PL-300 Manage and secure Power BI Practice Test 12 — 15 Questions

Question 1

You are a Power BI administrator. A user in your organization wants to share a report with an external user who does not have a Power BI license. You want to allow the external user to view the report without requiring them to sign in. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'Publish to web' option to generate an embed code and send the link to the external user.. The correct option is D: use 'Publish to web' to generate an embed code and send the link, because this feature creates a publicly accessible URL that renders the report anonymously, so the external user needs no Power BI license and no sign-in. It is designed exactly for anonymous, internet-wide viewing of non-sensitive reports. Option A is wrong because assigning a Power BI Pro license still requires the external user to authenticate with that account. Option B is wrong because direct sharing requires the recipient to have a Power BI account/license and to sign in. Option C is wrong because guest access in Microsoft Entra ID still requires the external user to sign in with the guest identity.

Answer

Create a new user account in your Microsoft Entra ID for the external user and assign a Power BI Pro license.

Answer

Share the report directly with the external user's email address.

Answer

Invite the external user as a guest in Microsoft Entra ID, then share the report.

Question 2

Your organization uses Microsoft Purview to catalog Power BI assets. You need to ensure that all published reports and dashboards are automatically scanned and added to the catalog. What should you do?

Accepted Answer

Register the Power BI tenant as a data source in Microsoft Purview.. The correct option is A: register the Power BI tenant as a data source in Microsoft Purview. Microsoft Purview scans and catalogs Power BI assets (reports, dashboards, datasets, dataflows) only after the Power BI tenant is registered as a data source and a scan is configured, which uses the Power BI Admin API and requires tenant-level read-only admin permissions. Option B is unrelated: enabling Microsoft Entra ID authentication in the Power BI admin portal does not trigger Purview scanning or cataloging. Option C, applying sensitivity labels, governs data protection and classification but does not populate the Purview catalog with Power BI assets. Option D is incorrect because creating a workspace and assigning a catalog admin role does not register the tenant or initiate scanning of published reports and dashboards.

Answer

Enable 'Allow Azure Active Directory authentication' in the Power BI admin portal.

Answer

Apply sensitivity labels to all assets.

Answer

Create a new workspace in Power BI and assign the catalog admin role.

Question 3

You need to audit which users have accessed a specific Power BI dashboard in the last 30 days. What should you use?

Accepted Answer

Power BI Activity Log (audit log) in the Microsoft 365 admin center.. The Power BI Activity Log (audit log) in the Microsoft 365 admin center is the correct tool because it records user activities such as viewing dashboards and reports, and it can be filtered by date range (e.g., last 30 days) and by item to identify exactly which users accessed a specific dashboard. It captures events like ViewDashboard and ViewReport with user, timestamp, and artifact details, which is precisely what this audit requires. Microsoft Sentinel is a SIEM for security analytics and would only have this data if the Power BI logs were explicitly ingested, so it is not the direct source. Microsoft Purview compliance portal focuses on data governance, classification, and compliance rather than Power BI usage auditing. The Power BI REST API 'Get Datasets' endpoint only returns dataset metadata and does not provide user access activity.

Answer

Microsoft Sentinel.

Answer

Microsoft Purview compliance portal.

Answer

Power BI REST API 'Get Datasets' endpoint.

Question 4

Refer to the exhibit. A Power BI dataset has the scheduled refresh configuration shown in the JSON. The refresh fails on Monday, March 2, 2026. Who will be notified?

Accepted Answer

The dataset owner.. The correct option is B, the dataset owner, because Power BI scheduled refresh failure notifications are sent by default to the owner of the dataset (the user who configured/owns the refresh), not to broader groups. In the exhibit's scheduled refresh configuration, no additional notification recipients are specified, so only the dataset owner receives the failure alert for the March 2, 2026 refresh. Workspace admins are not automatically notified of refresh failures unless they are the dataset owner or explicitly added as recipients. The Power BI tenant admin and all users with dataset access are also not default recipients of scheduled refresh failure emails.

Answer

All workspace admins.

Answer

The Power BI tenant admin.

Answer

All users with access to the dataset.

Question 5

You have a Power BI workspace named Sales. You need to ensure that only users in the Finance security group can view reports in this workspace, while members of the Sales team can edit and share content. What should you do?

Accepted Answer

Add Finance as Viewer, Sales as Member.. Workspace roles in Power BI are designed to grant specific permissions: Viewer allows read-only access, ideal for Finance who only need to view reports; Member allows editing and sharing, which matches the Sales team's requirements. Option B is wrong because Contributor role cannot share content, which Sales needs. Option C is wrong because Admin grants full control, including managing permissions, which is unnecessary and excessive. Option D is wrong because row-level security (RLS) controls data access within reports, not workspace-level permissions.

Answer

Add Finance as Contributor, Sales as Member.

Answer

Add Finance as Viewer, Sales as Admin.

Answer

Use row-level security to restrict Finance data, add both as Member.

Question 6

Refer to the exhibit. You have a Power BI dataset with the JSON policy shown. You add a user to the USOnly role. What happens when that user views a report based on this dataset?

Accepted Answer

The user sees only rows where Region is 'US' in the Sales table.. Row-level security (RLS) restricts data: only rows where Region is 'US' are visible. Option A is wrong because RLS does not hide the entire table. Option C is wrong because RLS does not affect columns. Option D is wrong because RLS does not affect other tables unless defined.

Answer

The user sees all rows in the Sales table.

Answer

The user sees all rows but the SalesAmount column is hidden.

Answer

The user sees all rows in all tables of the dataset.

Question 7

You have a Power BI dataset that uses a live connection to an Azure Analysis Services (AAS) model. The AAS model has object-level security (OLS) that hides certain measures. Your Power BI report users need to see those measures. What should you do?

Accepted Answer

Modify the object-level security roles in Azure Analysis Services to include the measures.. Modify the object-level security roles in Azure Analysis Services to include the measures. Because the Power BI dataset uses a live connection, all security—including OLS that hides measures—is enforced by the AAS model itself, so the only way to expose those measures to report users is to edit the OLS roles in AAS to grant access to them. Power BI cannot override or bypass AAS security in a live connection, so options A and B are ineffective, and option C would require abandoning the live connection and rebuilding the model, which is unnecessary and changes the architecture.

Answer

Use Power BI Desktop object-level security to override AAS settings.

Answer

Configure row-level security (RLS) in Power BI to grant access.

Answer

Change the dataset to import mode and then apply OLS in Power BI.

Question 8

Your organization uses Microsoft Power BI with Microsoft Purview for data governance. You have a dataset that contains customer data classified as 'Highly Confidential' under a sensitivity label. The compliance team requires that when this dataset is shared with external users, a Microsoft Purview data loss prevention (DLP) policy must block the sharing and notify the compliance team. You need to configure this. What should you do?

Accepted Answer

Create a DLP policy in Microsoft Purview that applies to Power BI and blocks sharing of content with the 'Highly Confidential' label.. The correct option is D: create a DLP policy in Microsoft Purview that applies to Power BI and blocks sharing of content with the 'Highly Confidential' label. Microsoft Purview DLP natively supports Power BI as a workload, so a policy scoped to Power BI can detect items carrying the specified sensitivity label and block external sharing while sending notifications to the compliance team. Option A is wrong because Defender for Cloud Apps session policies govern SaaS session activity, not Power BI item-level label-based sharing. Option B is wrong because Microsoft Sentinel is a SIEM/SOAR platform for monitoring and alerting, not for enforcing DLP blocking. Option C is wrong because disabling sharing at the workspace level is a blunt control that does not target the 'Highly Confidential' label or notify compliance.

Answer

Use Microsoft Defender for Cloud Apps to create a session policy that blocks sharing.

Answer

Configure Microsoft Sentinel to monitor and block sharing events.

Answer

In the Power BI admin portal, disable sharing for workspaces containing 'Highly Confidential' content.

Question 9

You are a Power BI administrator. The company has a premium capacity that many users publish reports to. Recently, users have reported that some reports are slow to load. You suspect that the capacity is being overused by certain large datasets. You need to identify which workspaces and datasets are consuming the most memory and CPU resources on the capacity. You want to use a tool that provides historical metrics and can be queried. What should you do?

Accepted Answer

Install the Power BI Premium Capacity Metrics app from AppSource.. The Power BI Premium Capacity Metrics app (option A) is the correct tool because it is installed from AppSource and provides historical, queryable metrics on memory and CPU consumption per workspace and dataset on a Premium capacity, directly addressing the need to find the top resource consumers. It surfaces dataset sizes, refresh durations, CPU usage, and memory usage over time, which is exactly what the administrator requires. Option B, Performance Analyzer, only measures rendering and query performance of individual reports in Power BI Desktop and does not give capacity-wide historical resource metrics. Option C, the admin portal, shows current capacity health and utilization but not the detailed historical, queryable per-dataset metrics needed. Option D, activity logs in Log Analytics, capture user and admin activity events, not the granular memory and CPU consumption metrics of datasets on the capacity.

Answer

Use Performance Analyzer in Power BI Desktop for each report.

Answer

Use the Power BI admin portal to view capacity metrics in real-time.

Answer

Enable Power BI activity logs and query Log Analytics for capacity metrics.

Question 10

Your organization uses Power BI with a shared capacity. You have a dataset that is refreshed daily from an on-premises SQL Server database using an on-premises data gateway. The dataset contains sensitive financial data. The security team requires that all access to the dataset be logged and that any access from outside the corporate network be flagged. You need to implement a monitoring solution. What should you do?

Accepted Answer

Enable Power BI activity logging and stream to Azure Log Analytics, then create alerts on access events from external IPs.. Power BI activity logging captures dataset access events (including who accessed the dataset and from which client IP), and streaming those logs to Azure Log Analytics lets you query and alert on access originating from outside the corporate network, satisfying both the logging and external-access-flagging requirements. The other options do not fit: Azure SQL Auditing (A) only logs activity at the SQL Server level, not Power BI dataset access, and the source is on-premises SQL Server rather than Azure SQL. Microsoft Defender for Cloud Apps (B) enforces conditional access but does not provide the required access logging and external-IP flagging for the dataset. Gateway logging (C) records gateway connectivity and query traffic, not end-user dataset access events or their source IPs.

Answer

Audit the SQL Server database using Azure SQL Auditing.

Answer

Use Microsoft Defender for Cloud Apps to enforce conditional access policies.

Answer

Enable logging on the on-premises data gateway and monitor the logs.

Question 11

You are the Power BI administrator for a company that uses Microsoft 365. The security team requires that when a user opens a Power BI report on a personal device, the user must authenticate with Microsoft Entra ID and satisfy a conditional access policy that demands multifactor authentication. The report is in a workspace that is not backed by Fabric capacity. Which feature should you enable to meet this requirement?

Accepted Answer

Microsoft Entra ID Conditional Access. The requirement is to force MFA when users open a report on personal devices. Because Power BI authenticates users through Microsoft Entra ID, a Conditional Access policy that targets the Power BI app and requires MFA will enforce the challenge at sign-in. This works regardless of whether the workspace uses Fabric capacity. Other features like sensitivity labels, RLS, or Embedded do not enforce interactive MFA.

Answer

Power BI Embedded

Answer

Row-level security (RLS)

Answer

Sensitivity labels

Question 12

You manage a Power BI tenant. A workspace named 'Finance' contains a dataset that uses an on-premises SQL Server data source via an on-premises data gateway. The gateway is configured with a single data source that uses a SQL Server account for authentication. You need to ensure that when users view reports based on this dataset, they see only data for their own department, and the filtering must be enforced at query time without modifying the dataset. What should you do?

Accepted Answer

Configure row-level security (RLS) on the dataset and map users to roles.. Row-level security (RLS) is the correct approach because it dynamically filters data based on the user's identity at query time. It is defined within the dataset and does not require changes to the data source or gateway. Other options either duplicate content, do not enforce per-user filtering, or address column-level rather than row-level security.

Answer

Create separate reports for each department and distribute them via apps.

Answer

Configure column-level security on the dataset to hide sensitive columns.

Answer

Use the gateway's 'Add users to data source' feature to map each user to a specific SQL Server login.

Question 13

You are a Power BI administrator. The compliance team requires that all Power BI datasets and reports must be retained for seven years, even if users delete them. You need to configure the tenant to meet this requirement with minimal administrative effort. What should you do?

Accepted Answer

Enable Microsoft Purview retention policies for Power BI items.. Microsoft Purview retention policies are the correct solution because they can be applied to Power BI items to retain them for a specified period, even if users delete them. This is a tenant-level configuration that requires minimal effort and meets compliance requirements. Other options are either not valid Power BI features or do not enforce automatic retention.

Answer

Configure a backup schedule for the Power BI workspace.

Answer

Set the workspace retention policy to seven years in the workspace settings.

Answer

Instruct users to move items to a dedicated archive workspace.

Question 14

You are a Power BI administrator. A new analyst joins the team and needs to publish reports to an existing workspace named Sales Analytics. The analyst must be able to create and edit content in the workspace but must not be allowed to add or remove other members or change workspace settings. Which workspace role should you assign to the analyst?

Accepted Answer

Contributor. The Contributor role allows a user to create and edit content such as reports and datasets in a workspace, but does not allow managing workspace membership or settings. Assigning Contributor gives the analyst the needed publishing and editing capabilities while enforcing least privilege. Admin and Member grant excessive rights, and Viewer lacks the required editing permissions.

Answer

Viewer

Answer

Member

Answer

Admin

Question 15

You are a Power BI administrator. You need to ensure that users in your organization can only access Power BI through the web browser and cannot use the Power BI Desktop application to connect to the Power BI service. Which tenant setting should you configure?

Accepted Answer

Disable 'Allow users to connect to the Power BI service with Power BI Desktop'.. The tenant setting 'Allow users to connect to the Power BI service with Power BI Desktop' controls whether Desktop can be used to connect to the service. Disabling it restricts users to the web browser. Other settings address different features such as publishing publicly or API access, and do not prevent Desktop connections.

Answer

Disable 'Publish to web' for the entire organization.

Answer

Disable 'Allow service principals to use Power BI APIs'.

Answer

Disable 'Allow users to try Power BI Desktop for free'.