PL-300 Practice Test 38 — 15 Questions

Question 1

A Power BI administrator needs to ensure that reports containing sensitive financial data are only accessible to users who have completed mandatory training and are using compliant devices. The organization uses Microsoft Entra ID and Microsoft Intune. Which feature should the administrator configure?

Accepted Answer

Create a Conditional Access policy that requires device compliance and a specific group membership for training completion. Option B is correct because Conditional Access policies in Microsoft Entra ID can enforce access controls based on device compliance (Intune) and training completion (custom attribute or group membership). Option A is wrong because sensitivity labels classify and protect data, but do not enforce device compliance or training. Option C is wrong because RLS restricts data within a report, not access to the report itself. Option D is wrong because Microsoft Purview is for data governance, not access policies.

Answer

Deploy Microsoft Purview to scan the reports and enforce access policies

Answer

Use row-level security (RLS) to filter data based on user training status

Answer

Apply sensitivity labels to the reports and require MFA

Question 2

A user reports that they cannot publish a Power BI Desktop file to the Power BI service. The error message indicates insufficient permissions. The user is a member of a workspace and has the Viewer role. What is the most likely cause?

Accepted Answer

The user has the Viewer role in the workspace. Option B is correct because the Viewer role in a Power BI workspace does not allow publishing or editing. Option A is wrong because the Power BI license is required but the user has a license as a workspace member. Option C is wrong because the report may not be in a shared drive, but the core issue is role permissions. Option D is wrong because RLS does not affect publishing permissions.

Answer

Row-level security (RLS) is preventing the user from seeing the data

Answer

The user does not have a Power BI Pro license

Answer

The .pbix file is stored on a network share that restricts write access

Question 3

Refer to the exhibit. A Power BI administrator is reviewing a dataset configuration exported from a workspace. The dataset connects to an on-premises SQL Server using Windows authentication. The administrator wants to configure a gateway to support scheduled refresh without storing credentials. Which gateway type and configuration should be used?

Accepted Answer

Use the on-premises data gateway (standard mode) and configure Kerberos constrained delegation for single sign-on. Option D is correct because the on-premises data gateway supports Windows authentication via Kerberos constrained delegation, allowing refresh without storing credentials. Option A is wrong because the personal gateway is only for a single user and requires credentials. Option B is wrong because the VNet gateway is for Azure VNets, not on-premises. Option C is wrong because the on-premises data gateway does not need a connection string stored in the gateway; it uses the dataset's connection string.

Answer

Use the on-premises data gateway (standard mode) and store the connection string in the gateway

Answer

Use the on-premises data gateway (personal mode) and store the Windows credentials in the gateway

Answer

Use the virtual network (VNet) gateway and configure a service principal

Question 4

You are a Power BI administrator. Your organization uses Microsoft Entra ID for identity management. You need to ensure that only users from specific security groups can access the Power BI service. What should you configure?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID that grants access to Power BI only for members of the allowed security groups.. Option C is correct because conditional access policies in Microsoft Entra ID can restrict access to the Power BI service based on security group membership. Option A is wrong because the Power BI admin portal does not have a setting to restrict access to specific security groups. Option B is wrong because guest user settings control external access, not internal group restrictions. Option D is wrong because workspace access settings control access to workspaces, not the service itself.

Answer

In the Power BI admin portal, configure the 'Allow users to access Power BI' setting to specify the security groups.

Answer

Configure the 'B2B guest user settings' to allow only specific domains.

Answer

Modify the workspace access permissions to include only the allowed security groups.

Question 5

A Power BI workspace contains a report that uses a shared dataset. The dataset owner leaves the company. The report still works, but the dataset cannot be refreshed. What should the administrator do to restore refresh capability?

Accepted Answer

Take over the dataset as an administrator and update the data source credentials. Option C is correct because taking over the dataset allows the administrator to configure credentials and refresh. Option A is wrong because reassigning ownership is not a direct feature; take over is. Option B is wrong because creating a new dataset would break the report linkage. Option D is wrong because the data source credentials are stored in the dataset, not the gateway.

Answer

Reassign the dataset ownership to another user in the workspace settings

Answer

Create a new dataset and link the report to it

Answer

Reconfigure the gateway to use a service principal

Question 6

You have a Power BI workspace that contains a report connected to an Azure Analysis Services (AAS) model. The data source uses Single Sign-On (SSO) with Microsoft Entra ID. When users access the report, they see an error that the data cannot be refreshed. What is the most likely cause?

Accepted Answer

The dataset is configured in Import mode.. Option B is correct because SSO requires the dataset to use DirectQuery or Live Connection mode; Import mode does not support SSO. Option A is incorrect because the data source credentials are passed via SSO, not stored. Option C is incorrect because row-level security is applied at query time, not during connection. Option D is incorrect because SSO uses the user's identity, not a service principal.

Answer

Row-level security (RLS) is not configured on the AAS model.

Answer

The data source credentials are stored in the dataset.

Answer

The service principal used for authentication has expired.

Question 7

Which THREE components are required for a Power BI deployment pipeline? (Choose three.)

Accepted Answer

A workspace assigned to a Premium capacity.. Options A, B, and C are correct. A deployment pipeline requires a workspace assigned to a Premium capacity, at least three stages (dev, test, prod), and the pipeline must be created in the Power BI service. Option D is incorrect because a separate Azure DevOps repository is not required; deployment pipelines are native to Power BI. Option E is incorrect because a service principal is optional for automation, not required.

Answer

An Azure DevOps repository for version control.

Answer

A service principal for automated deployments.

Question 8

You have a Power BI dataset that uses DirectQuery to a SQL Server data warehouse. You need to ensure that when users view reports, they see only data relevant to their department. The data warehouse contains a 'Department' column. What should you implement?

Accepted Answer

Define row-level security (RLS) roles in Power BI Desktop and assign users.. Option B is correct because row-level security (RLS) in Power BI allows you to filter data based on the user's identity. By defining roles and using DAX filters like 'Department = USERPRINCIPALNAME()', you can restrict data. Option A is wrong because object-level security (OLS) controls access to tables/columns, not rows. Option C is wrong because data source credentials are used for connection, not for filtering. Option D is wrong because Power BI does not support query passthrough for RLS; RLS is implemented in Power BI.

Answer

Configure the data source credentials to pass the user's identity.

Answer

Create separate datasets for each department and grant access accordingly.

Answer

Implement object-level security (OLS) on the 'Department' column.

Question 9

Your organization uses Microsoft Entra ID for identity management. You have created a Power BI app workspace and assigned users to the Viewer role. However, some viewers report that they cannot export report data to Excel. What is the most likely reason?

Accepted Answer

The 'Allow viewers to export data' setting is disabled in the workspace.. Option B is correct because the 'Export data' permission is controlled by the app workspace setting 'Allow viewers to export data', which is disabled by default. Option A is wrong because Viewer role can generally view reports. Option C is wrong because licensing affects creation, not basic export. Option D is wrong because Entra ID settings do not block export at the workspace level.

Answer

Viewers do not have a Power BI Pro license.

Answer

The Viewer role does not have permission to view reports.

Answer

Microsoft Entra ID conditional access policies block data export.

Question 10

Refer to the exhibit. A Power BI administrator runs a PowerShell script to get an access token for the Power BI API. The output shows a token with claims. Based on the token, which authentication method was used?

Accepted Answer

Password-based authentication. Option B is correct because the 'amr' claim contains 'pwd', which indicates password-based authentication. Option A is wrong because MFA would show 'mfa' in amr. Option C is wrong because certificate-based authentication would show 'cert'. Option D is wrong because device code flow would show 'device_authentication'.

Answer

Multi-factor authentication (MFA)

Answer

Device code flow

Answer

Certificate-based authentication

Question 11

A data analyst creates a Power BI report using a dataset that contains sensitive salary information. The analyst needs to ensure that only HR managers can see salary columns. What should the analyst use?

Accepted Answer

Object-level security (OLS).. Option B is correct because object-level security (OLS) hides columns from specific roles. Option A is wrong because RLS filters rows, not columns. Option C is wrong because sensitivity labels are for classification, not access control. Option D is wrong because the dataset's security settings do not support column-level security natively.

Answer

Row-level security (RLS).

Answer

Microsoft Purview sensitivity labels.

Answer

Set the dataset security to 'Restrict access'.

Question 12

An organization uses Power BI with Microsoft Purview Information Protection. A report contains sensitive customer data. The administrator wants to ensure that when the report is exported to Excel, the sensitivity label is automatically applied. What must be configured?

Accepted Answer

Enable auto-labeling in the Power BI admin settings and configure the sensitivity label policy. Option B is correct because Power BI supports automatic sensitivity labeling based on data classification, which can propagate to exports. Option A is wrong because manual labeling is not automatic. Option C is wrong because RLS does not affect labeling. Option D is wrong because the label is applied by Power BI, not Excel.

Answer

Configure the Excel workbook to inherit the label from Power BI

Answer

Use row-level security to restrict access to sensitive data

Answer

Require users to manually apply a sensitivity label before exporting

Question 13

You need to ensure that only members of a specific security group can view a Power BI dashboard. The dashboard is in a shared workspace. What should you do?

Accepted Answer

Publish the dashboard as an app and set the security group as the audience.. Option C is correct because Power BI allows restricting access to a dashboard by using App permissions and audience targeting. Option A is incorrect because workspace roles grant access to all content in the workspace, not specific items. Option B is incorrect because sharing gives access to the dashboard but does not restrict to a security group automatically. Option D is incorrect because row-level security filters data, not the dashboard visibility.

Answer

Assign the security group the Viewer role on the workspace.

Answer

Configure row-level security on the underlying dataset to filter by user.

Answer

Share the dashboard directly with the security group.

Question 14

Which TWO methods can you use to share a Power BI report with external users who do not have a Power BI Pro license? (Choose two.)

Accepted Answer

Embed the report in a secure portal using 'Embed for your customers'.. Options A and D are correct. You can share a report by publishing to a public website (if allowed) or by embedding it in a secure portal using the 'Embed for your customers' option (requires Premium). Option B is incorrect because sharing via email requires the recipient to have a Pro license. Option C is incorrect because exporting to PDF does not provide interactive sharing. Option E is incorrect because exporting to Excel is not a sharing method.

Answer

Export the report to PDF and share the file.

Answer

Share directly via Power BI using the user's email address.

Answer

Export the report to Excel and attach it to an email.

Question 15

You need to audit Power BI activities such as viewing reports, sharing dashboards, and exporting data. Which TWO actions should you take to enable and access audit logs? (Choose two.)

Accepted Answer

Access the audit log from the Microsoft 365 compliance portal.. Options A and C are correct. Enabling the audit log in the Power BI admin portal is the first step. Option C is correct because audit logs are stored in the Microsoft 365 compliance portal. Option B is wrong because Microsoft Defender for Cloud Apps is not the primary storage for audit logs. Option D is wrong because Azure Monitor is not used for Power BI audit logs. Option E is wrong because Power BI itself does not store audit logs; it sends them to the Microsoft 365 audit log.

Answer

Configure Microsoft Defender for Cloud Apps to forward logs to Microsoft Sentinel.

Answer

Use the 'Export' feature in Power BI to export audit logs to a CSV file.

Answer

Set up a diagnostic setting in Azure Monitor to collect Power BI logs.