PL-300 Manage and secure Power BI Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. A Power BI administrator reviews a row-level security (RLS) policy for the Sales dataset. The SalesManager role should see all sales above $10,000, and the SalesRep role should see all sales above $0. However, users in the SalesRep role report that they cannot see any data when they open the report. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The column name in the filter expression does not match the actual column name in the dataset. The correct answer is B: the column name in the filter expression does not match the actual column name in the dataset. In Power BI RLS, DAX filter expressions such as [SalesAmount] > 0 are evaluated against the dataset's actual columns, and if the referenced column name is misspelled or does not exist, the role's filter fails to resolve and effectively returns no rows, which matches the symptom of SalesRep users seeing no data. Option A is unlikely because users are already in the SalesRep role and would otherwise see the report content, and unassigned roles would not cause this specific blank-data behavior. Option C is incorrect because RLS supports standard comparison operators like >, <, =, and <>. Option D is incorrect because RLS filters must be defined on columns, not measures, so a measure-based filter would not be a valid RLS expression in the first place.

Answer

The SalesRep role is not assigned to any users

Answer

The filter expression uses a comparison operator that is not supported in RLS

Answer

The RLS role uses a filter on a measure, not a column

Question 2

You have a Power BI workspace that contains a report connected to an Azure Analysis Services (AAS) model. The data source uses Single Sign-On (SSO) with Microsoft Entra ID. When users access the report, they see an error that the data cannot be refreshed. What is the most likely cause?

Accepted Answer

The dataset is configured in Import mode.. The most likely cause is that the dataset is configured in Import mode. Single Sign-On (SSO) with Microsoft Entra ID is only supported when the dataset uses DirectQuery or Live Connection mode. Import mode requires stored credentials and does not pass the user's identity to the data source. Option A is incorrect because RLS does not affect data refresh connectivity. Option B is incorrect because stored credentials are not used when SSO is enabled. Option C is incorrect because SSO uses the user's identity, not a service principal.

Answer

Row-level security (RLS) is not configured on the AAS model.

Answer

The data source credentials are stored in the dataset.

Answer

The service principal used for authentication has expired.

Question 3

You need to ensure that only members of a specific security group can view a Power BI dashboard. The dashboard is in a shared workspace. What should you do?

Accepted Answer

Publish the dashboard as an app and set the security group as the audience.. The correct answer is A: publish the dashboard as an app and set the security group as the audience. In Power BI, app audiences let you grant read-only access to a curated set of reports and dashboards to specific security groups, so only those group members can view the content. Option B is wrong because assigning the Viewer role on the workspace gives the group access to all workspace content, not just the dashboard, and workspace roles are broader than app audience scoping. Option C is wrong because row-level security filters data rows within a dataset and does not control who can view a dashboard. Option D is wrong because sharing a dashboard directly grants access to individual users or groups but does not provide the controlled, app-based distribution mechanism intended for restricting viewing to a specific security group.

Answer

Assign the security group the Viewer role on the workspace.

Answer

Configure row-level security on the underlying dataset to filter by user.

Answer

Share the dashboard directly with the security group.

Question 4

Your organization uses Microsoft Purview Information Protection to label sensitive data in Power BI datasets. You need to ensure that when a report is exported to Excel, the sensitivity label is automatically applied. What should you configure?

Accepted Answer

Ensure the dataset has a sensitivity label and that the export inherits the label.. When a Power BI dataset has a sensitivity label applied via Microsoft Purview Information Protection, any downstream exports (such as reports exported to Excel) automatically inherit that label. This inheritance ensures consistent protection across all outputs. Option D is incorrect because the Power BI admin portal setting 'Apply sensitivity labels to exported data' is used to apply labels when the data source does not have a label, but it does not override automatic inheritance from a labeled dataset. Option B is incorrect because DLP policies in Microsoft Purview monitor and protect data, but they do not automatically apply sensitivity labels to exports. Option C is incorrect because setting a default sensitivity label on a report is not a feature; sensitivity labels are inherited from the dataset, not configured per report.

Answer

Use data loss prevention (DLP) policies in Microsoft Purview.

Answer

Set a default sensitivity label on the report.

Answer

Enable 'Apply sensitivity labels to exported data' in the Power BI admin portal.

Question 5

You manage a Power BI environment where users create reports using data from Azure SQL Database. You need to enforce that all data sources use Single Sign-On (SSO) with Microsoft Entra ID. What should you do?

Accepted Answer

In the Power BI admin portal, block authentication methods other than OAuth2.. The correct option is A: in the Power BI admin portal, block authentication methods other than OAuth2. This tenant-level setting (under Tenant settings, often labeled 'Authentication methods' or via 'Block non-OAuth2 authentication methods') forces all data source connections, including Azure SQL Database, to use OAuth2, which is the protocol that enables Microsoft Entra ID SSO for Power BI. Options B and C are not valid enforcement mechanisms: SSO for Azure SQL is configured per data source/dataset or via the gateway, and there is no tenant setting named 'Allow data sources to use SSO' that enforces SSO globally. Option D is incorrect because security groups control workspace access, not the authentication method used by data sources.

Answer

Configure the dataset to use SSO in the Power BI service.

Answer

Enable the 'Allow data sources to use SSO' tenant setting.

Answer

Create a security group for SSO-enabled data sources and assign it to the workspace.

Question 6

You have a Power BI dataset that uses a DirectQuery connection to Azure Synapse Analytics. Users report that the report is slow. You need to improve query performance without changing the data source. What should you do?

Accepted Answer

Reduce the number of visuals on each report page.. In DirectQuery mode, every visual generates one or more queries that are pushed down to Azure Synapse, so the number of visuals on a page directly multiplies the query load and round-trip latency. Reducing the number of visuals per page lowers the number of concurrent queries sent to the source, which is the only lever available when the data source itself cannot be changed. This is a documented Power BI performance optimization for DirectQuery datasets.

Answer

Reduce the cardinality of calculated measures.

Answer

Disable row-level security (RLS) on the dataset.

Answer

Increase the scheduled refresh frequency.

Question 7

You have a Power BI report that uses a dataset with row-level security (RLS) roles. You need to verify that a specific user sees only the data they are supposed to see. What is the most efficient way to test this?

Accepted Answer

Use the 'View as' feature in the Power BI service or Desktop.. 'View as' allows you to impersonate a user and see exactly what they see. Option A is incorrect because manually checking the dataset is not efficient. Option C is incorrect because you cannot verify in the dataset settings. Option D is incorrect because checking the report after sharing is less efficient.

Answer

Run a DAX query in DAX Studio as the user.

Answer

Check the dataset settings in the workspace.

Answer

Share the report with the user and ask them to verify.

Question 8

Your organization uses Microsoft Purview to catalog Power BI assets. You need to ensure that sensitivity labels applied to Power BI datasets are automatically synced to Microsoft Purview. What must you configure?

Accepted Answer

Enable the 'Allow data discovery and classification' tenant setting and set up a Purview catalog scan.. The correct option is B: enabling the 'Allow data discovery and classification' tenant setting and setting up a Microsoft Purview catalog scan. This tenant setting in the Power BI admin portal permits Power BI to share metadata, including sensitivity labels, with Microsoft Purview, and the Purview scan of the Power BI tenant then ingests and syncs those labels into the catalog. Option A is wrong because publishing a sensitivity label policy to Power BI governs label availability and application, not the metadata sync to Purview. Option C is wrong because manually adding assets does not automate label synchronization. Option D is wrong because 'Automatically apply sensitivity labels' controls label inheritance/application in Power BI, not synchronization of labels to Microsoft Purview.

Answer

Create a sensitivity label policy in Microsoft Purview and publish it to Power BI.

Answer

Create a Microsoft Purview catalog and manually add Power BI assets.

Answer

Enable 'Automatically apply sensitivity labels' in the Power BI admin portal.

Question 9

Which TWO actions are required to enable Microsoft Copilot for Power BI in your tenant? (Choose two.)

Accepted Answer

Enable the 'Allow Copilot for Power BI' tenant setting.. Option B is correct because enabling Copilot for Power BI requires the tenant administrator to turn on the 'Allow Copilot for Power BI' setting in the Power BI admin portal, which is the prerequisite that makes the Copilot feature available across the tenant. Option D is correct because Copilot for Power BI is only available when the Fabric/Power BI capacity (F64 or higher, or Premium P1+) is provisioned in a supported Azure region, so the capacity must reside in a region where the Copilot service is offered. Option A is not required because Copilot for Power BI uses Microsoft's built-in Fabric/Copilot service rather than a customer-deployed custom Azure OpenAI model. Option C is not required because configuring Azure OpenAI Service in the tenant is not a prerequisite for Copilot for Power BI. Option E is not required because Copilot for Power BI is included with eligible Fabric capacities and does not require assigning a Microsoft Copilot for Microsoft 365 license to each user.

Answer

Deploy a custom Azure OpenAI model.

Answer

Configure Azure OpenAI Service in your tenant.

Answer

Assign a Microsoft Copilot for Microsoft 365 license to each user.

Question 10

Which THREE components are required for a Power BI deployment pipeline? (Choose three.)

Accepted Answer

A workspace assigned to a Premium capacity.. Option A is correct because Power BI deployment pipelines require the workspaces involved to be hosted on a Premium (or Fabric/PPU-equivalent) capacity, since the pipeline feature is only available with Premium capabilities. Option D is correct because the deployment pipeline itself must be created in the Power BI service, which is the object that links the stages and manages content promotion. Option E is correct because a deployment pipeline by definition consists of stages, and the default/mandatory configuration uses three stages: Development, Test, and Production. Option B is not required because deployment pipelines do not depend on an Azure DevOps repository for version control; that is a separate ALM practice. Option C is not required because a service principal is only needed for certain automated deployment scenarios, not as a core component of every deployment pipeline.

Answer

An Azure DevOps repository for version control.

Answer

A service principal for automated deployments.

Question 11

You need to ensure that only users with a specific security group in Microsoft Entra ID can access a Power BI dataset. The dataset is used in a shared workspace that also contains other datasets. What should you configure?

Accepted Answer

Move the dataset to a separate workspace and manage access via workspace roles.. The correct answer is A: move the dataset to a separate workspace and manage access via workspace roles. In Power BI, item-level access control for a single dataset is not possible within a shared workspace because workspace roles (Admin, Member, Contributor, Viewer) apply to all items in that workspace; isolating the dataset in its own workspace lets you grant the Entra ID security group the Viewer role so only those users can access that dataset. Option B is wrong because row-level security filters rows within a dataset for users who already have access, not who can access the dataset. Option C is wrong because dataset sharing grants broad Build/Read permissions to individual users or groups but does not provide the workspace-level role-based restriction described, and it does not isolate the dataset from other workspace items. Option D is wrong because app permissions control access to a published app's content, not to a dataset inside a shared workspace.

Answer

Configure row-level security (RLS) on the dataset to filter data based on the security group.

Answer

Use the 'Share' feature on the dataset to grant access to the security group.

Answer

Configure the app permissions to restrict access to the dataset.

Question 12

You manage a Power BI environment where users frequently create personal workspaces. The finance team requires that all financial reports be placed in a managed workspace to enforce data protection labels from Microsoft Purview. What should you implement to prevent users from saving financial reports to their personal workspaces?

Accepted Answer

Disable the 'Create workspaces (My Workspace)' tenant setting in the admin portal.. The correct option is D: disabling the 'Create workspaces (My Workspace)' tenant setting in the Power BI admin portal prevents users from creating or using personal workspaces, which is the only way to stop financial reports from being saved there and force them into managed workspaces governed by Microsoft Purview sensitivity labels. This tenant-level setting directly removes the personal workspace capability, so users must publish to managed workspaces where label enforcement applies. Options A, B, and C do not address personal workspace creation: requiring sensitivity labels (A) still allows saving to My Workspace, and disabling external sharing (B) or blocking external data sharing (C) only restrict external sharing, not internal personal workspace storage.

Answer

Require sensitivity labels on all financial datasets.

Answer

Disable the 'Allow sharing with external users' tenant setting.

Answer

Enable the 'Block external data sharing' setting in Microsoft Purview.

Question 13

You are deploying a Power BI solution for a multinational company. The data contains personally identifiable information (PII) subject to GDPR. You need to ensure that users outside the European Union cannot access the underlying data when viewing reports in the Power BI service. What should you implement?

Accepted Answer

Configure Power BI multi-geo and implement row-level security (RLS) based on user region.. Option A is correct because Power BI multi-geo lets you pin the dataset's storage and processing to a specific geography (for example, an EU region), and RLS based on user region ensures that users outside the EU only see data they are entitled to, keeping the underlying PII within the EU boundary. Multi-geo addresses the data-residency requirement of GDPR, while RLS enforces row-level filtering by region so non-EU users cannot access EU PII. Option B is wrong because classification labels and protection policies tag and protect content but do not control where the data is stored or processed. Option C is wrong because Conditional Access IP blocking restricts sign-in, not data residency, and does not prevent access to the underlying data for users who can authenticate. Option D is wrong because sensitivity labels restrict access to labeled content but do not by themselves enforce EU-only access or data residency.

Answer

Apply data classification labels to the datasets and configure protection policies.

Answer

Use Microsoft Entra ID Conditional Access policies to block access from non-EU IP addresses.

Answer

Use Microsoft Purview sensitivity labels to restrict access to EU users only.

Question 14

You have a Power BI workspace that contains a dataset with a live connection to Azure Analysis Services. You need to configure the dataset so that when a user views a report in the Power BI service, the underlying data is queried from the Azure Analysis Services model using the user's identity. What should you configure in the Power BI dataset settings?

Accepted Answer

Configure the 'Effective identity' settings on the dataset.. The correct option is D: Configure the 'Effective identity' settings on the dataset. For a Power BI dataset using a live connection to Azure Analysis Services, you configure the dataset's data source credentials in the Power BI service and set the Effective identity so that queries to the Azure Analysis Services model are executed under the identity of the user viewing the report, enabling per-user authentication and authorization against the AAS model. Option A is not the mechanism here because SSO is enabled through the data source credentials/effective identity configuration rather than a standalone dataset toggle. Option B is not a valid Power BI dataset authentication setting for this scenario. Option C is incorrect because RLS roles defined in Power BI Desktop do not apply to a live-connected dataset; RLS for AAS is defined and enforced in the Azure Analysis Services model itself.

Answer

Enable single sign-on (SSO) for the dataset.

Answer

Set the authentication method to 'Use current user's credentials'.

Answer

Define row-level security (RLS) roles in Power BI Desktop.

Question 15

You need to ensure that only members of the 'Sales' security group can edit reports in the 'Sales Reports' workspace. The workspace currently has four members: three from Sales and one from Marketing. What should you do?

Accepted Answer

Add the Sales security group as a workspace Admin and remove the Marketing user.. Adding the Sales security group as a workspace Admin grants all its members edit rights, and removing the Marketing user ensures only Sales can edit, satisfying the requirement. Workspace roles in Power BI are Admin, Member, Contributor, and Viewer, and Admin/Member/Contributor can edit content, so the Sales group must hold one of those roles while the Marketing user is removed. This is the cleanest way to enforce group-based edit access.

Answer

Configure the workspace to allow only specific users to edit by using the 'Restrict editing' option.

Answer

Publish the reports to a Power BI app and grant the Sales group 'Build' permissions.

Answer

Assign the Sales security group the 'Contributor' role and keep the Marketing user as 'Member'.