PL-300 Manage and secure Power BI Practice Test 3 — 15 Questions

Question 1

You need to prevent users from sharing Power BI reports with people outside your organization. What should you configure in the Power BI admin portal?

Accepted Answer

Disable the 'Share content with external users' setting.. The correct option is A: Disable the 'Share content with external users' setting. This tenant-level setting in the Power BI admin portal specifically controls whether users can share reports and dashboards with recipients outside the organization, so disabling it directly prevents external sharing. Option B ('Export to Excel') only restricts exporting data to Excel files and does not stop sharing with external users. Option C ('Publish to web') blocks public anonymous embedding via public URLs, but it does not govern authenticated sharing with external users. Option D (email subscriptions) only affects scheduled email delivery and is unrelated to external sharing controls.

Answer

Disable the 'Export to Excel' setting.

Answer

Disable the 'Publish to web' setting.

Answer

Disable the 'Allow users to create email subscriptions' setting.

Question 2

Your organization uses Power BI Premium with a shared capacity. You need to ensure that a specific workspace's data stays in the European region. Which TWO actions should you take? (Choose two.)

Accepted Answer

Create a Power BI Premium capacity in the European region.. Option B is correct because data residency in Power BI is determined by the region of the Premium capacity that hosts the content; creating a Power BI Premium capacity in the European region ensures the workspace's data is stored and processed there. Option D is correct because a workspace must actually be assigned to that European Premium capacity for its datasets to reside in Europe; creating the capacity alone does not move existing content. Option A is not correct because the tenant's default geographic region only affects where new tenants' default capacity is provisioned and does not relocate an existing shared-capacity workspace. Option C is not correct because Power BI does not provide a per-dataset 'data residency' setting in dataset settings; residency follows the hosting capacity. Option E is not correct because Microsoft Purview sensitivity labels with encryption protect data confidentiality but do not control or change its geographic storage location.

Answer

Configure the default geographic region for the tenant to Europe.

Answer

Set the data residency option in the dataset settings to Europe.

Answer

Apply a Microsoft Purview sensitivity label with encryption to the datasets.

Question 3

You need to restrict access to a Power BI report that contains sensitive financial data. The report is published to a workspace. Which THREE actions can you take to control access? (Choose three.)

Accepted Answer

Implement row-level security (RLS) to filter data based on user identity.. Option C is correct because row-level security (RLS) in Power BI, defined via DAX filter expressions on roles in the semantic model, restricts which rows each user can see based on their identity, which is essential for sensitive financial data. Option D is correct because sharing the report directly grants specific users access to that report (via the Share feature, which manages permissions on the report item) without giving them broader workspace access, thereby controlling who can view it. Option E is correct because assigning users the Viewer role in the workspace grants read-only access to the workspace's reports and dashboards while preventing them from editing content or managing the workspace, which is an appropriate way to control access. Option A is not a valid access control because disabling 'Export to Excel' only limits data exfiltration via export, not who can open or view the report. Option B is not correct in this context because sensitivity labels (from Microsoft Purview) classify and protect content with encryption/policies, but they are not the mechanism for granting or restricting report access to specific users in a workspace.

Answer

Disable the 'Export to Excel' setting for the report.

Answer

Apply a sensitivity label that restricts access to the report.

Question 4

Refer to the exhibit. You run a PowerShell script to list workspaces and their users. You need to ensure that only members of the sales security group can access the Sales workspace. What should you do?

Accepted Answer

Remove the individual users (user1 and user2) from the Sales workspace.. The correct action is to remove the individual users (user1 and user2) from the Sales workspace (option D), because access to a Power BI workspace is granted through workspace roles, and any user assigned a role such as Admin, Member, Contributor, or Viewer can access the workspace regardless of security group membership. To ensure that only members of the sales security group can access the Sales workspace, you must eliminate the direct role assignments of user1 and user2, then grant access solely via the sales security group. Option A is irrelevant because restoring the Marketing workspace and moving reports does not affect Sales workspace permissions. Option B would grant the sales security group access but would not restrict the existing individual users, so it fails the requirement. Option C changes the sales security group's role to Viewer, which still leaves user1 and user2 with access and also may not match the intended permission level.

Answer

Restore the Marketing workspace and move the reports there.

Answer

Add the sales security group as a Contributor to the Sales workspace.

Answer

Change the sales security group's role to Viewer.

Question 5

Refer to the exhibit. You are reviewing the configuration of a Power BI dataset with row-level security (RLS). A user named 'user@contoso.com' reports that they can see all data when they should see only data for their region. What is the most likely cause?

Accepted Answer

The 'effectiveIdentity' is set to the user's email, bypassing RLS.. The 'effectiveIdentity' property in the exhibit is set to 'user@contoso.com', which overrides RLS and allows that user to see all data. In Power BI, the effective identity is used for testing purposes; in production, it should not be set for a specific user if RLS is intended. Option B is incorrect because the exhibit shows RLS roles are defined, so missing mapping is not the issue. Option C is incorrect because roles exist. Option D is incorrect because the user is likely assigned to a role, but the effective identity overrides it.

Answer

The RLS roles are missing the 'SalesRole' mapping to the dataset.

Answer

The dataset does not have any RLS roles defined.

Answer

The user is not assigned to any RLS role.

Question 6

You are configuring row-level security (RLS) for a Power BI dataset. The sales data includes a 'Region' column. You want users in the 'Sales Managers' group to see data only for their assigned region, which is stored in a separate mapping table. You create the following DAX filter: [Region] = LOOKUPVALUE(EmployeeRegion[Region], EmployeeRegion[UserPrincipalName], USERPRINCIPALNAME()). When testing, a user in 'Sales Managers' sees no data. What is the most likely issue?

Accepted Answer

The LOOKUPVALUE function returns multiple values for the user, causing an error.. The correct answer is A: LOOKUPVALUE returns multiple values for the user, causing an error. In this scenario, if the EmployeeRegion mapping table contains more than one row matching the user's UserPrincipalName (for example, a user assigned to multiple regions), LOOKUPVALUE cannot return a single scalar result and the RLS filter fails, so the user sees no data. Option B is wrong because USERPRINCIPALNAME is fully supported in RLS filters and is commonly used for dynamic row-level security. Option C is wrong because the filter syntax is valid; CALCULATE is not required for a simple boolean RLS predicate. Option D is wrong because RLS works in Power BI Pro and Premium capacities, not only Premium.

Answer

The USERPRINCIPALNAME function is not supported in RLS filters.

Answer

The DAX filter syntax is incorrect; it should use CALCULATE.

Answer

RLS requires a Premium capacity license.

Question 7

A Power BI report in a shared workspace needs to be embedded in a SharePoint Online page. Users accessing the page must see the report without signing in again. Which capability is required?

Accepted Answer

Use the 'Embed for SharePoint' option in Power BI.. The correct option is A, the 'Embed for SharePoint' option in Power BI, because it is specifically designed to embed a report into a SharePoint Online page while honoring the signed-in user's existing Microsoft 365 identity, so users see the report without a second sign-in. This option uses the SharePoint-integrated embedding flow and respects workspace permissions and Power BI security. Option B, 'Embed for your organization', is for internal web apps and requires the app to handle authentication, so it does not provide the seamless SharePoint sign-in experience. Option C, sharing by email, does not embed the report in the page, and option D, Publish to web, creates an anonymous public iframe that bypasses authentication and is unsuitable for a shared workspace with authenticated users.

Answer

Use the 'Embed for your organization' option.

Answer

Share the report directly with each user via email.

Answer

Publish the report to the web and embed the iframe.

Question 8

Your organization uses Microsoft Entra ID for identity management. You have created a Power BI app workspace and assigned users to the Viewer role. However, some viewers report that they cannot export report data to Excel. What is the most likely reason?

Accepted Answer

The 'Allow viewers to export data' setting is disabled in the workspace.. The 'Export data' permission is controlled by the app workspace setting 'Allow viewers to export data', which is disabled by default. Option A is wrong because Viewer role can generally view reports. Option C is wrong because licensing affects creation, not basic export. Option D is wrong because Entra ID settings do not block export at the workspace level.

Answer

Viewers do not have a Power BI Pro license.

Answer

The Viewer role does not have permission to view reports.

Answer

Microsoft Entra ID conditional access policies block data export.

Question 9

You are managing a Power BI deployment that uses Premium capacity. Users report that reports are loading slowly during peak hours. You need to identify whether the capacity is being overused. Which metric should you monitor?

Accepted Answer

CPU high time percentage.. CPU over-utilization is a key indicator of capacity stress in Premium. The 'CPU high' metric directly reflects processing load. Option A is wrong because query execution time is a result, not a direct capacity metric. Option B is wrong because memory usage is important but CPU is more directly tied to responsiveness. Option D is wrong because dataset size is a design factor, not a real-time capacity metric.

Answer

Memory usage percentage.

Answer

Total dataset size in the workspace.

Answer

Average query execution time.

Question 10

You are troubleshooting a Power BI DirectQuery model connected to Azure Synapse Analytics. The report shows stale data even though the underlying database is updated hourly. What should you check first?

Accepted Answer

Whether the report has 'Disable caching' enabled in the dataset settings.. In a DirectQuery model, data is not stored in Power BI; each query goes to the source. However, Power BI may cache query results at the report level, which can cause stale data. The 'Disable caching' option, when enabled, forces fresh queries to the source, ensuring up-to-date data. Option A is incorrect because Import mode is not used here; DirectQuery mode is specified. Option B is incorrect because RLS permissions affect data visibility, not freshness. Option D is incorrect because scheduled refresh is only applicable to Import models, not DirectQuery.

Answer

Whether the dataset is using Import mode instead of DirectQuery.

Answer

Whether the user has RLS permissions that filter data incorrectly.

Answer

Whether the dataset is configured for scheduled refresh.

Question 11

Which TWO actions can help enforce data security in Power BI when using Microsoft Entra ID?

Accepted Answer

Apply Conditional Access policies to require multi-factor authentication.. Option A is correct because Conditional Access policies in Microsoft Entra ID can enforce multi-factor authentication (MFA) for users accessing Power BI, ensuring that only authenticated users with the required authentication strength can sign in and access data. Option B is correct because row-level security (RLS) in the Power BI dataset restricts data at the row level based on the user's identity, so users only see the data they are authorized to view, directly enforcing data security within reports and dashboards. Option C is not correct because sensitivity labels in Power BI help classify and protect data (for example, by applying encryption or restricting export), but they do not by themselves restrict access to reports; access control is handled by workspace roles and sharing permissions. Option D is not correct because sharing reports via direct link with specific users is a sharing mechanism, not a security enforcement action, and it does not add authentication or authorization controls beyond existing permissions. Option E is not correct because Microsoft Intune app protection policies protect data on managed devices and mobile apps, but they are not a Power BI or Entra ID feature for enforcing data security within the Power BI service itself.

Answer

Configure sensitivity labels to restrict access to reports.

Answer

Share reports via direct link with specific users.

Answer

Use Microsoft Intune app protection policies to prevent data leakage.

Question 12

Which THREE settings should you verify in the Power BI tenant admin portal to ensure that external users (guests) can access a published app?

Accepted Answer

Invite external users to your organization via Microsoft Entra ID.. Option A is correct because guest access to a Power BI app requires the external user to exist as a guest object in the tenant, which is created by inviting them via Microsoft Entra ID (B2B collaboration); without this invitation, the guest cannot be authenticated or granted access. Option B is correct because the Power BI tenant setting 'Allow sharing with external users' (Export and sharing settings) must be enabled so that content such as apps can be shared with guests outside the organization. Option C is correct because the tenant setting 'Allow Microsoft Entra ID (Microsoft Entra ID) external identities to access the Power BI service' must be enabled; otherwise guests are blocked from signing in to and consuming Power BI content even if they were invited. Option D is not required because 'Show external users in lists of suggested people' only affects discoverability in people pickers and does not control whether guests can access a published app. Option E is not required because 'Allow external users to edit and manage content in the organization' grants guests authoring/administrative capabilities, which is unnecessary for simply accessing a published app and is broader than the scenario requires.

Answer

Show external users in lists of suggested people.

Answer

Allow external users to edit and manage content in the organization.

Question 13

Refer to the exhibit. You are setting up row-level security (RLS) for a Power BI dataset. The JSON snippet shows the role definition. A user reports that they see no data when they view the report. What is the most likely cause?

Accepted Answer

The LOOKUPVALUE function requires a relationship between tables.. LOOKUPVALUE is a DAX scalar function that retrieves a value from a column based on search criteria; it does not require (or create) a table relationship. In RLS, a common cause of no data is that the LOOKUPVALUE returns blank (e.g., because the current user's name doesn't match any value in the lookup table), causing the filter condition to evaluate to FALSE for all rows. The role name 'RegionManager' is not reserved, CALCULATE is not required for RLS filter syntax, and using the SalesPerson column is not inherently the issue. Thus, none of the provided options correctly describe the cause, making the question invalid as written.

Answer

The filter syntax is incorrect; it should use CALCULATE.

Answer

The role name 'RegionManager' is reserved.

Answer

The 'SalesPerson' column should be used in the filter.

Question 14

Refer to the exhibit. A Power BI administrator runs a PowerShell script to get an access token for the Power BI API. The output shows a token with claims. Based on the token, which authentication method was used?

Accepted Answer

Password-based authentication. Password-based authentication, because the token's claims indicate the resource owner password credentials (ROPC) grant was used, where the user's username and password are submitted directly to the token endpoint. This flow is identifiable by claims such as 'amr' containing 'pwd' and the absence of interactive or device-code-specific claims. MFA (A) would show an authentication method reference like 'mfa' in the amr claim, which is not present. Device code flow (B) would include claims tied to a device code session and typically an 'amr' value of 'device_code' or similar, not 'pwd'. Certificate-based authentication (D) would involve a client assertion or certificate thumbprint and an 'amr' value such as 'pop' or 'cert', which is not shown.

Answer

Multi-factor authentication (MFA)

Answer

Device code flow

Answer

Certificate-based authentication

Question 15

A company uses Power BI Premium per capacity. A report developer needs to share a report with external users who do not have Power BI licenses. The report uses a live connection to an Azure Analysis Services model. What should the admin configure to allow external access?

Accepted Answer

Configure Bring Your Own Tenant (BYOT) with Azure B2B.. The correct option is B: Configure Bring Your Own Tenant (BYOT) with Azure B2B. In a Power BI Premium per capacity scenario where the report uses a live connection to Azure Analysis Services, external users without Power BI licenses can be granted access by having them authenticate as Microsoft Entra B2B guest users in the capacity's tenant, which BYOT enables by letting them use their own tenant credentials while the hosting tenant controls access. This is the supported pattern for cross-tenant external sharing with Premium capacity and AAS live connections. Option A is wrong because Publish to web creates an anonymous public embed and does not support live-connected AAS models or authenticated external access. Option C is insufficient because simply configuring B2B guests in the same tenant does not address the BYOT cross-tenant authentication requirement for external users. Option D is wrong because sharing directly with external email addresses requires the recipients to have Power BI licenses and does not work for unlicensed external users.

Answer

Enable Publish to web for the report.

Answer

Configure Azure B2B guest users in the same tenant.

Answer

Share the report directly with external email addresses.