a document library. Which extension type is designed for this kind of toolbar command?
Show answer
Correct answer: AA SharePoint Framework ListView Command Set adds commands to list or library interfaces, including command bars and item menus. The other options serve different extension or page-composition purposes.
A developer needs to ensure a Microsoft Graph request body is interpreted as JSON. Which HTTP header should the request normally include?
Show answer
Correct answer: AFor a JSON request body, `Content-Type: application/json` indicates the media type being sent. `Accept` can separately describe the response format the client prefers.
A Microsoft 365 application needs to keep client credentials out of its source code and deployment package. Which approach is most appropriate for a server-side application hosted in Azure?
Show answer
Correct answer: AAzure Key Vault provides protected storage for secrets, and a managed identity can let an Azure-hosted application access the vault without embedding another credential in code. Client-side code and manifests are not secure locations for secrets.
A SharePoint Framework web part needs to make a call to a Microsoft Graph endpoint using the current user's context. Which approach is intended for this scenario?
Show answer
Correct answer: ASPFx provides authenticated client abstractions, including AadHttpClient and MSGraphClient, for calling protected APIs in the current SharePoint user context, subject to permissions and consent. Secrets and user passwords must not be embedded in client-side code.
A background process needs to identify changes to a Microsoft Graph resource over time without repeatedly retrieving the entire collection. Which general Graph capability is designed to return changes since a previous synchronization state?
Show answer
Correct answer: ADelta query supports incremental synchronization by returning changes since a prior delta state, helping applications avoid repeatedly downloading all items. Batching combines requests, while the other options address unrelated resources or operations.
How to use this practice test
The free practice set draws up to 20 random questions from the 50-question bank. Complete a session to see results and identify which areas—such as Graph authorization, credential handling, or SharePoint Framework extensions—need closer review. Use missed questions to revisit the underlying implementation decision, not just the selected answer.
Preparation tips
- For each authentication scenario, identify whether the app acts for a signed-in user or runs without one, then match that need to an appropriate flow and permission model.
- Practice tracing a Microsoft Graph request from token acquisition through the Authorization header, request method, endpoint, and JSON Content-Type header.
- Compare approaches for protecting server-side client credentials, including keeping secrets out of source code and deployment packages.
- Review SharePoint Framework extension points and map a document-library toolbar command to the appropriate extension type.
- Work through change-tracking scenarios and distinguish incremental synchronization from retrieving an entire resource collection repeatedly.