PL-300 Manage and secure Power BI Practice Test 10 — 15 Questions

Question 1

Your organization uses Power BI in a shared capacity model. A report developer complains that a new report published to a workspace does not appear in the 'My workspace' area. They have the Contributor role on the workspace. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reports published to a workspace do not appear in 'My workspace' unless the user manually saves a copy there.. The correct answer is C: reports published to a workspace do not appear in 'My workspace' unless the user manually saves a copy there. In Power BI, 'My workspace' is a personal container separate from shared workspaces, so a report published to a shared workspace stays in that workspace and is not mirrored into the developer's personal area. The Contributor role is sufficient to publish and edit content in a workspace, so permission is not the issue. Option A is wrong because Contributor does allow publishing, option B is wrong because no automatic copy is created to be deleted, and option D is wrong because licensing would not cause this specific display behavior.

Answer

The Contributor role does not have permission to publish reports to the workspace.

Answer

The report was automatically added to 'My workspace' but was deleted by an administrator.

Answer

The user does not have a Power BI Pro license.

Question 2

You need to grant a user the ability to manage permissions, add members, and edit content in a Power BI workspace, but not delete the workspace. Which role should you assign?

Accepted Answer

Member. The Member role is correct because in a Power BI workspace it grants the ability to add members, manage permissions, and edit and publish content, while it does not allow deleting or renaming the workspace, which matches the stated requirement. Admin would be too permissive since it can delete the workspace and manage all aspects of it. Contributor allows editing and publishing content but cannot add members or manage permissions. Viewer only provides read access to content and cannot edit or manage anything.

Answer

Admin

Answer

Contributor

Answer

Viewer

Question 3

Your organization is implementing a data sensitivity labeling strategy for Power BI. You have created labels in Microsoft Purview Compliance Portal. After publishing a report, you notice that some labels are not available for selection in Power BI. What is the most likely cause?

Accepted Answer

The labels are not included in a label policy that applies to Power BI.. The labels are not included in a label policy that applies to Power BI. Sensitivity labels created in Microsoft Purview only become selectable in Power BI when they are published through a label policy whose scope includes Power BI (and the users are in that policy); simply creating the labels does not make them available. Options A, B, and D do not fit: labels are tenant-level objects not tied to a Power BI workspace, Premium capacity is not required for sensitivity labels, and Power BI Pro licensing does not control label availability.

Answer

The labels were created in the wrong workspace.

Answer

The Power BI tenant does not have Premium capacity.

Answer

Users do not have Power BI Pro licenses.

Question 4

You need to share a Power BI dashboard with a large group of users in your organization. The users should not be able to edit the dashboard or share it with others. What is the most efficient method?

Accepted Answer

Create a workspace app and grant the group Viewer access.. The correct answer is D: create a workspace app and grant the group Viewer access. A workspace app packages the dashboard (and its reports) for distribution to a broad audience, and the Viewer role gives read-only access without edit or reshare rights, which matches the requirement efficiently for a large group. Option A is wrong because the Member role allows editing and sharing content, violating the restriction. Option B is inefficient for a large group and grants per-user sharing permissions rather than a single managed distribution. Option C is wrong because Publish to web makes the dashboard publicly accessible on the internet with no access control.

Answer

Add all users as Members of the workspace.

Answer

Share the dashboard directly with each user's email address.

Answer

Publish the dashboard to the web.

Question 5

Which TWO are valid Power BI workspace roles?

Accepted Answer

Viewer. In Power BI, the four valid workspace roles are Admin, Member, Contributor, and Viewer, so option A (Viewer) is correct because it grants read-only access to view reports and dashboards without editing content, and option B (Admin) is correct because it provides full control of the workspace including adding/removing users, managing permissions, and deleting the workspace. Option C (Owner) is not a Power BI workspace role—ownership concepts apply to items or capacities, not workspace membership roles. Option D (Reader) is not a workspace role; read-only access is provided by the Viewer role. Option E (Editor) is not a workspace role; edit permissions are granted via Contributor, Member, or Admin roles.

Answer

Owner

Answer

Reader

Answer

Editor

Question 6

Refer to the exhibit. You are reviewing a DAX expression used in a Power BI measure. You need to ensure that only users in the 'West' region see data for that region. Which approach should you use?

Accepted Answer

Implement row-level security (RLS) in the dataset with a role filter.. Row-level security (RLS) in the dataset with a role filter is the correct approach because it enforces data restrictions at the model level, so users in the 'West' region automatically see only rows where the region equals 'West' regardless of which report or visual they open. RLS roles are defined in Power BI Desktop and assigned to users or groups in the Power BI Service, providing centralized and secure filtering. Using CALCULATE with a report-page filter (B) only affects calculations or visuals, not the underlying data visible to users, so it can be bypassed. A measure with a conditional statement checking the user's email (C) is not a security boundary and cannot reliably restrict row visibility. A calculated column (D) computes values at refresh time and does not filter data per user, so it cannot enforce regional access.

Answer

Use the CALCULATE function with a filter on the report page.

Answer

Modify the measure to include a conditional statement that checks the user's email.

Answer

Create a calculated column with the same logic.

Question 7

A Power BI admin receives a support ticket that a user cannot see any data in a report that uses row-level security (RLS). The report is based on a dataset with a single table 'Sales' and RLS roles defined. The user is assigned to the role 'SalesManager' which filters Sales[Region] = 'West'. The dataset uses Import mode. The user can see the report but all visuals show blank. What is the most likely cause?

Accepted Answer

The RLS filter removes all rows for the user's role.. The RLS filter removes all rows for the user's role. In Import mode, RLS is enforced by DAX filters applied at query time, so if the 'SalesManager' role filters Sales[Region] = 'West' and the user's identity maps to no rows where Region equals 'West' (for example, due to case/spacing mismatches or the user not being in the intended region), every visual returns blank rather than an error. The other options do not fit: B would typically block report access entirely or show a permission error, not blank visuals; C describes a dashboard tile scenario, but the ticket says the user can see the report; and D is not a valid cause because refreshing with an RLS bypass account affects data loading, not the query-time RLS filtering applied to the user.

Answer

The user does not have permission to view the report page.

Answer

The user is viewing a dashboard tile instead of the report.

Answer

The dataset was refreshed using an RLS bypass account.

Question 8

A Power BI report uses a composite model combining Import and DirectQuery sources. When a user filters a visual, the report takes a long time to update. The admin wants to diagnose performance issues. Which tool should the admin use?

Accepted Answer

Performance Analyzer in Power BI Desktop.. The correct option is B, Performance Analyzer in Power BI Desktop, because it captures per-visual query timings and DAX query durations as the user interacts with the report, letting the admin pinpoint which visual or filter is slow in a composite model. It records each visual's rendering and query events, so the admin can see whether the delay comes from the Import or DirectQuery portion. DAX Studio (A) is useful for tuning individual DAX queries but does not profile the report's visual-by-visual interaction flow. The Power BI activity log (C) tracks usage and audit events, not query performance per visual, and the on-premises data gateway log (D) only covers gateway traffic for DirectQuery/refresh, not the full report rendering path.

Answer

DAX Studio.

Answer

Power BI activity log.

Answer

On-premises data gateway log.

Question 9

A data analyst creates a Power BI report using a dataset that contains sensitive salary information. The analyst needs to ensure that only HR managers can see salary columns. What should the analyst use?

Accepted Answer

Object-level security (OLS).. Object-level security (OLS) is the correct choice because it restricts access to specific tables or columns within a dataset, which is exactly what is needed to hide salary columns from everyone except HR managers. OLS is defined in the dataset's Tabular Model roles and can deny access to individual columns so that unauthorized users cannot see them in reports. Row-level security (RLS) only filters rows, not columns, so it cannot prevent viewing salary columns. Microsoft Purview sensitivity labels classify and protect data but do not control column visibility in Power BI reports, and 'Restrict access' is not a valid dataset security setting for column-level control.

Answer

Row-level security (RLS).

Answer

Microsoft Purview sensitivity labels.

Answer

Set the dataset security to 'Restrict access'.

Question 10

Which TWO methods can a Power BI admin use to enforce the use of sensitivity labels on reports? (Choose two.)

Accepted Answer

Apply labels automatically using Microsoft Purview Information Protection.. Option C is correct because Microsoft Purview Information Protection can be configured with auto-labeling policies that automatically apply sensitivity labels to Power BI content based on sensitive information types or other conditions, ensuring reports are labeled without relying on user action. Option D is correct because the Power BI tenant setting 'Require users to apply sensitivity labels when publishing reports' (in the admin portal under Information protection) enforces labeling at publish time, blocking publication of unlabeled reports. Option A is not correct because Intune is for device and app management (MDM/MAM) and cannot block unlabeled Power BI reports. Option B is not correct because default labels in Power BI Desktop only pre-populate a suggested label; users can still change or remove it, so it does not enforce labeling. Option E is not correct because row-level security (RLS) filters data rows by user identity and has no capability to detect or hide unlabeled reports.

Answer

Deploy a Microsoft Intune policy to block unlabeled reports.

Answer

Configure default labels in Power BI Desktop.

Answer

Use row-level security to hide unlabeled reports.

Question 11

Refer to the exhibit. A user is a member of both 'HRManager' and 'Executive' RLS roles. The dataset uses DirectQuery. When the user views a report showing all employees, what data will they see?

Accepted Answer

Rows where Department is 'HR' or 'Executive' (union).. Rows where Department is 'HR' or 'Executive' (union). In Power BI row-level security, when a user belongs to multiple roles, the role filters are combined with OR logic, so the user sees the union of the rows permitted by each role. This behavior applies regardless of whether the dataset uses DirectQuery or Import mode, since RLS role membership is evaluated per user at query time. Options A, B, and C are incorrect because RLS does not grant all rows, does not intersect multiple role filters, and does not produce an empty result due to role conflicts.

Answer

All rows in the Employees table.

Answer

Only rows where Department is both 'HR' and 'Executive' (intersection).

Answer

No rows because roles conflict.

Question 12

Refer to the exhibit. User2 wants to add a new user to the Finance workspace. Can User2 perform this action, and why?

Accepted Answer

No, because only Admins can add users.. The correct answer is D: No, because only Admins can add users. In the workspace roles model, adding or removing users (managing workspace access) is an Admin-only capability; Members and Contributors can work with content but cannot change membership. Therefore User2 cannot add a new user to the Finance workspace regardless of being a Member or Contributor. Option A is wrong because the Contributor role does not include user management, and Option B is wrong because the Member role also lacks that permission. Option C is wrong because Premium capacity is unrelated to workspace user-addition rights; permissions are governed by workspace roles, not capacity SKU.

Answer

Yes, because User2 is a Contributor.

Answer

Yes, because User2 is a Member.

Answer

No, because the Premium capacity does not allow adding users.

Question 13

You are a Power BI administrator. You need to prevent users from exporting underlying data from reports. Which tenant setting should you disable?

Accepted Answer

'Export data'. 'Export data' controls the ability to export underlying data. Option B is wrong because 'Export reports as PowerPoint' is for exporting the report itself. Option C is wrong because 'Export reports as PDF' is for static exports. Option D is wrong because 'Export reports as MHTML' is also for report export.

Answer

'Export reports as PowerPoint presentations'

Answer

'Export reports as PDF files'

Answer

'Export reports as MHTML files'

Question 14

You have a Power BI report that uses a DirectQuery dataset. You need to ensure that users see only the data relevant to their department. What should you implement?

Accepted Answer

Row-level security (RLS) with DAX filter expressions.. Row-level security (RLS) is the correct approach because it filters data at the query level based on the user's identity. In a DirectQuery model, RLS translates DAX filter expressions into source queries, ensuring that each user only sees rows relevant to their department without duplicating reports or datasets.

Answer

Q&A features to restrict natural language queries.

Answer

Object-level security (OLS) to hide tables.

Answer

Data lineage view to control access.

Question 15

Your organization is deploying Power BI content to multiple stages (dev, test, prod) using deployment pipelines. You need to ensure that test data is not visible to production users. What is the best approach?

Accepted Answer

Use deployment pipelines with separate datasets per stage and configure data source parameters to point to different databases.. Option D is correct because deployment pipelines support deployment rules that let you bind each stage's dataset to a different data source via parameters, so the production stage connects to the production database and never exposes test data. Configuring data source parameters per stage is the standard mechanism for environment-specific connections in Power BI deployment pipelines. Option A is wrong because manually swapping datasets after deployment is error-prone and not a pipeline feature. Option B is wrong because row-level security filters rows for users, not test versus production data sources, and would still leave test data in the production dataset. Option C is wrong because separate tenants per stage is an extreme, costly approach that deployment pipelines are specifically designed to avoid.

Answer

Manually replace the dataset in the production workspace after deployment.

Answer

Apply row-level security to filter test data in production.

Answer

Create separate Power BI tenants for each stage.