PL-300 Manage and secure Power BI — 30 Questions

Question 1

You are a Power BI administrator. A user reports that a shared dashboard shows 'Sensitive data detected' for certain visualizations, but the dashboard is configured with row-level security (RLS). What is the most likely cause of this issue?

Accepted Answer

A Microsoft Purview sensitivity label is applied to the dataset or report.. Option B is correct because Microsoft Purview Information Protection sensitivity labels take precedence over RLS; a label applied to a dataset or report can flag data as sensitive regardless of RLS. Option A is wrong because RLS does not block sensitivity labels from being applied. Option C is wrong because the dashboard owner's permissions do not affect label detection. Option D is wrong because the Power BI service does not strip sensitivity labels for external users unless explicitly configured.

Answer

The dashboard owner has not granted the user 'Build' permission on the dataset.

Answer

RLS is incorrectly configured and allowing users to see data they should not.

Answer

The user is viewing the dashboard in a browser that does not support sensitivity labels.

Question 2

A Power BI administrator needs to enforce that all datasets published to the service use certified data sources only. Which two settings should be configured? (Choose two.)

Accepted Answer

Use Microsoft Sentinel to audit Power BI activity logs and flag non-certified data sources.. Option A (tenant setting for 'Certification' of data sources) and Option C (admin monitoring with Microsoft Sentinel) are correct. Option A directly enforces certification. Option C allows detection of non-compliant datasets via logs. Option B (Row-level security) does not enforce data source certification. Option D (B2B guest settings) is irrelevant. Option E (dataflow certification) certifies dataflows, not datasets.

Answer

Enable 'Certification' for dataflows in the Power BI tenant settings.

Answer

Configure row-level security (RLS) on all datasets.

Answer

Set up B2B guest user permissions to restrict external data sources.

Question 3

You are a Power BI administrator. A user reports that their scheduled data refresh fails with error 'The data source credentials are no longer valid.' The dataset uses a SQL Server database with Windows authentication. What should you do first to resolve the issue?

Accepted Answer

Ask the user to update the data source credentials in the Power BI service dataset settings.. Option C is correct because the most common cause for Windows authentication failures is a password change; the user can update credentials in the dataset settings. Option A is wrong because the on-premises gateway is not necessarily the issue. Option B is wrong because impersonation does not apply to Windows credentials. Option D is wrong because capacity reassignment does not fix credential issues.

Answer

Reinstall the on-premises data gateway on the server.

Answer

Reassign the dataset to a different Premium capacity.

Answer

Modify the dataset to use 'Impersonate the authenticated user' for data sources.

Question 4

You are a Power BI administrator. Your organization uses Microsoft Purview to manage sensitivity labels. You need to ensure that when a report is exported to PDF, the sensitivity label is automatically applied to the PDF file. What should you configure?

Accepted Answer

Enable the tenant setting 'Apply sensitivity labels to exported data' in the Power BI admin portal.. Option D is correct because Power BI can enforce sensitivity labels on exported files when the tenant setting 'Apply sensitivity labels to exported data' is enabled. Option A is wrong because the labeling policy applies at the report level, not during export. Option B is wrong because file encryption settings in Purview do not control Power BI export behavior. Option C is wrong because the sensitivity label in the report does not automatically carry over to exports unless the tenant setting is enabled.

Answer

Enable 'Microsoft Purview Information Protection' file encryption settings.

Answer

Set the default sensitivity label for the workspace to 'Confidential'.

Answer

Configure a Microsoft Purview auto-labeling policy for Power BI reports.

Question 5

A Power BI administrator wants to allow users to create dashboards and reports, but prevent them from sharing content outside the organization. Which two settings should be configured in the Power BI admin portal? (Choose two.)

Accepted Answer

Disable 'Share content with external users' in the tenant settings.. Option A (control 'Share content with external users') and Option D (disable 'Publish to web') are correct. Option A directly blocks sharing with external users. Option D prevents public sharing via embed codes. Option B (create workspaces) is irrelevant to sharing. Option C (export data) is about exporting, not sharing. Option E (featured tables) is unrelated.

Answer

Disable 'Create workspaces' in the tenant settings.

Answer

Disable 'Export data' in the tenant settings.

Answer

Disable 'Featured tables' in the tenant settings.

Question 6

You are a Power BI administrator. A Power BI dataset owner reports that the dataset is not refreshing automatically, but manual refreshes work fine. The dataset uses a cloud data source (Azure SQL Database) with OAuth2 credentials. What is the most likely cause?

Accepted Answer

The OAuth2 token used for the data source credentials has expired.. Option B is correct because OAuth2 tokens can expire, causing automatic refresh failures while manual refreshes work (since the user reauthenticates). Option A is wrong because gateway issues typically affect both manual and automatic refreshes. Option C is wrong because capacity restrictions would also affect manual refreshes. Option D is wrong because RLS does not affect refresh functionality.

Answer

Row-level security (RLS) is misconfigured.

Answer

The on-premises data gateway is offline.

Answer

The dataset exceeds the refresh limit for the assigned capacity.

Question 7

Refer to the exhibit. You are a Power BI administrator reviewing a workspace capacity configuration in the Power BI admin portal. Based on the exhibit, which of the following is true?

Accepted Answer

The workspace is on a Premium capacity with ABFSSmall storage format.. Option C is correct because 'ABFSSmall' is a valid Premium capacity storage format (Azure Blob File System Small). Option A is wrong because encryption is 'ServiceManaged', not 'CustomerKey'. Option B is wrong because there is no 'SharePoint' in allowedDataSources. Option D is wrong because the data classification is set to 'Confidential', not 'General'.

Answer

The workspace has data classification set to 'General'.

Answer

The workspace uses a customer-managed encryption key.

Answer

The workspace allows data sources from SharePoint Online.

Question 8

You are a Power BI administrator. A user in the Sales department needs to create reports using a shared dataset, but should not be able to modify the dataset or share it with others. What is the minimum permission level you should assign to the user on the dataset?

Accepted Answer

Build. Option C is correct because 'Build' permission allows a user to create reports based on a dataset without being able to modify or share the dataset. Option A is wrong because 'Read' permission only allows viewing reports, not building new ones. Option B is wrong because 'Reshare' is not a standalone permission; sharing is part of the 'Share' permission. Option D is wrong because 'Write' would allow modifications.

Answer

Reshare

Answer

Write

Answer

Read

Question 9

A Power BI administrator needs to audit which users have exported data from a specific report in the last 30 days. What is the most efficient way to retrieve this information?

Accepted Answer

Query the Power BI activity log using the audit log search in the Microsoft 365 Defender portal.. Option A is correct because the Power BI activity log contains export events (e.g., 'ExportToCSV', 'ExportToExcel') that can be filtered by report and date. Option B is wrong because Azure Monitor for Power BI Premium provides metrics but not detailed user-level export logs. Option C is wrong because Microsoft Purview audit logs may not include Power BI export events. Option D is wrong because the usage metrics report only shows aggregate usage, not individual export actions.

Answer

Use the Microsoft Purview compliance portal to search for 'Export' events.

Answer

Check the report's usage metrics report for export counts.

Answer

Review the 'Export to Excel' metrics in the Azure Monitor for Power BI Premium.

Question 10

Refer to the exhibit. You are reviewing a Power BI activity log entry. What action should you take to ensure compliance if the user who created the report should not have access to 'Confidential' data?

Accepted Answer

Investigate the user's permissions on the dataset 'SalesDataset' to verify they are authorized to access confidential data.. Option B is correct because the activity log shows the user created a report with a 'Confidential' sensitivity label. The best action is to investigate the user's access permissions to the underlying dataset to ensure they are authorized. Option A is wrong because the report was already created. Option C is wrong because removing the label does not address the root cause. Option D is wrong because the event indicates the report was created, not just an attempt.

Answer

Delete the report immediately.

Answer

Change the sensitivity label on the report to 'General'.

Answer

Ignore the event because the report creation is logged but not necessarily a violation.

Question 11

You are a Power BI administrator. Your organization uses Microsoft Entra ID for identity management. You need to ensure that only users from specific security groups can access the Power BI service. What should you configure?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID that grants access to Power BI only for members of the allowed security groups.. Option C is correct because conditional access policies in Microsoft Entra ID can restrict access to the Power BI service based on security group membership. Option A is wrong because the Power BI admin portal does not have a setting to restrict access to specific security groups. Option B is wrong because guest user settings control external access, not internal group restrictions. Option D is wrong because workspace access settings control access to workspaces, not the service itself.

Answer

In the Power BI admin portal, configure the 'Allow users to access Power BI' setting to specify the security groups.

Answer

Configure the 'B2B guest user settings' to allow only specific domains.

Answer

Modify the workspace access permissions to include only the allowed security groups.

Question 12

A Power BI administrator needs to prevent users from creating new workspaces, but allow existing workspaces to continue functioning. Which two settings should be configured? (Choose two.)

Accepted Answer

In the Power BI admin portal, under 'Workspace settings', disable 'Create workspaces' for all users.. Option A (disable 'Create workspaces' for all users) and Option D (enable 'Block users from creating workspaces' in the admin portal) are correct. Option A is a tenant setting to disable workspace creation. Option D is the actual admin portal setting. Option B is wrong because disabling 'Use workspaces' would break existing workspaces. Option C is wrong because setting a group policy is not the correct approach. Option E is wrong because removing workspace creation from the admin portal is not a granular setting.

Answer

Set the 'Maximum number of workspaces a user can create' to 0 for all security groups.

Answer

Remove the 'Create workspace' button from the Power BI navigation pane using custom branding.

Answer

In the Power BI admin portal, disable 'Use workspaces' for all users.

Question 13

You are a Power BI administrator. A user reports that they cannot see a shared dashboard in their Power BI account. You verify that the dashboard has been shared with the user. What is the most likely cause?

Accepted Answer

The user is looking in the wrong workspace or the dashboard is located in a different workspace.. Option B is correct because the user may be accessing the wrong workspace or the dashboard may be shared in a different workspace context. Option A is wrong because if the user is signed in with the wrong account, they would see a different set of items. Option C is wrong because the dashboard was shared, so sharing is not the issue. Option D is wrong because the dashboard owner's license does not affect visibility for the user.

Answer

The dashboard owner does not have a Power BI Pro license.

Answer

The user is signed in with the wrong Microsoft Entra ID account.

Answer

The dashboard has not been shared with the user's security group.

Question 14

You are a Power BI administrator. Your organization wants to use Microsoft Defender XDR to monitor Power BI activity for suspicious behavior. Which two components are essential for this integration? (Choose two.)

Accepted Answer

Power BI activity logs streamed to Microsoft Sentinel.. Option A (Power BI activity logs streamed to Microsoft Sentinel) and Option D (Microsoft Defender XDR advanced hunting) are correct. Option A provides the data source. Option D allows querying the data for anomalies. Option B is wrong because Microsoft Intune manages devices, not Power BI. Option C is wrong because Microsoft Purview is for compliance, not threat detection. Option E is wrong because Microsoft Foundry is for AI workloads.

Answer

Microsoft Purview data classification policies.

Answer

Microsoft Foundry AI models.

Answer

Microsoft Intune device compliance policies.

Question 15

A Power BI administrator needs to ensure that all reports in a workspace are labeled with a sensitivity label automatically when created. The workspace is used by multiple departments. What should the administrator configure?

Accepted Answer

Set a default sensitivity label for the workspace in the workspace settings.. Option D is correct because Power BI supports automatic labeling via default labels at the workspace level, which can be set by administrators or workspace owners. Option A is wrong because manual labeling is not automatic. Option B is wrong because Microsoft Purview auto-labeling policies apply to the service as a whole, not per workspace. Option C is wrong because the tenant default label applies to all workspaces, not a specific one.

Answer

Configure a Microsoft Purview auto-labeling policy for the workspace.

Answer

Set the default sensitivity label for the entire Power BI tenant.

Answer

Instruct all users to manually apply the sensitivity label when creating reports.

Question 16

A company deploys Power BI for internal reporting. The security team requires that all report data be encrypted at rest and in transit, and that access be granted only to users with verified identities. Which combination of features should the Power BI administrator use?

Accepted Answer

Leverage Azure SQL Database Transparent Data Encryption (TDE), TLS, and Microsoft Entra ID. Option C is correct because Power BI uses Azure SQL Database encryption at rest, TLS for data in transit, and integrates with Microsoft Entra ID for authentication. Option A is wrong because Microsoft Purview is for data governance, not encryption. Option B is wrong because SharePoint is not a core encryption or identity service for Power BI. Option D is wrong because Microsoft Intune is for mobile management, not encryption.

Answer

Apply row-level security (RLS) and use Microsoft Intune for conditional access

Answer

Use Microsoft Purview for encryption and Microsoft Intune for identity

Answer

Enable Power BI encryption settings and configure SharePoint permissions

Question 17

A Power BI administrator needs to ensure that reports containing sensitive financial data are only accessible to users who have completed mandatory training and are using compliant devices. The organization uses Microsoft Entra ID and Microsoft Intune. Which feature should the administrator configure?

Accepted Answer

Create a Conditional Access policy that requires device compliance and a specific group membership for training completion. Option B is correct because Conditional Access policies in Microsoft Entra ID can enforce access controls based on device compliance (Intune) and training completion (custom attribute or group membership). Option A is wrong because sensitivity labels classify and protect data, but do not enforce device compliance or training. Option C is wrong because RLS restricts data within a report, not access to the report itself. Option D is wrong because Microsoft Purview is for data governance, not access policies.

Answer

Deploy Microsoft Purview to scan the reports and enforce access policies

Answer

Use row-level security (RLS) to filter data based on user training status

Answer

Apply sensitivity labels to the reports and require MFA

Question 18

A user reports that they cannot publish a Power BI Desktop file to the Power BI service. The error message indicates insufficient permissions. The user is a member of a workspace and has the Viewer role. What is the most likely cause?

Accepted Answer

The user has the Viewer role in the workspace. Option B is correct because the Viewer role in a Power BI workspace does not allow publishing or editing. Option A is wrong because the Power BI license is required but the user has a license as a workspace member. Option C is wrong because the report may not be in a shared drive, but the core issue is role permissions. Option D is wrong because RLS does not affect publishing permissions.

Answer

Row-level security (RLS) is preventing the user from seeing the data

Answer

The user does not have a Power BI Pro license

Answer

The .pbix file is stored on a network share that restricts write access

Question 19

Refer to the exhibit. A Power BI administrator is reviewing a dataset configuration exported from a workspace. The dataset connects to an on-premises SQL Server using Windows authentication. The administrator wants to configure a gateway to support scheduled refresh without storing credentials. Which gateway type and configuration should be used?

Accepted Answer

Use the on-premises data gateway (standard mode) and configure Kerberos constrained delegation for single sign-on. Option D is correct because the on-premises data gateway supports Windows authentication via Kerberos constrained delegation, allowing refresh without storing credentials. Option A is wrong because the personal gateway is only for a single user and requires credentials. Option B is wrong because the VNet gateway is for Azure VNets, not on-premises. Option C is wrong because the on-premises data gateway does not need a connection string stored in the gateway; it uses the dataset's connection string.

Answer

Use the on-premises data gateway (standard mode) and store the connection string in the gateway

Answer

Use the on-premises data gateway (personal mode) and store the Windows credentials in the gateway

Answer

Use the virtual network (VNet) gateway and configure a service principal

Question 20

A Power BI administrator deploys a dashboard that uses a real-time dataset from Azure Stream Analytics. The dashboard must refresh every minute. The administrator notices that the dashboard sometimes shows stale data. What is the most likely cause and solution?

Accepted Answer

The dashboard tile cache is set to the default 30 minutes. Reduce the cache duration to 1 minute in the dataset settings. Option A is correct because Power BI has a default dashboard tile cache of 30 minutes for streaming datasets; reducing the cache duration solves the issue. Option B is wrong because the data source is streaming, not push. Option C is wrong because automatic page refresh is for report pages, not dashboard tiles. Option D is wrong because the issue is cache, not the refresh interval.

Answer

The streaming dataset is not supported for dashboards. Use a push dataset instead

Answer

Enable automatic page refresh on the dashboard and set it to 1 minute

Answer

The refresh interval in the dataset is set to 30 minutes. Change it to 1 minute