PL-300 Manage and secure Power BI Practice Test 11 — 15 Questions

Question 1

You need to audit Power BI activity for compliance. Which tool should you use to access detailed logs of user actions?

Accepted Answer

Microsoft Purview compliance portal (Audit). The correct option is B, Microsoft Purview compliance portal (Audit), because it provides the unified audit log that captures detailed Power BI user activity such as viewed reports, edited datasets, shared dashboards, and exported data, which is exactly what a compliance audit requires. Power BI activity events are surfaced through the Microsoft 365 audit log, accessible via the Purview compliance portal's Audit search (or the Search-UnifiedAuditLog cmdlet), letting you filter by workload, user, and date. Option A, Microsoft Defender XDR, focuses on security incidents and threat detection across endpoints, identities, and email, not on Power BI activity auditing. Option C, Microsoft Purview Data Map, catalogs and classifies data assets for governance but does not record user action logs. Option D, the Power BI Premium capacity metrics app, reports on capacity utilization and performance metrics, not detailed per-user activity logs.

Answer

Microsoft Defender XDR

Answer

Microsoft Purview Data Map

Answer

Power BI Premium capacity metrics app

Question 2

You have a Power BI dataset that connects to an Azure SQL Database. You need to use single sign-on (SSO) so that users' identities are passed to the database. What authentication method should you configure?

Accepted Answer

OAuth2 with Microsoft Entra ID. OAuth2 with Microsoft Entra ID (option C) is correct because Power BI's SSO to Azure SQL Database relies on Microsoft Entra ID token-based authentication, where the user's Entra ID identity is passed through to the database via OAuth2, enabling row-level security and auditing per user. Azure SQL Database natively supports Entra ID authentication, and Power BI can forward the user's token when the data source is configured with DirectQuery and SSO enabled. Windows authentication (A) is not applicable since Azure SQL Database does not accept on-premises Windows/Kerberos credentials directly without a gateway and Entra ID setup. Key authentication (B) uses a shared key rather than a user identity, so it cannot provide SSO. Basic authentication with a service account (D) uses a single shared credential, not the individual user's identity, so it also fails to meet the SSO requirement.

Answer

Windows authentication

Answer

Key authentication

Answer

Basic authentication with a service account

Question 3

Your organization uses Microsoft Intune to manage devices. You need to ensure that Power BI reports can only be viewed on managed devices that are compliant with company policies. What should you configure?

Accepted Answer

Conditional Access policy in Microsoft Entra ID requiring device compliance.. A Conditional Access policy in Microsoft Entra ID requiring device compliance. Conditional Access is the mechanism that evaluates signals such as Intune device compliance state and enforces access controls, so a policy targeting the Power BI cloud app with a 'Require device to be marked as compliant' grant control ensures reports can only be viewed from managed, compliant devices. Option A is not a real Power BI Premium capacity setting for this purpose, and Power BI capacity settings do not enforce device compliance. Option C only enforces Entra ID authentication for the tenant and does not check device compliance or management state. Option D, an Intune MAM policy, protects app data on mobile devices but does not gate access to Power BI reports based on device compliance.

Answer

Power BI Premium capacity setting 'Restrict access to mobile devices'.

Answer

Power BI tenant setting 'Require users to sign in with Microsoft Entra ID'.

Answer

Mobile app management (MAM) policy in Microsoft Intune.

Question 4

Your organization uses row-level security (RLS) in Power BI. You have a table 'Sales' with a column 'Region'. You define a role 'RegionManagers' with the filter: [Region] = "North". A user named Alice is a member of this role. However, when Alice views a report that uses this dataset, she sees all regions. What is the most likely reason?

Accepted Answer

Alice is the dataset owner.. The correct answer is B: Alice is the dataset owner. In Power BI, members of the dataset's Admin/owner workspace role (or the dataset owner) bypass row-level security, so Alice sees all regions despite being assigned to the RegionManagers role with the filter [Region] = "North". RLS is enforced only for users who access the dataset with Viewer, Contributor, or read permissions, not for owners/admins. Option A is wrong because DirectQuery does support RLS. Option C is wrong because a static filter like [Region] = "North" is valid; USERNAME()/USERPRINCIPALNAME() is only needed for dynamic filtering. Option D is wrong because RLS is enforced in the Power BI service as well as in Desktop.

Answer

The dataset uses DirectQuery mode, which does not support RLS.

Answer

The filter must use USERNAME() or USERPRINCIPALNAME() function.

Answer

RLS is only applied in Power BI Desktop, not in the service.

Question 5

You are a Power BI administrator. A user reports that they are unable to share a dashboard with an external user from a partner organization. The external user has a Microsoft Entra ID account in their own tenant. What is the most likely reason?

Accepted Answer

The 'Share content with external users' tenant setting is disabled.. The correct answer is B: the 'Share content with external users' tenant setting is disabled. In Power BI, an administrator must enable the 'Share content with external users' setting in the Admin portal (Tenant settings) before users can share dashboards and reports with Microsoft Entra ID (Azure AD) B2B guest users from other tenants, so if it is off, sharing attempts fail regardless of the external user's account. Option A is wrong because external users can view Power BI content once properly licensed and invited; a license may be required but that is not the most likely blocker described. Option C is wrong because RLS would only filter data for an already-authorized viewer, not prevent the share action itself. Option D is wrong because external users are added as B2B guest users in the host tenant, not as members, and this is not the reason sharing is blocked.

Answer

External users cannot view Power BI content; they need a Power BI license.

Answer

The dashboard is based on a dataset that uses RLS and the external user is not in the role.

Answer

External users must be added as members in the same tenant.

Question 6

Your organization uses Power BI with Premium capacity. You need to configure a scheduled refresh for a dataset that connects to an Azure SQL Database. The refresh must complete before 6:00 AM every day. The dataset currently takes 45 minutes to refresh. What is the most important consideration?

Accepted Answer

Schedule the refresh to start early enough to complete by 6:00 AM, considering any other scheduled refreshes.. The correct option is B: schedule the refresh to start early enough to complete by 6:00 AM, considering any other scheduled refreshes. Since the dataset takes 45 minutes, the schedule must begin by 5:15 AM at the latest, and because Power BI Premium allows up to 48 scheduled refreshes per day but serializes overlapping refreshes on the same capacity, other datasets sharing that capacity can delay the start and push completion past 6:00 AM. Option A is unnecessary because Azure SQL Database is a cloud service reachable directly over the internet, so no on-premises data gateway is required. Option C could reduce refresh duration but is an optimization, not the essential scheduling consideration, and option D is irrelevant because the dataset needs only one daily refresh, far below the Premium limit.

Answer

Use an on-premises data gateway to connect to Azure SQL.

Answer

Configure incremental refresh to reduce the refresh time.

Answer

Ensure the dataset does not exceed the maximum number of daily refreshes (8 for shared, 48 for Premium).

Question 7

You are a Power BI administrator. You need to audit all activities related to sharing reports and dashboards in the Power BI service. Which tool should you use?

Accepted Answer

Power BI activity log (via admin API or portal). The Power BI activity log provides a comprehensive record of all user activities within the Power BI service, including sharing reports and dashboards. Option A (Microsoft Purview compliance portal audit log) can capture some Power BI activities but is less specific and may not include all sharing events. Option B (Azure diagnostic settings) exports telemetry data to other destinations and is not designed for direct auditing of user actions. Option D (Microsoft Sentinel) is a SIEM tool that can ingest logs but is not the primary tool for auditing Power BI activities. The Power BI activity log is the correct choice as it is purpose-built for auditing Power BI user activities.

Answer

Microsoft Purview compliance portal audit log

Answer

Azure diagnostic settings for Power BI

Answer

Microsoft Sentinel

Question 8

You create a Power BI report that uses a live connection to an Azure Analysis Services (AAS) model. You want to enforce row-level security defined in the AAS model. What should you do?

Accepted Answer

No additional configuration needed; RLS from AAS is automatically applied.. Option B is correct because when a Power BI report uses a live connection to an Azure Analysis Services (AAS) model, the report does not contain its own dataset or RLS definitions; instead, it queries the AAS model directly, so the row-level security roles and memberships defined in the AAS model are automatically enforced for the connecting user. This is the standard behavior for live connections to Analysis Services, where security is managed at the source model rather than in Power BI. Option A is wrong because object-level security (OLS) restricts columns/tables, not rows, and is not a substitute for RLS. Option C is wrong because you cannot create RLS roles on the dataset in the Power BI service when the report uses a live connection, since there is no imported dataset in Power BI to configure. Option D is wrong because defining RLS roles in Power BI Desktop and publishing applies only to imported or DirectQuery datasets hosted in Power BI, not to live-connected AAS models.

Answer

Use object-level security (OLS) instead.

Answer

Use Power BI service to create RLS roles on the dataset.

Answer

Define the same RLS roles in Power BI Desktop and publish.

Question 9

Which TWO are valid methods to secure access to a Power BI dataset? (Select exactly two.)

Accepted Answer

Row-level security (RLS). Row-level security (RLS) [CORRECT] is a valid method to secure access to a Power BI dataset because it restricts which rows a given user can see by applying DAX filter expressions to roles defined in the dataset, and those roles are assigned to users or groups in the Power BI service. Object-level security (OLS) [CORRECT] is also valid because it secures specific tables or columns in the dataset model by hiding them entirely from users who lack permission, preventing them from viewing or querying those objects. Column-level security (CLS) is not a separate Power BI feature; column-level restriction is achieved through OLS, so it is not a distinct valid method. App permissions control access to Power BI apps and workspaces rather than securing the dataset model itself, and data encryption at rest protects stored data on disk but does not control which data a user can access within a dataset.

Answer

Column-level security (CLS)

Answer

App permissions

Answer

Data encryption at rest

Question 10

You are a Power BI administrator. A user reports they cannot publish a report to a shared workspace because they receive an error 'You need at least a Contributor role to publish to this workspace.' The user is a member of a security group that has been assigned the Viewer role on the workspace. What should you do to allow the user to publish?

Accepted Answer

Add the user as a Contributor directly to the workspace, or change the security group role to Contributor.. The correct option is B: add the user as a Contributor directly to the workspace, or change the security group role to Contributor. In Power BI, publishing a report to a workspace requires at least the Contributor role, which grants content creation and editing permissions; the Viewer role only allows read-only access, so the user's current group-based Viewer role blocks publishing. Granting Contributor either directly or by elevating the group's role resolves the error. Option A is insufficient because Read permission on an existing report does not grant publishing rights. Option C is wrong because Viewer plus 'Publish to web' is for public embedding, not workspace publishing. Option D is unnecessary and does not address the required role in the existing shared workspace.

Answer

Grant the user Read permission on the report in the workspace.

Answer

Change the user's role to Viewer on the workspace and ask them to use the 'Publish to web' option.

Answer

Create a new workspace and add the user as a Member.

Question 11

Your organization uses Power BI with a shared capacity (no Premium capacity). You need to implement row-level security (RLS) on a dataset that is used by multiple reports. Which of the following is a limitation you must consider?

Accepted Answer

RLS cannot be applied when the dataset uses DirectQuery to a data source that requires single sign-on (SSO) because the user's identity is passed through, and the source must enforce RLS.. The correct option is C: RLS cannot be applied when the dataset uses DirectQuery to a data source that requires single sign-on (SSO) because the user's identity is passed through, and the source must enforce RLS. In a shared capacity, Power BI does not perform RLS for DirectQuery sources that use SSO; instead, it passes the user's credentials to the source, so the source system must enforce its own row-level security. Options A, B, and D are incorrect: RLS is supported in shared capacity, roles can be created in Power BI Desktop, and RLS can be applied to DirectQuery tables (with the SSO caveat noted in C).

Answer

RLS is not supported in shared capacity; you need a Premium license.

Answer

RLS roles must be created in the Power BI service after publishing; they cannot be created in Power BI Desktop.

Answer

RLS can only be applied to tables that are imported, not to tables using DirectQuery.

Question 12

Which TWO of the following are valid methods to share a Power BI report with external users (outside your organization)? (Choose two.)

Accepted Answer

Invite the external user as a guest in your Microsoft Entra ID (Azure AD) and share the report directly with them.. The correct answers are C and E. Option C: By inviting external users as guests in your Microsoft Entra ID (Azure AD) using Microsoft Entra B2B, you can share Power BI reports directly with them without requiring them to have a Power BI license. Option E: 'Publish to web' creates a public embed code that anyone on the internet can view, making it suitable for sharing with external users. Option A is incorrect because exporting to PDF creates a static file, not an interactive report, and is not a sharing method. Option B is incorrect because external users need to be set up as guests or use publish to web; a direct link alone will not work without proper authentication. Option D is incorrect because embedding in SharePoint Online requires the external user to have access to the SharePoint site, which typically involves additional setup such as guest access.

Answer

Export the report to PDF and email it to the external user.

Answer

Send the external user a direct link to the report via email; they can view it without any additional setup.

Answer

Embed the report in a SharePoint Online page using the Power BI web part.

Question 13

Which THREE of the following are required to configure Microsoft Purview Information Protection sensitivity labels for Power BI? (Choose three.)

Accepted Answer

Users must have appropriate permissions (e.g., Azure Information Protection rights) to apply labels.. Option C is correct because applying a sensitivity label to a Power BI artifact requires the user to hold the appropriate usage rights, such as Azure Information Protection (AIP) rights, so the label's protection settings can be enforced on the item. Option D is correct because sensitivity labels must first be created and published to the relevant users from the Microsoft 365 Compliance Center (Microsoft Purview compliance portal) before they become available for use in Power BI. Option E is correct because an admin must enable sensitivity labels for Power BI in the Power BI admin portal tenant settings; otherwise the labeling feature remains unavailable in the service and Desktop. Option A is not required because sensitivity labels are not gated on a Power BI Pro license specifically, and Option B is not required because labeling works without assigning the workspace to a Power BI Premium capacity.

Answer

Each user must have a Power BI Pro license.

Answer

Have a Power BI Premium capacity assigned to the workspace.

Question 14

Your organization uses Power BI and has deployed Microsoft Purview Data Loss Prevention (DLP) policies. You want to prevent users from exporting data from Power BI reports that contain credit card numbers. What should you configure?

Accepted Answer

Create a DLP policy in Microsoft Purview that detects credit card numbers in Power BI and set the action to block export.. The correct option is B: create a DLP policy in Microsoft Purview that detects credit card numbers in Power BI and set the action to block export. Microsoft Purview DLP supports Power BI as a workload, so a policy can use the sensitive information type for credit card numbers (e.g., Credit Card Number) and enforce a block-export action when that data appears in Power BI reports. This directly targets the scenario's requirement of preventing export only when credit card numbers are present. Option A does not fit because row-level security restricts which rows users can see, not export of sensitive content. Option C is not the right mechanism because sensitivity labels apply protection/policy to items but do not provide content-based detection of credit card numbers for blocking export in Power BI. Option D is too broad because disabling export settings in the Power BI admin portal blocks export for all content, not specifically reports containing credit card numbers.

Answer

Configure row-level security (RLS) to hide the credit card column from users.

Answer

Apply a Microsoft Purview sensitivity label 'Highly Confidential' to the dataset and configure the label to prevent export.

Answer

Disable the 'Export to Excel' and 'Export to CSV' settings in the Power BI admin portal.

Question 15

Your organization uses Power BI and has implemented Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security). A user reports that they are unable to export data from a Power BI report. The Power BI tenant settings allow export. What could be the cause?

Accepted Answer

A Microsoft Defender for Cloud Apps session policy is blocking the export based on the user's risk level or the report's sensitivity.. The correct answer is D: a Microsoft Defender for Cloud Apps session policy is blocking the export based on the user's risk level or the report's sensitivity. Because Defender for Cloud Apps can proxy Power BI sessions via Conditional Access App Control, its session policies can inspect and block actions like export even when the Power BI tenant setting allows export. Option A is wrong because the scenario states the tenant settings already allow export. Option B is wrong because sensitivity labels alone do not automatically block export; protection is enforced through encryption/permissions, not a blanket export block. Option C is wrong because being an external guest user does not by itself prevent exporting data.

Answer

The 'Export to Excel' setting is disabled in the Power BI admin portal.

Answer

A sensitivity label with high classification is applied to the report, automatically blocking export.

Answer

The user is an external guest user.