PL-300 Manage and secure Power BI Practice Test 2 — 15 Questions

Question 1

A user reports that they cannot publish a Power BI Desktop file to the Power BI service. The error message indicates insufficient permissions. The user is a member of a workspace and has the Viewer role. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user has the Viewer role in the workspace. The Viewer role in a Power BI workspace has read-only access and cannot publish or edit content. The error message indicates insufficient permissions, which is directly caused by the Viewer role. Option B is incorrect because RLS controls data access, not publishing permissions. Option C is incorrect because the user may have a Power BI Pro license but still be restricted by the Viewer role. Option D is incorrect because the file location does not affect service permissions.

Answer

Row-level security (RLS) is preventing the user from seeing the data

Answer

The user does not have a Power BI Pro license

Answer

The .pbix file is stored on a network share that restricts write access

Question 2

Refer to the exhibit. A Power BI administrator is reviewing a dataset configuration exported from a workspace. The dataset connects to an on-premises SQL Server using Windows authentication. The administrator wants to configure a gateway to support scheduled refresh without storing credentials. Which gateway type and configuration should be used?

Accepted Answer

Use the on-premises data gateway (standard mode) and configure Kerberos constrained delegation for single sign-on. The on-premises data gateway (standard mode) supports Kerberos constrained delegation, enabling single sign-on (SSO) for scheduled refresh without storing credentials in the gateway. Option B is incorrect because storing the connection string in the gateway is not necessary and does not address credential storage; Kerberos delegation is used instead. Option C is incorrect because personal mode gateways require stored credentials and are not suitable for shared or scheduled refresh scenarios. Option D is incorrect because VNet gateways are used for Azure VNets, not on-premises data sources.

Answer

Use the on-premises data gateway (standard mode) and store the connection string in the gateway

Answer

Use the on-premises data gateway (personal mode) and store the Windows credentials in the gateway

Answer

Use the virtual network (VNet) gateway and configure a service principal

Question 3

A Power BI administrator deploys a dashboard that uses a real-time dataset from Azure Stream Analytics. The dashboard must refresh every minute. The administrator notices that the dashboard sometimes shows stale data. What is the most likely cause and solution?

Accepted Answer

The dashboard tile cache is set to the default 30 minutes. Reduce the cache duration to 1 minute in the dataset settings. Power BI has a default dashboard tile cache of 30 minutes for streaming datasets; reducing the cache duration solves the issue. Option B is wrong because the data source is streaming, not push. Option C is wrong because automatic page refresh is for report pages, not dashboard tiles. Option D is wrong because the issue is cache, not the refresh interval.

Answer

The streaming dataset is not supported for dashboards. Use a push dataset instead

Answer

Enable automatic page refresh on the dashboard and set it to 1 minute

Answer

The refresh interval in the dataset is set to 30 minutes. Change it to 1 minute

Question 4

A Power BI workspace contains a report that uses a shared dataset. The dataset owner leaves the company. The report still works, but the dataset cannot be refreshed. What should the administrator do to restore refresh capability?

Accepted Answer

Take over the dataset as an administrator and update the data source credentials. An administrator can take over the dataset and update the data source credentials to enable refresh. Option A is wrong because reassigning dataset ownership is not a feature; administrators can take over datasets. Option B is wrong because creating a new dataset would break the report's link to the existing dataset. Option C is wrong because reconfiguring the gateway does not address the credential issue; the administrator needs to take over the dataset to update credentials.

Answer

Reassign the dataset ownership to another user in the workspace settings

Answer

Create a new dataset and link the report to it

Answer

Reconfigure the gateway to use a service principal

Question 5

An organization uses Power BI with Microsoft Purview Information Protection. A report contains sensitive customer data. The administrator wants to ensure that when the report is exported to Excel, the sensitivity label is automatically applied. What must be configured?

Accepted Answer

Enable auto-labeling in the Power BI admin settings and configure the sensitivity label policy. Power BI supports automatic sensitivity labeling based on data classification, which can propagate to exports. Option A is wrong because manual labeling is not automatic. Option C is wrong because RLS does not affect labeling. Option D is wrong because the label is applied by Power BI, not Excel.

Answer

Configure the Excel workbook to inherit the label from Power BI

Answer

Use row-level security to restrict access to sensitive data

Answer

Require users to manually apply a sensitivity label before exporting

Question 6

A Power BI administrator receives a support ticket that users can see reports in the Power BI service but cannot access them, receiving a 'not found' error. The reports are stored in a shared workspace. What should the administrator check first?

Accepted Answer

Ensure the workspace is assigned to an active capacity (Pro or Premium) and that the capacity is not paused. If the workspace is assigned to an active capacity (Pro or Premium) and that capacity is paused or deleted, users may see reports in the Power BI service due to caching but receive a 'not found' error when trying to open them. This is a common issue when capacity billing is disrupted. Option A is incorrect because license assignment is typically global and would not cause a 'not found' error for specific reports. Option B is incorrect because publishing to the correct workspace is about visibility, not access errors. Option D is incorrect because row-level security (RLS) filters data but does not block report access entirely; users would still see the report but with limited data.

Answer

Verify that the users have Power BI Pro or Premium Per User licenses assigned

Answer

Confirm that the report is published to the correct workspace

Answer

Check if row-level security (RLS) is blocking access to the underlying data

Question 7

An administrator wants to monitor all Power BI activities, including viewing reports, exporting data, and sharing workspaces. Which tool should they use?

Accepted Answer

Power BI activity log in the admin portal. The Power BI activity log captures user activities such as viewing, exporting, and sharing. Option B is wrong because the usage metrics report shows aggregate usage, not detailed activities. Option C is wrong because the Power BI capacity metrics app focuses on performance and capacity metrics, not user activities. Option D is wrong because the Microsoft 365 audit log is broader but less specific to Power BI; the activity log is the dedicated tool.

Answer

Power BI usage metrics report

Answer

Power BI capacity metrics app

Answer

Microsoft 365 audit log

Question 8

Which TWO actions are required to enable Bring Your Own Key (BYOK) encryption for Power BI datasets? (Select exactly two.)

Accepted Answer

Upload the customer-managed key to Azure Key Vault. Options C and D are correct. BYOK requires uploading the customer-managed key to Azure Key Vault (C) and configuring the Power BI admin settings to use the key from Azure Key Vault (D). Option A is wrong because BYOK does not require a Premium capacity; it works with Premium Per User or Premium capacity, but the workspace must be assigned to a capacity that supports BYOK, but that alone is not sufficient. Option B is wrong because the key is stored in Azure Key Vault, not in Power BI admin settings. Option E is wrong because the key is not registered in Microsoft Purview compliance portal.

Answer

Assign the workspace to a Power BI Premium capacity

Answer

Store the encryption key in the Power BI service admin settings

Answer

Register the encryption key in Microsoft Purview compliance portal

Question 9

Which Power BI component can be used to restrict access to specific rows of data for different users?

Accepted Answer

Row-level security (RLS). Row-Level Security (RLS) is the only Power BI component that can restrict access to specific rows of data based on user roles or filters. The other options (Column-level security, Bookmark-based filtering, Object-level security, Dashboard-level permissions) are not designed to restrict data at the row level.

Answer

Column-level security (CLS)

Answer

Bookmark-based filtering

Answer

Object-level security (OLS)

Answer

Dashboard-level permissions

Question 10

Refer to the exhibit. The Power BI admin portal shows capacity usage. The Sales workspace is on Premium capacity and the Marketing workspace is on Shared capacity. The Marketing report uses a dataset from the Sales workspace. The admin notices that the Sales dataset refresh takes 45 minutes, and the Marketing dataset refresh takes 10 minutes. Users complain that during the Sales dataset refresh, the Marketing report becomes slow. What is the most likely cause?

Accepted Answer

The Sales dataset is too large and consumes Premium capacity resources, leaving no resources for Marketing. The Marketing report uses the Sales dataset, which is located in the Premium capacity. During the Sales dataset refresh, significant Premium capacity resources (CPU, memory) are consumed, leaving fewer resources to handle queries against that dataset. This causes slow performance for all reports that query the Sales dataset, including the Marketing report, even though the Marketing workspace is on Shared capacity. Option A is incorrect because moving the Marketing workspace to Premium would not resolve the contention for the Sales dataset's Premium resources; the query still runs on Premium capacity. Option C is incorrect because the Sales workspace is on Premium, not shared capacity; the two workspaces are not on the same shared node. Option D is incorrect because licensing is not the cause of the performance issue; both workspaces likely have appropriate licenses.

Answer

The Marketing workspace should be moved to Premium capacity to avoid contention

Answer

Both workspaces are on the same shared capacity node, and the Sales dataset refresh consumes node resources, slowing Marketing

Answer

The Marketing dataset requires a Pro license, which is not assigned

Question 11

Refer to the exhibit. A Power BI administrator reviews a row-level security (RLS) policy for the Sales dataset. The SalesManager role should see all sales above $10,000, and the SalesRep role should see all sales above $0. However, users in the SalesRep role report that they cannot see any data when they open the report. What is the most likely issue?

Accepted Answer

The column name in the filter expression does not match the actual column name in the dataset. If the column name in the RLS filter expression does not match the actual column name in the dataset (e.g., using 'SalesAmount' when the column is 'Amount'), the filter will fail silently, causing users to see no data. RLS filters are evaluated at query time and must reference valid column names. Option A is wrong because the SalesRep role is assigned to users, so that is not the issue. Option C is wrong because the 'greater than' operator is supported in RLS. Option D is wrong because RLS filters must be applied on columns, not measures, but the issue here is mismatched column names.

Answer

The SalesRep role is not assigned to any users

Answer

The filter expression uses a comparison operator that is not supported in RLS

Answer

The RLS role uses a filter on a measure, not a column

Question 12

A Power BI administrator needs to allow an external partner organization to access a specific report without requiring them to have Power BI Pro licenses. The report is stored in a workspace assigned to a Premium capacity. What is the correct configuration?

Accepted Answer

Invite the external users as guest users in Microsoft Entra ID, add them to the workspace with Viewer role, and share the report or app. In a Premium capacity workspace, you can share reports with external users via B2B collaboration. Inviting them as guest users in Microsoft Entra ID, adding them to the workspace with Viewer role, and sharing the report or app allows access without requiring the external users to have Power BI Pro licenses, as the workspace is on Premium capacity. Option A is incorrect because adding external users as workspace members requires them to be authenticated in the same tenant or as guests, but simply adding them as members without proper guest setup will fail. Option B is incorrect because publishing to the web makes the report public and is not a secure method for sharing with a specific external partner. Option D is incorrect because 'embed for your organization' requires internal users with proper licenses or access within the same organization; it does not grant access to external users without additional configuration.

Answer

Add the external users as members of the workspace and assign them a Viewer role

Answer

Publish the report to the web and share the public link

Answer

Embed the report in a secure portal using the 'embed for your organization' option

Question 13

You need to ensure that only members of a specific security group can view a Power BI dashboard. The dashboard is in a shared workspace. What should you do?

Accepted Answer

Publish the dashboard as an app and set the security group as the audience.. Publishing a dashboard as an app and setting a security group as the audience restricts visibility to only members of that group. App permissions with audience targeting allow you to grant access to specific items in a workspace without granting access to the entire workspace. Option B is incorrect because assigning the Viewer role on the workspace gives access to all content in the workspace, not just the dashboard. Option C is incorrect because row-level security filters data rows, not dashboard visibility. Option D is incorrect because sharing the dashboard directly with the security group gives access, but the intended method for controlled audience targeting is app publishing.

Answer

Assign the security group the Viewer role on the workspace.

Answer

Configure row-level security on the underlying dataset to filter by user.

Answer

Share the dashboard directly with the security group.

Question 14

You have a Power BI capacity that is frequently hitting its memory limits, causing refreshes to fail. You need to reduce memory usage without increasing capacity size. What should you do?

Accepted Answer

Reduce the number of parallel data refresh operations.. Reducing the number of parallel data refresh operations decreases peak memory consumption during refreshes. Option A is incorrect because increasing the eviction time keeps more data in memory, exacerbating memory pressure. Option C is incorrect because removing row-level security (RLS) does not significantly reduce memory usage during refreshes; RLS primarily affects query-time filtering. Option D is incorrect because increasing the frequency of scheduled refreshes can lead to more frequent memory spikes, worsening the issue.

Answer

Increase the eviction time for unused data.

Answer

Remove row-level security (RLS) from the dataset.

Answer

Increase the frequency of scheduled refreshes.

Question 15

You manage a Power BI environment where users create reports using data from Azure SQL Database. You need to enforce that all data sources use Single Sign-On (SSO) with Microsoft Entra ID. What should you do?

Accepted Answer

In the Power BI admin portal, block authentication methods other than OAuth2.. By blocking authentication methods other than OAuth2 in the Power BI admin portal, you force all data sources to use OAuth2, which is required for SSO with Microsoft Entra ID. This ensures that no data source can use other authentication methods, effectively enforcing SSO for all supported sources. Option B is incorrect because configuring a dataset to use SSO only applies to that specific dataset, not all data sources across the environment. Option C is incorrect because enabling the 'Allow data sources to use SSO' tenant setting permits SSO but does not block other authentication methods; it does not enforce SSO. Option D is incorrect because creating a security group does not enforce SSO; it is used for managing access, not for blocking authentication methods.

Answer

Configure the dataset to use SSO in the Power BI service.

Answer

Enable the 'Allow data sources to use SSO' tenant setting.

Answer

Create a security group for SSO-enabled data sources and assign it to the workspace.