PL-300 Manage and secure Power BI Practice Test 2 — 15 Questions

Question 1

A company deploys Power BI for internal reporting. The security team requires that all report data be encrypted at rest and in transit, and that access be granted only to users with verified identities. Which combination of features should the Power BI administrator use?

Accepted Answer

Leverage Azure SQL Database Transparent Data Encryption (TDE), TLS, and Microsoft Entra ID. Option C is correct because Power BI uses Azure SQL Database encryption at rest, TLS for data in transit, and integrates with Microsoft Entra ID for authentication. Option A is wrong because Microsoft Purview is for data governance, not encryption. Option B is wrong because SharePoint is not a core encryption or identity service for Power BI. Option D is wrong because Microsoft Intune is for mobile management, not encryption.

Answer

Apply row-level security (RLS) and use Microsoft Intune for conditional access

Answer

Use Microsoft Purview for encryption and Microsoft Intune for identity

Answer

Enable Power BI encryption settings and configure SharePoint permissions

Question 2

A Power BI administrator needs to ensure that reports containing sensitive financial data are only accessible to users who have completed mandatory training and are using compliant devices. The organization uses Microsoft Entra ID and Microsoft Intune. Which feature should the administrator configure?

Accepted Answer

Create a Conditional Access policy that requires device compliance and a specific group membership for training completion. Option B is correct because Conditional Access policies in Microsoft Entra ID can enforce access controls based on device compliance (Intune) and training completion (custom attribute or group membership). Option A is wrong because sensitivity labels classify and protect data, but do not enforce device compliance or training. Option C is wrong because RLS restricts data within a report, not access to the report itself. Option D is wrong because Microsoft Purview is for data governance, not access policies.

Answer

Deploy Microsoft Purview to scan the reports and enforce access policies

Answer

Use row-level security (RLS) to filter data based on user training status

Answer

Apply sensitivity labels to the reports and require MFA

Question 3

A user reports that they cannot publish a Power BI Desktop file to the Power BI service. The error message indicates insufficient permissions. The user is a member of a workspace and has the Viewer role. What is the most likely cause?

Accepted Answer

The user has the Viewer role in the workspace. Option B is correct because the Viewer role in a Power BI workspace does not allow publishing or editing. Option A is wrong because the Power BI license is required but the user has a license as a workspace member. Option C is wrong because the report may not be in a shared drive, but the core issue is role permissions. Option D is wrong because RLS does not affect publishing permissions.

Answer

Row-level security (RLS) is preventing the user from seeing the data

Answer

The user does not have a Power BI Pro license

Answer

The .pbix file is stored on a network share that restricts write access

Question 4

Refer to the exhibit. A Power BI administrator is reviewing a dataset configuration exported from a workspace. The dataset connects to an on-premises SQL Server using Windows authentication. The administrator wants to configure a gateway to support scheduled refresh without storing credentials. Which gateway type and configuration should be used?

Accepted Answer

Use the on-premises data gateway (standard mode) and configure Kerberos constrained delegation for single sign-on. Option D is correct because the on-premises data gateway supports Windows authentication via Kerberos constrained delegation, allowing refresh without storing credentials. Option A is wrong because the personal gateway is only for a single user and requires credentials. Option B is wrong because the VNet gateway is for Azure VNets, not on-premises. Option C is wrong because the on-premises data gateway does not need a connection string stored in the gateway; it uses the dataset's connection string.

Answer

Use the on-premises data gateway (standard mode) and store the connection string in the gateway

Answer

Use the on-premises data gateway (personal mode) and store the Windows credentials in the gateway

Answer

Use the virtual network (VNet) gateway and configure a service principal

Question 5

A Power BI administrator deploys a dashboard that uses a real-time dataset from Azure Stream Analytics. The dashboard must refresh every minute. The administrator notices that the dashboard sometimes shows stale data. What is the most likely cause and solution?

Accepted Answer

The dashboard tile cache is set to the default 30 minutes. Reduce the cache duration to 1 minute in the dataset settings. Option A is correct because Power BI has a default dashboard tile cache of 30 minutes for streaming datasets; reducing the cache duration solves the issue. Option B is wrong because the data source is streaming, not push. Option C is wrong because automatic page refresh is for report pages, not dashboard tiles. Option D is wrong because the issue is cache, not the refresh interval.

Answer

The streaming dataset is not supported for dashboards. Use a push dataset instead

Answer

Enable automatic page refresh on the dashboard and set it to 1 minute

Answer

The refresh interval in the dataset is set to 30 minutes. Change it to 1 minute

Question 6

A Power BI workspace contains a report that uses a shared dataset. The dataset owner leaves the company. The report still works, but the dataset cannot be refreshed. What should the administrator do to restore refresh capability?

Accepted Answer

Take over the dataset as an administrator and update the data source credentials. Option C is correct because taking over the dataset allows the administrator to configure credentials and refresh. Option A is wrong because reassigning ownership is not a direct feature; take over is. Option B is wrong because creating a new dataset would break the report linkage. Option D is wrong because the data source credentials are stored in the dataset, not the gateway.

Answer

Reassign the dataset ownership to another user in the workspace settings

Answer

Create a new dataset and link the report to it

Answer

Reconfigure the gateway to use a service principal

Question 7

An organization uses Power BI with Microsoft Purview Information Protection. A report contains sensitive customer data. The administrator wants to ensure that when the report is exported to Excel, the sensitivity label is automatically applied. What must be configured?

Accepted Answer

Enable auto-labeling in the Power BI admin settings and configure the sensitivity label policy. Option B is correct because Power BI supports automatic sensitivity labeling based on data classification, which can propagate to exports. Option A is wrong because manual labeling is not automatic. Option C is wrong because RLS does not affect labeling. Option D is wrong because the label is applied by Power BI, not Excel.

Answer

Configure the Excel workbook to inherit the label from Power BI

Answer

Use row-level security to restrict access to sensitive data

Answer

Require users to manually apply a sensitivity label before exporting

Question 8

A Power BI administrator receives a support ticket that users can see reports in the Power BI service but cannot access them, receiving a 'not found' error. The reports are stored in a shared workspace. What should the administrator check first?

Accepted Answer

Ensure the workspace is assigned to an active capacity (Pro or Premium) and that the capacity is not paused. Option D is correct because if users are in a workspace with a different capacity, they may see reports due to caching but get 'not found' when trying to open them if the capacity is paused or deleted. Option A is wrong because license assignment is usually global. Option B is wrong because RLS would show data, not 'not found'. Option C is wrong because the reports exist.

Answer

Verify that the users have Power BI Pro or Premium Per User licenses assigned

Answer

Confirm that the report is published to the correct workspace

Answer

Check if row-level security (RLS) is blocking access to the underlying data

Question 9

An administrator wants to monitor all Power BI activities, including viewing reports, exporting data, and sharing workspaces. Which tool should they use?

Accepted Answer

Power BI activity log in the admin portal. Option A is correct because the Power BI activity log captures user activities such as viewing, exporting, and sharing. Option B is wrong because the usage metrics report shows aggregate usage, not detailed activities. Option C is wrong because Microsoft 365 audit log is broader but less specific to Power BI; the activity log is the dedicated tool. Option D is wrong because the admin portal's capacity metrics focus on performance.

Answer

Power BI usage metrics report

Answer

Power BI capacity metrics app

Answer

Microsoft 365 audit log

Question 10

Which TWO actions are required to enable Bring Your Own Key (BYOK) encryption for Power BI datasets? (Select exactly two.)

Accepted Answer

Upload the customer-managed key to Azure Key Vault. Options B and D are correct. BYOK requires uploading the encryption key to Azure Key Vault and configuring the Power BI admin settings to use the key. Option A is wrong because the key is stored in Azure Key Vault, not Power BI. Option C is wrong because BYOK does not require a Premium capacity; it works with Premium Per User or Premium capacity. Option E is wrong because the key is not stored in Microsoft Purview.

Answer

Assign the workspace to a Power BI Premium capacity

Answer

Store the encryption key in the Power BI service admin settings

Answer

Register the encryption key in Microsoft Purview compliance portal

Question 11

Which THREE components must be in place to enable Power BI data sensitivity labels from Microsoft Purview? (Select exactly three.)

Accepted Answer

Power BI admin setting to enable sensitivity labels enabled. Options B, C, and D are correct. A Purview Information Protection subscription is required; sensitivity labels must be published to users or groups; and Power BI admin settings must enable sensitivity labels. Option A is wrong because the Power BI license is not a prerequisite; any license can use labels if the admin enables them. Option E is wrong because a Premium capacity is not required; labels work with Pro and Premium.

Answer

Power BI Premium capacity assigned to the workspace

Answer

Power BI Pro license for all users

Question 12

Which TWO Power BI components can be used to restrict access to specific rows of data for different users? (Select exactly two.)

Accepted Answer

Object-level security (OLS). Options A and B are correct. Row-level security (RLS) is the primary method to filter data rows by user. Object-level security (OLS) can also restrict access to specific tables or columns, which indirectly restricts rows if applied to tables. Option C is wrong because column-level security is not a Power BI feature; it's a database concept. Option D is wrong because bookmark-based filtering is not a security feature. Option E is wrong because dashboard-level security controls access to the dashboard, not rows.

Answer

Column-level security (CLS)

Answer

Bookmark-based filtering

Answer

Dashboard-level permissions

Question 13

Refer to the exhibit. The Power BI admin portal shows capacity usage. The Sales workspace is on Premium capacity and the Marketing workspace is on Shared capacity. The admin notices that the Sales dataset refresh takes 45 minutes, and the Marketing dataset refresh takes 10 minutes. Users complain that during the Sales dataset refresh, the Marketing report becomes slow. What is the most likely cause?

Accepted Answer

Both workspaces are on the same shared capacity node, and the Sales dataset refresh consumes node resources, slowing Marketing. Option B is correct because on Shared capacity, refreshes can be throttled by system load, and a long-running Premium refresh (Sales) can impact the shared capacity node's performance, affecting Marketing. Option A is wrong because Premium capacity is isolated; it would not directly slow Marketing. Option C is wrong because Marketing is on Shared, not Premium. Option D is wrong because the issue is not about licenses but about capacity contention.

Answer

The Marketing workspace should be moved to Premium capacity to avoid contention

Answer

The Sales dataset is too large and consumes Premium capacity resources, leaving no resources for Marketing

Answer

The Marketing dataset requires a Pro license, which is not assigned

Question 14

Refer to the exhibit. A Power BI administrator reviews a row-level security (RLS) policy for the Sales dataset. The SalesManager role should see all sales above $10,000, and the SalesRep role should see all sales above $0. However, users in the SalesRep role report that they cannot see any data when they open the report. What is the most likely issue?

Accepted Answer

The column name in the filter expression does not match the actual column name in the dataset. Option C is correct because the filter expression uses the column name 'SalesAmount' but the actual column may be named differently (e.g., 'Amount'). RLS filters must match the exact column name in the dataset. Option A is wrong because RLS can filter on any numeric column. Option B is wrong because if the role is assigned, users would see data based on the filter. Option D is wrong because the '>' operator is valid.

Answer

The SalesRep role is not assigned to any users

Answer

The filter expression uses a comparison operator that is not supported in RLS

Answer

The RLS role uses a filter on a measure, not a column

Question 15

A Power BI administrator needs to allow an external partner organization to access a specific report without requiring them to have Power BI Pro licenses. The report is stored in a workspace assigned to a Premium capacity. What is the correct configuration?

Accepted Answer

Invite the external users as guest users in Microsoft Entra ID, add them to the workspace with Viewer role, and share the report or app. Option D is correct because in a Premium capacity workspace, you can share reports with external users (B2B collaboration) and grant access via app or direct sharing; the external user's Microsoft Entra ID tenant is trusted, and they can access without a Pro license if the workspace is on Premium. Option A is wrong because publish to web makes the report public, not secure. Option B is wrong because embedding requires a license or capacity. Option C is wrong because external users need to be invited as guests.

Answer

Add the external users as members of the workspace and assign them a Viewer role

Answer

Publish the report to the web and share the public link

Answer

Embed the report in a secure portal using the 'embed for your organization' option