PL-300 Manage and secure Power BI Practice Test 3 — 15 Questions

Question 1

You have a Power BI workspace that contains a report connected to an Azure Analysis Services (AAS) model. The data source uses Single Sign-On (SSO) with Microsoft Entra ID. When users access the report, they see an error that the data cannot be refreshed. What is the most likely cause?

Accepted Answer

The dataset is configured in Import mode.. Option B is correct because SSO requires the dataset to use DirectQuery or Live Connection mode; Import mode does not support SSO. Option A is incorrect because the data source credentials are passed via SSO, not stored. Option C is incorrect because row-level security is applied at query time, not during connection. Option D is incorrect because SSO uses the user's identity, not a service principal.

Answer

Row-level security (RLS) is not configured on the AAS model.

Answer

The data source credentials are stored in the dataset.

Answer

The service principal used for authentication has expired.

Question 2

You need to ensure that only members of a specific security group can view a Power BI dashboard. The dashboard is in a shared workspace. What should you do?

Accepted Answer

Publish the dashboard as an app and set the security group as the audience.. Option C is correct because Power BI allows restricting access to a dashboard by using App permissions and audience targeting. Option A is incorrect because workspace roles grant access to all content in the workspace, not specific items. Option B is incorrect because sharing gives access to the dashboard but does not restrict to a security group automatically. Option D is incorrect because row-level security filters data, not the dashboard visibility.

Answer

Assign the security group the Viewer role on the workspace.

Answer

Configure row-level security on the underlying dataset to filter by user.

Answer

Share the dashboard directly with the security group.

Question 3

Your organization uses Microsoft Purview Information Protection to label sensitive data in Power BI datasets. You need to ensure that when a report is exported to Excel, the sensitivity label is automatically applied. What should you configure?

Accepted Answer

Ensure the dataset has a sensitivity label and that the export inherits the label.. Option D is correct because sensitivity labels are inherited from the dataset to downstream exports when the data source inherits the label. Option A is incorrect because labels are not applied via Power BI admin settings directly. Option B is incorrect because labels are not applied at export time; they are part of the data protection. Option C is incorrect because labels are automatically applied based on the dataset's label, not configured individually on each report.

Answer

Use data loss prevention (DLP) policies in Microsoft Purview.

Answer

Set a default sensitivity label on the report.

Answer

Enable 'Apply sensitivity labels to exported data' in the Power BI admin portal.

Question 4

You have a Power BI capacity that is frequently hitting its memory limits, causing refreshes to fail. You need to reduce memory usage without increasing capacity size. What should you do?

Accepted Answer

Reduce the number of parallel data refresh operations.. Option A is correct because reducing the number of parallel data refreshes reduces memory pressure. Option B is incorrect because increasing scheduled refresh frequency increases memory usage. Option C is incorrect because removing RLS does not reduce memory usage significantly. Option D is incorrect because increasing the eviction time keeps more data in memory, worsening the issue.

Answer

Increase the eviction time for unused data.

Answer

Remove row-level security (RLS) from the dataset.

Answer

Increase the frequency of scheduled refreshes.

Question 5

You manage a Power BI environment where users create reports using data from Azure SQL Database. You need to enforce that all data sources use Single Sign-On (SSO) with Microsoft Entra ID. What should you do?

Accepted Answer

In the Power BI admin portal, block authentication methods other than OAuth2.. Option D is correct because you can block other authentication methods via tenant settings in the Power BI admin portal. Option A is incorrect because SSO is configured per data source, not globally in a security group. Option B is incorrect because the 'Allow data sources to use SSO' setting enables SSO but does not block other methods. Option C is incorrect because you cannot block authentication methods in the dataset itself.

Answer

Configure the dataset to use SSO in the Power BI service.

Answer

Enable the 'Allow data sources to use SSO' tenant setting.

Answer

Create a security group for SSO-enabled data sources and assign it to the workspace.

Question 6

You have a Power BI dataset that uses a DirectQuery connection to Azure Synapse Analytics. Users report that the report is slow. You need to improve query performance without changing the data source. What should you do?

Accepted Answer

Reduce the number of visuals on each report page.. Option C is correct because reducing the number of visuals on a page reduces the number of queries sent to the data source. Option A is incorrect because increasing scheduled refresh does not affect DirectQuery. Option B is incorrect because disabling RLS would not improve performance significantly. Option D is incorrect because reducing the cardinality of measures does not reduce the number of queries.

Answer

Reduce the cardinality of calculated measures.

Answer

Disable row-level security (RLS) on the dataset.

Answer

Increase the scheduled refresh frequency.

Question 7

You need to grant a user the ability to manage permissions on a Power BI workspace but not to view or edit the content. What minimum role should you assign?

Accepted Answer

Admin. Option D is correct because the Admin role allows managing permissions and membership but does not require viewing content. Option A is incorrect because Member can edit content. Option B is incorrect because Contributor can edit content. Option C is incorrect because Viewer can view content but cannot manage permissions.

Answer

Contributor

Answer

Viewer

Answer

Member

Question 8

You have a Power BI report that uses a dataset with row-level security (RLS) roles. You need to verify that a specific user sees only the data they are supposed to see. What is the most efficient way to test this?

Accepted Answer

Use the 'View as' feature in the Power BI service or Desktop.. Option B is correct because 'View as' allows you to impersonate a user and see exactly what they see. Option A is incorrect because manually checking the dataset is not efficient. Option C is incorrect because you cannot verify in the dataset settings. Option D is incorrect because checking the report after sharing is less efficient.

Answer

Run a DAX query in DAX Studio as the user.

Answer

Check the dataset settings in the workspace.

Answer

Share the report with the user and ask them to verify.

Question 9

Your organization uses Microsoft Purview to catalog Power BI assets. You need to ensure that sensitivity labels applied to Power BI datasets are automatically synced to Microsoft Purview. What must you configure?

Accepted Answer

Enable the 'Allow data discovery and classification' tenant setting and set up a Purview catalog scan.. Option C is correct because the integration between Power BI and Microsoft Purview requires enabling the 'Allow data discovery and classification' tenant setting and configuring the Purview catalog to scan Power BI. Option A is incorrect because labels are not synced via the Power BI admin portal alone. Option B is incorrect because sensitivity label policies in Purview do not automatically sync to Power BI. Option D is incorrect because catalog creation does not sync labels.

Answer

Create a sensitivity label policy in Microsoft Purview and publish it to Power BI.

Answer

Create a Microsoft Purview catalog and manually add Power BI assets.

Answer

Enable 'Automatically apply sensitivity labels' in the Power BI admin portal.

Question 10

Which TWO actions are required to enable Microsoft Copilot for Power BI in your tenant? (Choose two.)

Accepted Answer

Enable the 'Allow Copilot for Power BI' tenant setting.. Options A and D are correct. Copilot for Power BI requires enabling the tenant setting 'Allow Copilot for Power BI' and ensuring that the capacity is in a supported region. Option B is incorrect because a separate Copilot license is not required; it is included with premium. Option C is incorrect because Microsoft 365 Copilot is not required. Option E is incorrect because Copilot uses Azure OpenAI, but you do not need to deploy it yourself.

Answer

Deploy a custom Azure OpenAI model.

Answer

Configure Azure OpenAI Service in your tenant.

Answer

Assign a Microsoft Copilot for Microsoft 365 license to each user.

Question 11

Which THREE components are required for a Power BI deployment pipeline? (Choose three.)

Accepted Answer

A workspace assigned to a Premium capacity.. Options A, B, and C are correct. A deployment pipeline requires a workspace assigned to a Premium capacity, at least three stages (dev, test, prod), and the pipeline must be created in the Power BI service. Option D is incorrect because a separate Azure DevOps repository is not required; deployment pipelines are native to Power BI. Option E is incorrect because a service principal is optional for automation, not required.

Answer

An Azure DevOps repository for version control.

Answer

A service principal for automated deployments.

Question 12

Which TWO methods can you use to share a Power BI report with external users who do not have a Power BI Pro license? (Choose two.)

Accepted Answer

Embed the report in a secure portal using 'Embed for your customers'.. Options A and D are correct. You can share a report by publishing to a public website (if allowed) or by embedding it in a secure portal using the 'Embed for your customers' option (requires Premium). Option B is incorrect because sharing via email requires the recipient to have a Pro license. Option C is incorrect because exporting to PDF does not provide interactive sharing. Option E is incorrect because exporting to Excel is not a sharing method.

Answer

Export the report to PDF and share the file.

Answer

Share directly via Power BI using the user's email address.

Answer

Export the report to Excel and attach it to an email.

Question 13

You need to ensure that only users with a specific security group in Microsoft Entra ID can access a Power BI dataset. The dataset is used in a shared workspace that also contains other datasets. What should you configure?

Accepted Answer

Move the dataset to a separate workspace and manage access via workspace roles.. Option B is correct because in Power BI, workspace-level roles (Admin, Member, Contributor, Viewer) control access to the entire workspace. To restrict access to a specific dataset within a shared workspace, you must use row-level security (RLS) or a separate workspace. Option A is wrong because app permissions control the app, not the dataset directly. Option C is wrong because sharing a report does not restrict dataset access. Option D is wrong because dataset-level permissions are not granularly configurable in the same way; RLS or separate workspace is required.

Answer

Configure row-level security (RLS) on the dataset to filter data based on the security group.

Answer

Use the 'Share' feature on the dataset to grant access to the security group.

Answer

Configure the app permissions to restrict access to the dataset.

Question 14

You manage a Power BI environment where users frequently create personal workspaces. The finance team requires that all financial reports be placed in a managed workspace to enforce data protection labels from Microsoft Purview. What should you implement to prevent users from saving financial reports to their personal workspaces?

Accepted Answer

Disable the 'Create workspaces (My Workspace)' tenant setting in the admin portal.. Option C is correct because the Power BI admin portal allows you to block the creation of personal workspaces, forcing users to use managed workspaces. Option A is wrong because sensitivity labels are applied to content but do not prevent saving to personal workspaces. Option B is wrong because tenant settings for sharing do not restrict workspace creation. Option D is wrong because the external data sharing setting is unrelated.

Answer

Require sensitivity labels on all financial datasets.

Answer

Disable the 'Allow sharing with external users' tenant setting.

Answer

Enable the 'Block external data sharing' setting in Microsoft Purview.

Question 15

Your organization uses Microsoft Defender for Cloud Apps to monitor Power BI activity. You need to receive an alert when a user exports a report with a sensitivity label of 'Highly Confidential' from Power BI service. What should you configure?

Accepted Answer

Create an activity policy in Microsoft Defender for Cloud Apps.. Option A is correct because Microsoft Defender for Cloud Apps allows you to create an activity policy that triggers alerts based on specific activities, such as exporting reports with specific sensitivity labels. Option B is wrong because Power BI audit logs can be monitored but require custom alerts via Sentinel or other tools; Defender for Cloud Apps provides built-in alerting. Option C is wrong because sensitivity labels themselves do not generate alerts. Option D is wrong because Microsoft 365 compliance alerts are separate and not focused on Power BI exports.

Answer

Set up a Microsoft 365 compliance alert for data export events.

Answer

Enable audit logging in Power BI and configure alerts in Microsoft Sentinel.

Answer

Apply a protection policy in Microsoft Purview that blocks export for 'Highly Confidential' labels.