PL-300 Manage and secure Power BI Practice Test 10 — 15 Questions

Question 1

Your organization uses Microsoft Power BI with Microsoft Purview for data governance. You have a dataset that contains customer data classified as 'Highly Confidential' under a sensitivity label. The compliance team requires that when this dataset is shared with external users, a Microsoft Purview data loss prevention (DLP) policy must block the sharing and notify the compliance team. You need to configure this. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a DLP policy in Microsoft Purview that applies to Power BI and blocks sharing of content with the 'Highly Confidential' label.. A DLP policy in Microsoft Purview can be configured to block sharing of content with a specific sensitivity label in Power BI. Option A is wrong because Microsoft Defender for Cloud Apps is for app governance, not DLP. Option B is wrong because Microsoft Sentinel is for security monitoring, not DLP. Option C is wrong because Power BI admin portal does not provide DLP capabilities; it only has settings for sharing controls that are not as granular as sensitivity labels.

Answer

Use Microsoft Defender for Cloud Apps to create a session policy that blocks sharing.

Answer

Configure Microsoft Sentinel to monitor and block sharing events.

Answer

In the Power BI admin portal, disable sharing for workspaces containing 'Highly Confidential' content.

Question 2

You are a Power BI administrator. The company has a premium capacity that many users publish reports to. Recently, users have reported that some reports are slow to load. You suspect that the capacity is being overused by certain large datasets. You need to identify which workspaces and datasets are consuming the most memory and CPU resources on the capacity. You want to use a tool that provides historical metrics and can be queried. What should you do?

Accepted Answer

Install the Power BI Premium Capacity Metrics app from AppSource.. The Power BI Premium Capacity Metrics app provides detailed historical metrics on memory, CPU, and query activity, allowing you to identify which workspaces and datasets are overusing capacity. Option B (Performance Analyzer) is only for analyzing individual report performance in Power BI Desktop, not for capacity-wide monitoring. Option C (admin portal) shows real-time status but not historical metrics that can be queried. Option D (activity logs and Log Analytics) can be used for auditing but does not provide ready-made capacity metrics like the dedicated app.

Answer

Use Performance Analyzer in Power BI Desktop for each report.

Answer

Use the Power BI admin portal to view capacity metrics in real-time.

Answer

Enable Power BI activity logs and query Log Analytics for capacity metrics.

Question 3

Your organization uses Power BI with a shared capacity. You have a dataset that is refreshed daily from an on-premises SQL Server database using an on-premises data gateway. The dataset contains sensitive financial data. The security team requires that all access to the dataset be logged and that any access from outside the corporate network be flagged. You need to implement a monitoring solution. What should you do?

Accepted Answer

Enable Power BI activity logging and stream to Azure Log Analytics, then create alerts on access events from external IPs.. Enabling Power BI activity logging and streaming to Azure Log Analytics provides a centralized log of all access events to datasets. Alerts can be configured in Log Analytics to detect access from external IPs, meeting the security team's requirements for logging and flagging external access. Option A is incorrect because Azure SQL Auditing logs only database-level operations, not Power BI dataset access. Option B is incorrect because Microsoft Defender for Cloud Apps focuses on conditional access and threat protection, but it does not log all dataset access events. Option C is incorrect because on-premises data gateway logging captures gateway operations, not user access to the dataset from the Power BI service.

Answer

Audit the SQL Server database using Azure SQL Auditing.

Answer

Use Microsoft Defender for Cloud Apps to enforce conditional access policies.

Answer

Enable logging on the on-premises data gateway and monitor the logs.

Question 4

You have a Power BI workspace that contains several dashboards and reports. You need to ensure that the workspace is certified and that only certified datasets can be used in reports across the tenant. You also want to display a certification badge on the workspace. What should you do?

Accepted Answer

Apply certification to the datasets in the workspace via the dataset settings.. Certification is applied to individual datasets, not to workspaces. To make your datasets certified, apply certification via the dataset settings in Power BI. The certification badge will appear on the datasets (and can be shown in reports that use them), not on the workspace itself. Therefore, the requirement to display a certification badge on the workspace is not directly achievable; if the goal is to have certified content, you must certify the datasets individually. Option B is incorrect because updating the workspace description does not certify anything. Option C is incorrect because marking the workspace as 'Featured' is unrelated to certification. Option D is incorrect because endorsement is the umbrella term that includes both promotion and certification; enabling endorsement does not automatically certify content.

Answer

Update the workspace description to include 'Certified'.

Answer

Mark the workspace as 'Featured' in the admin portal.

Answer

Enable the 'Endorsement' setting for the workspace.

Question 5

Your organization uses Power BI and has a requirement that all reports must be accessible to users with screen readers. You need to configure the Power BI service to enforce accessibility compliance. What should you do?

Accepted Answer

In the Power BI admin portal, enable the 'Enforce accessibility requirements' setting.. The Power BI admin portal includes a setting called 'Enforce accessibility requirements' that, when enabled, requires all reports to meet accessibility standards such as proper tab order and alt text. This enforces compliance at the tenant level. Option A is incorrect because Microsoft Entra ID (formerly Azure AD) handles identity and access management, not accessibility compliance for Power BI reports. Option B is incorrect because Microsoft Intune manages device policies and mobile device management, not Power BI report accessibility. Option C is incorrect because setting accessibility properties on each report individually does not enforce compliance; it must be done manually per report, whereas the admin portal setting enforces it across all reports.

Answer

Use Microsoft Entra ID to enforce conditional access for accessibility.

Answer

Use Microsoft Intune to enforce accessibility policies on user devices.

Answer

Set accessibility properties on each report individually.

Question 6

You are a Power BI administrator. Your company has a Power BI tenant with a large number of workspaces. A new regulation requires that all shared dashboards must have a data retention policy that deletes data older than 6 months. You need to implement this for all existing and future dashboards. The solution must be automated and not require manual intervention. What should you do?

Accepted Answer

Use Microsoft Purview data lifecycle management to apply retention labels.. To enforce automated data retention at the tenant level for shared dashboards, you must use Microsoft Purview data lifecycle management to apply retention labels to the underlying datasets. This ensures data older than 6 months is deleted automatically without manual intervention. Option A is incorrect because the Power BI admin portal does not support tenant-level data retention policies for dashboards. Option B is incorrect because manual configuration does not scale and is not automated. Option D is incorrect because deleting dashboards via the REST API removes the analysis surface but not the actual data, and it requires ongoing script execution.

Answer

Configure a tenant-level data retention policy in the Power BI admin portal.

Answer

Set a retention period on each dashboard manually in the dashboard settings.

Answer

Develop a PowerShell script using the Power BI REST API to regularly delete dashboards older than 6 months.

Question 7

Your Power BI workspace contains a dataset that uses a DirectQuery connection to Azure SQL Database. You need to ensure that only users with the 'Viewer' role in the workspace can query the dataset, but they should not be able to see the underlying SQL credentials. What should you do?

Accepted Answer

Configure the dataset to use a service principal with a credential stored in Power BI.. Configuring the dataset to use a service principal with a credential stored in Power BI allows users with the 'Viewer' role to query the dataset without seeing the underlying SQL credentials. The service principal's credentials are securely stored in Power BI and are not exposed to users. Option A is incorrect because using Windows authentication with the user's own credentials would require direct database access and does not hide credentials. Option B is incorrect because row-level security (RLS) only restricts row-level data access, not credential visibility. Option D is incorrect because object-level security (OLS) hides specific columns, not credentials.

Answer

Use Windows authentication with the user's own credentials.

Answer

Use row-level security (RLS) to restrict query access.

Answer

Use object-level security (OLS) to hide the credential columns.

Question 8

A Power BI administrator needs to enforce that all datasets published to the service use certified data sources only. Which two settings should be configured? (Choose two.)

Accepted Answer

Enable 'Certification' for dataflows in the Power BI tenant settings.. To enforce that all datasets use certified data sources only, an administrator should enable certification for data sources (Option C) and enable certification for dataflows (Option B). Option C allows data source owners to certify data sources, and Option B allows dataflow owners to certify dataflows. Combined, these settings promote the use of certified components. Option A (monitoring with Sentinel) only detects non-certified sources, it does not enforce. Option D (RLS) and Option E (B2B permissions) are unrelated to data source certification.

Answer

Use Microsoft Sentinel to audit Power BI activity logs and flag non-certified data sources.

Answer

Configure row-level security (RLS) on all datasets.

Answer

Set up B2B guest user permissions to restrict external data sources.

Question 9

You are a Power BI administrator. A user reports that their scheduled data refresh fails with error 'The data source credentials are no longer valid.' The dataset uses a SQL Server database with Windows authentication. What should you do first to resolve the issue?

Accepted Answer

Ask the user to update the data source credentials in the Power BI service dataset settings.. The error 'The data source credentials are no longer valid' typically occurs when the password has changed or expired. The user can update the credentials in the dataset settings in the Power BI service. Option A is incorrect because the on-premises data gateway is not the issue; a reinstall is unnecessary. Option B is incorrect because reassigning the dataset to a different Premium capacity does not address credential validity. Option C is incorrect because using 'Impersonate the authenticated user' still requires valid credentials and does not fix the problem.

Answer

Reinstall the on-premises data gateway on the server.

Answer

Reassign the dataset to a different Premium capacity.

Answer

Modify the dataset to use 'Impersonate the authenticated user' for data sources.

Question 10

Which THREE components must be in place to enable Power BI data sensitivity labels from Microsoft Purview? (Select exactly three.)

Accepted Answer

Power BI admin setting to enable sensitivity labels enabled. Options A, B, and D are correct. To enable Power BI data sensitivity labels from Microsoft Purview, three components are needed: the Power BI admin setting to enable sensitivity labels must be turned on (A), sensitivity labels must be published to users or groups in the Microsoft Purview compliance portal (B), and a Microsoft Purview Information Protection subscription (including Azure Information Protection P1/P2) is required (D). Option C is incorrect because Power BI Premium capacity is not a prerequisite; sensitivity labels work with both Power BI Pro and Premium capacities. Option E is incorrect because a Power BI Pro license is not required for all users; the feature can be used with any license type if the admin enables it and the necessary subscriptions are in place.

Answer

Power BI Premium capacity assigned to the workspace

Answer

Power BI Pro license for all users

Question 11

You have a Power BI workspace that contains a report connected to an Azure Analysis Services (AAS) model. The data source uses Single Sign-On (SSO) with Microsoft Entra ID. When users access the report, they see an error that the data cannot be refreshed. What is the most likely cause?

Accepted Answer

The dataset is configured in Import mode.. The most likely cause is that the dataset is configured in Import mode. Single Sign-On (SSO) with Microsoft Entra ID is only supported when the dataset uses DirectQuery or Live Connection mode. Import mode requires stored credentials and does not pass the user's identity to the data source. Option A is incorrect because RLS does not affect data refresh connectivity. Option B is incorrect because stored credentials are not used when SSO is enabled. Option C is incorrect because SSO uses the user's identity, not a service principal.

Answer

Row-level security (RLS) is not configured on the AAS model.

Answer

The data source credentials are stored in the dataset.

Answer

The service principal used for authentication has expired.

Question 12

Your organization uses Microsoft Purview Information Protection to label sensitive data in Power BI datasets. You need to ensure that when a report is exported to Excel, the sensitivity label is automatically applied. What should you configure?

Accepted Answer

Ensure the dataset has a sensitivity label and that the export inherits the label.. When a Power BI dataset has a sensitivity label applied via Microsoft Purview Information Protection, any downstream exports (such as reports exported to Excel) automatically inherit that label. This inheritance ensures consistent protection across all outputs. Option D is incorrect because the Power BI admin portal setting 'Apply sensitivity labels to exported data' is used to apply labels when the data source does not have a label, but it does not override automatic inheritance from a labeled dataset. Option B is incorrect because DLP policies in Microsoft Purview monitor and protect data, but they do not automatically apply sensitivity labels to exports. Option C is incorrect because setting a default sensitivity label on a report is not a feature; sensitivity labels are inherited from the dataset, not configured per report.

Answer

Use data loss prevention (DLP) policies in Microsoft Purview.

Answer

Set a default sensitivity label on the report.

Answer

Enable 'Apply sensitivity labels to exported data' in the Power BI admin portal.

Question 13

You have a Power BI dataset that uses a DirectQuery connection to Azure Synapse Analytics. Users report that the report is slow. You need to improve query performance without changing the data source. What should you do?

Accepted Answer

Reduce the number of visuals on each report page.. Reducing the number of visuals on each report page reduces the number of queries sent to the data source, improving performance for DirectQuery datasets. Option A is incorrect because reducing cardinality of measures may reduce data size but does not directly reduce the number of queries. Option B is incorrect because disabling RLS could change data access but does not significantly improve query performance. Option C is incorrect because increasing scheduled refresh frequency applies to import mode, not DirectQuery.

Answer

Reduce the cardinality of calculated measures.

Answer

Disable row-level security (RLS) on the dataset.

Answer

Increase the scheduled refresh frequency.

Question 14

You need to grant a user the ability to manage permissions on a Power BI workspace but not to view or edit the content. What minimum role should you assign?

Accepted Answer

Admin. The Admin role is the only workspace role that can manage permissions and membership, even though it also allows viewing and editing content. The minimum role required to manage permissions is Admin. Option A is incorrect because Contributor can view and edit content but cannot manage permissions. Option B is incorrect because Viewer can only view content and cannot manage permissions. Option C is incorrect because Member can view and edit content but cannot manage permissions.

Answer

Contributor

Answer

Viewer

Answer

Member

Question 15

Which TWO methods can you use to share a Power BI report with external users who do not have a Power BI Pro license? (Choose two.)

Accepted Answer

Embed the report in a secure portal using 'Embed for your customers'.. Options A and B are correct. Option A, 'Embed for your customers,' allows you to embed reports in a secure portal and share with external users without requiring them to have a Power BI Pro license (requires Premium capacity). Option B, 'Publish to a public website (Publish to web),' creates a public URL that anyone can access, including external users without a Pro license. Option D (share directly via email) requires recipients to have a Pro license. Options C and E (export to PDF or Excel) are not interactive sharing methods and do not allow the report to be consumed as a live report.

Answer

Export the report to PDF and share the file.

Answer

Share directly via Power BI using the user's email address.

Answer

Export the report to Excel and attach it to an email.