PL-300 Practice Test 40 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps to monitor Power BI activity. You need to receive an alert when a user exports a report with a sensitivity label of 'Highly Confidential' from Power BI service. What should you configure?

Accepted Answer

Create an activity policy in Microsoft Defender for Cloud Apps.. Option A is correct because Microsoft Defender for Cloud Apps allows you to create an activity policy that triggers alerts based on specific activities, such as exporting reports with specific sensitivity labels. Option B is wrong because Power BI audit logs can be monitored but require custom alerts via Sentinel or other tools; Defender for Cloud Apps provides built-in alerting. Option C is wrong because sensitivity labels themselves do not generate alerts. Option D is wrong because Microsoft 365 compliance alerts are separate and not focused on Power BI exports.

Answer

Set up a Microsoft 365 compliance alert for data export events.

Answer

Enable audit logging in Power BI and configure alerts in Microsoft Sentinel.

Answer

Apply a protection policy in Microsoft Purview that blocks export for 'Highly Confidential' labels.

Question 2

Refer to the exhibit. You run a PowerShell script to list workspaces and their users. You need to ensure that only members of the sales security group can access the Sales workspace. What should you do?

Accepted Answer

Remove the individual users (user1 and user2) from the Sales workspace.. Option B is correct because the exhibit shows that the sales security group is already an Admin in the workspace. However, user1 and user2 are individual users with Member and Contributor roles. To restrict access to only the security group, you must remove these individual users. Option A is wrong because the security group is already added as Admin, which is sufficient for access. Option C is wrong because the Marketing workspace is deleted and irrelevant. Option D is wrong because changing the security group role to Viewer would reduce permissions, but the core issue is the individual users.

Answer

Restore the Marketing workspace and move the reports there.

Answer

Add the sales security group as a Contributor to the Sales workspace.

Answer

Change the sales security group's role to Viewer.

Question 3

You are troubleshooting a Power BI DirectQuery model connected to Azure Synapse Analytics. The report shows stale data even though the underlying database is updated hourly. What should you check first?

Accepted Answer

Whether the report has 'Disable caching' enabled in the dataset settings.. Option A is correct because DirectQuery does not cache data; each query goes to the source. However, Power BI may cache query results at the report level. The 'Disable caching' option ensures fresh data. Option B is wrong because scheduled refresh is for import models. Option C is wrong because RLS does not affect data freshness. Option D is wrong because storage mode is import; DirectQuery is a separate mode.

Answer

Whether the dataset is using Import mode instead of DirectQuery.

Answer

Whether the user has RLS permissions that filter data incorrectly.

Answer

Whether the dataset is configured for scheduled refresh.

Question 4

A data analyst needs to ensure that a Power BI dataset used in a shared workspace is refreshed daily at 6 AM. The data source is an Azure SQL Database. The analyst's account has database permissions. What should the analyst configure?

Accepted Answer

Configure scheduled refresh in the dataset settings.. Option B is correct because a scheduled refresh in the dataset settings allows configuring refresh frequency and time. Option A is wrong because Gateway is needed only for on-premises sources. Option C is wrong because XMLA endpoints are for advanced management, not scheduling refresh. Option D is wrong because the refresh is scheduled on the dataset, not the report.

Answer

Enable XMLA endpoints for the workspace.

Answer

Install an on-premises data gateway.

Answer

Configure refresh in the report settings.

Question 5

Refer to the exhibit. A Power BI dataset uses a service principal to connect to an Azure SQL Database. The dataset fails to refresh with an authentication error. What is the most likely cause?

Accepted Answer

The service principal credentials are not configured in the data gateway.. Option C is correct because the service principal (client secret or certificate) must be stored in the gateway cluster credentials. Option A is wrong because the database name is correct. Option B is wrong because server name is correct. Option D is wrong because service principal has an ID, but the password/secret is missing from the exhibit; the credentials need to be configured in the gateway.

Answer

The database name is incorrect.

Answer

The service principal ID is invalid.

Answer

The server name is incorrect.

Question 6

A company deploys Power BI for internal reporting. The security team requires that all report data be encrypted at rest and in transit, and that access be granted only to users with verified identities. Which combination of features should the Power BI administrator use?

Accepted Answer

Leverage Azure SQL Database Transparent Data Encryption (TDE), TLS, and Microsoft Entra ID. Option C is correct because Power BI uses Azure SQL Database encryption at rest, TLS for data in transit, and integrates with Microsoft Entra ID for authentication. Option A is wrong because Microsoft Purview is for data governance, not encryption. Option B is wrong because SharePoint is not a core encryption or identity service for Power BI. Option D is wrong because Microsoft Intune is for mobile management, not encryption.

Answer

Apply row-level security (RLS) and use Microsoft Intune for conditional access

Answer

Use Microsoft Purview for encryption and Microsoft Intune for identity

Answer

Enable Power BI encryption settings and configure SharePoint permissions

Question 7

Which THREE components must be in place to enable Power BI data sensitivity labels from Microsoft Purview? (Select exactly three.)

Accepted Answer

Power BI admin setting to enable sensitivity labels enabled. Options B, C, and D are correct. A Purview Information Protection subscription is required; sensitivity labels must be published to users or groups; and Power BI admin settings must enable sensitivity labels. Option A is wrong because the Power BI license is not a prerequisite; any license can use labels if the admin enables them. Option E is wrong because a Premium capacity is not required; labels work with Pro and Premium.

Answer

Power BI Premium capacity assigned to the workspace

Answer

Power BI Pro license for all users

Question 8

You have a Power BI dataset that uses a DirectQuery connection to Azure Synapse Analytics. Users report that the report is slow. You need to improve query performance without changing the data source. What should you do?

Accepted Answer

Reduce the number of visuals on each report page.. Option C is correct because reducing the number of visuals on a page reduces the number of queries sent to the data source. Option A is incorrect because increasing scheduled refresh does not affect DirectQuery. Option B is incorrect because disabling RLS would not improve performance significantly. Option D is incorrect because reducing the cardinality of measures does not reduce the number of queries.

Answer

Reduce the cardinality of calculated measures.

Answer

Disable row-level security (RLS) on the dataset.

Answer

Increase the scheduled refresh frequency.

Question 9

You are deploying a Power BI solution for a multinational company. The data contains personally identifiable information (PII) subject to GDPR. You need to ensure that users outside the European Union cannot access the underlying data when viewing reports in the Power BI service. What should you implement?

Accepted Answer

Configure Power BI multi-geo and implement row-level security (RLS) based on user region.. Option D is correct because Power BI allows setting geographic data residency at the tenant level, ensuring data is stored in a specific region. Additionally, row-level security (RLS) can restrict data access based on user location, but the question specifically mentions preventing access from outside the EU, which is best achieved by combining multi-geo with RLS. Option A is wrong because Microsoft Entra ID Conditional Access can block access to the service, but not to the data within reports. Option B is wrong because data classification restricts actions but not access. Option C is wrong because sensitivity labels do not block access.

Answer

Apply data classification labels to the datasets and configure protection policies.

Answer

Use Microsoft Entra ID Conditional Access policies to block access from non-EU IP addresses.

Answer

Use Microsoft Purview sensitivity labels to restrict access to EU users only.

Question 10

Refer to the exhibit. You are reviewing the configuration of a Power BI dataset with row-level security (RLS). A user named 'user@contoso.com' reports that they can see all data when they should see only data for their region. What is the most likely cause?

Accepted Answer

The 'effectiveIdentity' is set to the user's email, bypassing RLS.. Option C is correct because the 'effectiveIdentity' property in the exhibit is set to 'user@contoso.com', which overrides RLS and allows that user to see all data. In Power BI, the effective identity is used for testing but in production, it should not be set for a specific user if RLS is intended. Option A is wrong because the roles include users, so RLS is configured. Option B is wrong because the exhibit does not indicate a missing role mapping. Option D is wrong because the roles are defined; the issue is the effective identity.

Answer

The RLS roles are missing the 'SalesRole' mapping to the dataset.

Answer

The dataset does not have any RLS roles defined.

Answer

The user is not assigned to any RLS role.

Question 11

You need to share a Power BI dashboard with a large group of users in your organization. The users should not be able to edit the dashboard or share it with others. What is the most efficient method?

Accepted Answer

Create a workspace app and grant the group Viewer access.. Option D is correct because creating a workspace app and granting Viewer access to the group is the most scalable and manageable approach. Option A is wrong because sharing via email is not scalable. Option B is wrong because publish to web is public. Option C is wrong because granting Member role allows editing and sharing.

Answer

Add all users as Members of the workspace.

Answer

Share the dashboard directly with each user's email address.

Answer

Publish the dashboard to the web.

Question 12

A company is deploying Power BI for the entire organization. They need to prevent users from sharing reports with external email addresses. Which configuration should the Power BI admin use?

Accepted Answer

Disable 'Share content with external users' in the Power BI admin portal.. Option D is correct because the admin portal has a setting to control sharing with external users. Option A is wrong because tenant-level sharing settings are in the admin portal, not Microsoft Entra ID. Option B is wrong because sensitivity labels classify data but do not block sharing. Option C is wrong because sharing settings are not in workspace settings.

Answer

Configure a Conditional Access policy in Microsoft Entra ID.

Answer

Apply a Microsoft Purview sensitivity label.

Answer

Set the workspace sharing settings to 'Only existing users'.

Question 13

Refer to the exhibit. A user is a member of both 'HRManager' and 'Executive' RLS roles. The dataset uses DirectQuery. When the user views a report showing all employees, what data will they see?

Accepted Answer

Rows where Department is 'HR' or 'Executive' (union).. Option B is correct because in Power BI, when a user belongs to multiple RLS roles, the filters are combined using OR logic, so the user sees rows satisfying either role. Option A is wrong because it would require intersection (AND). Option C is wrong because all rows are not returned. Option D is wrong because both roles are applied.

Answer

All rows in the Employees table.

Answer

Only rows where Department is both 'HR' and 'Executive' (intersection).

Answer

No rows because roles conflict.

Question 14

A Power BI administrator deploys a dashboard that uses a real-time dataset from Azure Stream Analytics. The dashboard must refresh every minute. The administrator notices that the dashboard sometimes shows stale data. What is the most likely cause and solution?

Accepted Answer

The dashboard tile cache is set to the default 30 minutes. Reduce the cache duration to 1 minute in the dataset settings. Option A is correct because Power BI has a default dashboard tile cache of 30 minutes for streaming datasets; reducing the cache duration solves the issue. Option B is wrong because the data source is streaming, not push. Option C is wrong because automatic page refresh is for report pages, not dashboard tiles. Option D is wrong because the issue is cache, not the refresh interval.

Answer

The streaming dataset is not supported for dashboards. Use a push dataset instead

Answer

Enable automatic page refresh on the dashboard and set it to 1 minute

Answer

The refresh interval in the dataset is set to 30 minutes. Change it to 1 minute

Question 15

A Power BI administrator needs to allow an external partner organization to access a specific report without requiring them to have Power BI Pro licenses. The report is stored in a workspace assigned to a Premium capacity. What is the correct configuration?

Accepted Answer

Invite the external users as guest users in Microsoft Entra ID, add them to the workspace with Viewer role, and share the report or app. Option D is correct because in a Premium capacity workspace, you can share reports with external users (B2B collaboration) and grant access via app or direct sharing; the external user's Microsoft Entra ID tenant is trusted, and they can access without a Pro license if the workspace is on Premium. Option A is wrong because publish to web makes the report public, not secure. Option B is wrong because embedding requires a license or capacity. Option C is wrong because external users need to be invited as guests.

Answer

Add the external users as members of the workspace and assign them a Viewer role

Answer

Publish the report to the web and share the public link

Answer

Embed the report in a secure portal using the 'embed for your organization' option