PL-300 Manage and secure Power BI Practice Test 3 — 15 Questions

Question 1

You have a Power BI report that uses a dataset with row-level security (RLS) roles. You need to verify that a specific user sees only the data they are supposed to see. What is the most efficient way to test this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'View as' feature in the Power BI service or Desktop.. 'View as' allows you to impersonate a user and see exactly what they see. Option A is incorrect because manually checking the dataset is not efficient. Option C is incorrect because you cannot verify in the dataset settings. Option D is incorrect because checking the report after sharing is less efficient.

Answer

Run a DAX query in DAX Studio as the user.

Answer

Check the dataset settings in the workspace.

Answer

Share the report with the user and ask them to verify.

Question 2

Your organization uses Microsoft Purview to catalog Power BI assets. You need to ensure that sensitivity labels applied to Power BI datasets are automatically synced to Microsoft Purview. What must you configure?

Accepted Answer

Enable the 'Allow data discovery and classification' tenant setting and set up a Purview catalog scan.. To automatically sync sensitivity labels applied in Power BI to Microsoft Purview, you need to enable the 'Allow data discovery and classification' tenant setting in the Power BI admin portal, and also configure a Purview catalog scan to discover Power BI assets. This integration ensures that labels applied in Power BI are reflected in Purview's catalog. Option A is incorrect: Creating a sensitivity label policy in Purview and publishing it to Power BI is about applying labels from Purview to Power BI, not syncing labels from Power BI back to Purview. Option C is incorrect: Manually adding Power BI assets to a Purview catalog does not automate the sync of sensitivity labels; it only catalogs the assets. Option D is incorrect: The 'Automatically apply sensitivity labels' setting in the Power BI admin portal applies labels based on rules, but does not sync existing labels to Purview; it is about automatic labeling within Power BI itself.

Answer

Create a sensitivity label policy in Microsoft Purview and publish it to Power BI.

Answer

Create a Microsoft Purview catalog and manually add Power BI assets.

Answer

Enable 'Automatically apply sensitivity labels' in the Power BI admin portal.

Question 3

Which TWO actions are required to enable Microsoft Copilot for Power BI in your tenant? (Choose two.)

Accepted Answer

Enable the 'Allow Copilot for Power BI' tenant setting.. Options B and D are correct. To enable Microsoft Copilot for Power BI, you must enable the 'Allow Copilot for Power BI' tenant setting and ensure your Power BI capacity is in a supported region. Option A is incorrect because you do not need to deploy a custom Azure OpenAI model; Microsoft provides the AI models. Option C is incorrect because configuring Azure OpenAI Service is not required; Copilot uses Microsoft's managed models. Option E is incorrect because a separate Copilot for Microsoft 365 license is not required; Copilot for Power BI is included with Premium capacities.

Answer

Deploy a custom Azure OpenAI model.

Answer

Configure Azure OpenAI Service in your tenant.

Answer

Assign a Microsoft Copilot for Microsoft 365 license to each user.

Question 4

Which THREE components are required for a Power BI deployment pipeline? (Choose three.)

Accepted Answer

A workspace assigned to a Premium capacity.. A Power BI deployment pipeline requires three components: a workspace assigned to a Premium capacity (option A), a deployment pipeline created in the Power BI service (option D), and at least three stages (Development, Test, Production) (option E). An Azure DevOps repository (option B) is not required because deployment pipelines are native to Power BI and do not need external version control. A service principal (option C) is optional for automation but not a required component.

Answer

An Azure DevOps repository for version control.

Answer

A service principal for automated deployments.

Question 5

You need to ensure that only users with a specific security group in Microsoft Entra ID can access a Power BI dataset. The dataset is used in a shared workspace that also contains other datasets. What should you configure?

Accepted Answer

Move the dataset to a separate workspace and manage access via workspace roles.. To restrict access to a specific dataset within a shared workspace without affecting other datasets, you must move the dataset to its own workspace and control access via workspace roles. Workspace roles (Admin, Member, Contributor, Viewer) apply to the entire workspace, so if other datasets are present, you cannot restrict access to only one dataset using workspace roles alone. Therefore, placing the dataset in a separate workspace ensures only users with the appropriate security group have access through workspace roles. Option B is incorrect because row-level security (RLS) filters data but does not control access to the dataset itself; it restricts what data users see within the dataset. Option C is incorrect because the 'Share' feature is for sharing reports or dashboards, not datasets directly; sharing does not grant dataset access in the same way. Option D is incorrect because app permissions control access to the app content, not directly to the dataset.

Answer

Configure row-level security (RLS) on the dataset to filter data based on the security group.

Answer

Use the 'Share' feature on the dataset to grant access to the security group.

Answer

Configure the app permissions to restrict access to the dataset.

Question 6

You manage a Power BI environment where users frequently create personal workspaces. The finance team requires that all financial reports be placed in a managed workspace to enforce data protection labels from Microsoft Purview. What should you implement to prevent users from saving financial reports to their personal workspaces?

Accepted Answer

Disable the 'Create workspaces (My Workspace)' tenant setting in the admin portal.. Disabling the 'Create workspaces (My Workspace)' tenant setting in the Power BI admin portal prevents users from creating personal workspaces, forcing them to use managed workspaces. Option A is wrong because sensitivity labels apply to content but do not restrict where reports are saved. Option B is wrong because disabling external user sharing does not affect workspace creation. Option C is wrong because the 'Block external data sharing' setting is unrelated to workspace creation.

Answer

Require sensitivity labels on all financial datasets.

Answer

Disable the 'Allow sharing with external users' tenant setting.

Answer

Enable the 'Block external data sharing' setting in Microsoft Purview.

Question 7

Your organization uses Microsoft Defender for Cloud Apps to monitor Power BI activity. You need to receive an alert when a user exports a report with a sensitivity label of 'Highly Confidential' from Power BI service. What should you configure?

Accepted Answer

Create an activity policy in Microsoft Defender for Cloud Apps.. Microsoft Defender for Cloud Apps allows you to create an activity policy that triggers alerts based on specific activities, such as exporting reports with specific sensitivity labels. Option A is incorrect because Microsoft 365 compliance alerts are not designed for Power BI-specific data export events; they are for compliance policies. Option B is incorrect because while audit logs and Sentinel can be used, the question specifically asks for using Defender for Cloud Apps, which provides built-in alerting without additional setup. Option C is incorrect because protection policies block exports but do not generate alerts; the requirement is to receive an alert.

Answer

Set up a Microsoft 365 compliance alert for data export events.

Answer

Enable audit logging in Power BI and configure alerts in Microsoft Sentinel.

Answer

Apply a protection policy in Microsoft Purview that blocks export for 'Highly Confidential' labels.

Question 8

You are deploying a Power BI solution for a multinational company. The data contains personally identifiable information (PII) subject to GDPR. You need to ensure that users outside the European Union cannot access the underlying data when viewing reports in the Power BI service. What should you implement?

Accepted Answer

Configure Power BI multi-geo and implement row-level security (RLS) based on user region.. Power BI multi-geo allows you to deploy content in specific Azure regions, and when combined with row-level security (RLS) that filters data based on user region (e.g., non-EU users), you can prevent users outside the EU from seeing PII in underlying data. Option B is incorrect because data classification labels and protection policies control actions like export or sharing, but do not restrict data access within reports. Option C is incorrect because Conditional Access blocks access to the Power BI service itself (e.g., sign-in), but does not control data visibility within a report after authentication. Option D is incorrect because sensitivity labels enforce protection and governance, but cannot block data access by geographic region.

Answer

Apply data classification labels to the datasets and configure protection policies.

Answer

Use Microsoft Entra ID Conditional Access policies to block access from non-EU IP addresses.

Answer

Use Microsoft Purview sensitivity labels to restrict access to EU users only.

Question 9

You have a Power BI workspace that contains a dataset with a live connection to Azure Analysis Services. You need to configure the dataset so that when a user views a report in the Power BI service, the underlying data is queried from the Azure Analysis Services model using the user's identity. What should you configure in the Power BI dataset settings?

Accepted Answer

Configure the 'Effective identity' settings on the dataset.. The 'Effective identity' setting in the Power BI dataset configuration allows you to pass the viewing user's identity through to Azure Analysis Services. This ensures that the underlying data is queried using the user's own credentials, enabling row-level security (RLS) defined in the Analysis Services model. Option A is incorrect because single sign-on (SSO) is typically used for sources like SQL Server or SAP HANA, not for live connections to Azure Analysis Services; SSO does not apply here. Option B is incorrect because 'Use current user's credentials' is not a valid setting for live connections; it is used for DirectQuery mode with certain sources. Option C is incorrect because row-level security for live connections is defined and enforced in Azure Analysis Services, not in Power BI Desktop. Defining RLS roles in Power BI Desktop would have no effect when using a live connection.

Answer

Enable single sign-on (SSO) for the dataset.

Answer

Set the authentication method to 'Use current user's credentials'.

Answer

Define row-level security (RLS) roles in Power BI Desktop.

Question 10

Your organization uses Power BI Premium capacity. You notice that reports are slow during peak hours. You need to identify which workspaces are consuming the most CPU resources on the capacity. What should you use?

Accepted Answer

Install and review the Power BI Premium Capacity Metrics app.. The Power BI Premium Capacity Metrics app provides detailed metrics on CPU consumption per workspace, helping identify resource-intensive workspaces. Option A is wrong because Power BI Desktop's Performance Analyzer analyzes query performance within a single report, not capacity-level CPU usage. Option C is wrong because diagnostic logging in Azure Monitor is used for auditing and troubleshooting, not for real-time capacity metrics per workspace. Option D is wrong because the Capacity settings in the admin portal show overall capacity health and settings, but not per-workspace CPU consumption.

Answer

Open the dataset in Power BI Desktop and view the performance analyzer.

Answer

Enable diagnostic logging in Azure Monitor for the capacity.

Answer

Check the 'Capacity settings' in the Power BI admin portal.

Question 11

You need to prevent users from sharing Power BI reports with people outside your organization. What should you configure in the Power BI admin portal?

Accepted Answer

Disable the 'Share content with external users' setting.. The 'Share content with external users' tenant setting controls whether users can share reports and dashboards with external users. Disabling this setting prevents external sharing. Option B is wrong because 'Export to Excel' is a separate setting that does not affect external sharing. Option C is wrong because 'Publish to web' allows public embedding, not external sharing within the organization. Option D is wrong because 'Allow users to create email subscriptions' does not control external sharing.

Answer

Disable the 'Export to Excel' setting.

Answer

Disable the 'Publish to web' setting.

Answer

Disable the 'Allow users to create email subscriptions' setting.

Question 12

You have a Power BI dataset that uses DirectQuery to a SQL Server data warehouse. You need to ensure that when users view reports, they see only data relevant to their department. The data warehouse contains a 'Department' column. What should you implement?

Accepted Answer

Define row-level security (RLS) roles in Power BI Desktop and assign users.. Row-level security (RLS) allows filtering data based on the user's identity. By defining roles in Power BI Desktop with a DAX filter like 'Department = USERPRINCIPALNAME()', users see only their department's data. Option A is incorrect because passing the user's identity via data source credentials does not filter rows; it only authenticates. Option B is incorrect because creating separate datasets is inefficient and does not scale. Option C is incorrect because object-level security (OLS) controls access to columns or tables, not rows.

Answer

Configure the data source credentials to pass the user's identity.

Answer

Create separate datasets for each department and grant access accordingly.

Answer

Implement object-level security (OLS) on the 'Department' column.

Question 13

Your organization uses Power BI Premium with a shared capacity. You need to ensure that a specific workspace's data stays in the European region. Which TWO actions should you take? (Choose two.)

Accepted Answer

Create a Power BI Premium capacity in the European region.. Creating a Premium capacity in the European region ensures that workspaces assigned to that capacity store data in Europe. Moving the workspace to that capacity enforces data residency for that workspace. Option A is incorrect because configuring the default geographic region at the tenant level does not guarantee data residency for a specific workspace; it only sets the default for new capacities. Option C is incorrect because Power BI does not have a per-dataset data residency setting. Option E is incorrect because sensitivity labels control access and classification, not data residency.

Answer

Configure the default geographic region for the tenant to Europe.

Answer

Set the data residency option in the dataset settings to Europe.

Answer

Apply a Microsoft Purview sensitivity label with encryption to the datasets.

Question 14

You need to restrict access to a Power BI report that contains sensitive financial data. The report is published to a workspace. Which THREE actions can you take to control access? (Choose three.)

Accepted Answer

Implement row-level security (RLS) to filter data based on user identity.. Options C, D, and E are correct. Row-level security (RLS) filters data based on user identity, sharing the report directly grants access to specific users, and assigning users to the workspace with Viewer role allows them to view the report. Option A is incorrect because disabling 'Export to Excel' does not control access to the report; it only prevents data export. Option B is incorrect because sensitivity labels classify data but do not control access.

Answer

Disable the 'Export to Excel' setting for the report.

Answer

Apply a sensitivity label that restricts access to the report.

Question 15

Refer to the exhibit. You run a PowerShell script to list workspaces and their users. You need to ensure that only members of the sales security group can access the Sales workspace. What should you do?

Accepted Answer

Remove the individual users (user1 and user2) from the Sales workspace.. The exhibit shows that the sales security group is already an Admin of the Sales workspace. However, there are individual users (user1 and user2) with Member and Contributor roles. To ensure only members of the sales security group can access the workspace, these individual users must be removed. Option A is incorrect because restoring the Marketing workspace does not affect access to the Sales workspace. Option B is incorrect because the sales security group already has Admin role, which includes Contributor permissions and more. Option C is incorrect because changing the security group's role to Viewer would reduce its permissions, but the main issue is the presence of individual users, not the security group's role.

Answer

Restore the Marketing workspace and move the reports there.

Answer

Add the sales security group as a Contributor to the Sales workspace.

Answer

Change the sales security group's role to Viewer.