PL-300 Manage and secure Power BI Practice Test 4 — 15 Questions

Question 1

A data analyst needs to ensure that a Power BI dataset used in a shared workspace is refreshed daily at 6 AM. The data source is an Azure SQL Database. The analyst's account has database permissions. What should the analyst configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure scheduled refresh in the dataset settings.. A scheduled refresh in the dataset settings allows configuring refresh frequency and time. Option A is wrong because XMLA endpoints are for advanced management, not scheduling refresh. Option C is wrong because an on-premises data gateway is needed only for on-premises data sources, not for Azure SQL Database. Option D is wrong because the refresh is scheduled on the dataset, not the report.

Answer

Enable XMLA endpoints for the workspace.

Answer

Install an on-premises data gateway.

Answer

Configure refresh in the report settings.

Question 2

A company is deploying Power BI for the entire organization. They need to prevent users from sharing reports with external email addresses. Which configuration should the Power BI admin use?

Accepted Answer

Disable 'Share content with external users' in the Power BI admin portal.. The Power BI admin portal includes a tenant setting called 'Share content with external users' that, when disabled, prevents users from sharing reports and dashboards with external email addresses. This setting directly controls the ability to share with external users via email, links, or apps. Disabling it enforces the requirement organization-wide without needing additional policies.

Answer

Configure a Conditional Access policy in Microsoft Entra ID.

Answer

Apply a Microsoft Purview sensitivity label.

Answer

Set the workspace sharing settings to 'Only existing users'.

Question 3

A Power BI dataset uses DirectQuery to a Snowflake data warehouse. Users report that the report takes more than 5 minutes to load. The dataset has complex DAX measures. The admin wants to improve performance without changing the data source. Which action is most effective?

Accepted Answer

Create aggregations in the dataset.. Creating aggregations in the dataset (option A) is the most effective action because it caches pre-aggregated summary data in Power BI while the detail remains in Snowflake via DirectQuery, so complex DAX measures can be resolved against the smaller, in-memory aggregation tables instead of pushing heavy queries to Snowflake. This directly reduces the volume of data scanned and the query load on the Snowflake source without changing the data source itself. Switching to Import mode (B) would change the data source behavior and requires scheduled refresh, which the scenario excludes, and it isn't necessary to solve the query performance issue. Reducing visuals or simplifying measures (C) may help marginally but doesn't address the underlying DirectQuery cost of complex DAX against Snowflake. Increasing Premium capacity (D) adds compute resources but doesn't reduce the expensive queries sent to Snowflake, so it is less effective than aggregations.

Answer

Switch the dataset to Import mode and schedule refresh.

Answer

Reduce the number of visuals and simplify measures.

Answer

Increase the Power BI Premium capacity size.

Question 4

A Power BI admin needs to audit which users have accessed a specific report in the last 30 days. Which log should the admin use?

Accepted Answer

Power BI activity log (audit log) in the Power BI admin portal.. The Power BI activity log captures user access events. Option B is wrong because the audit log in Microsoft 365 Defender may not have detailed Power BI access events. Option C is wrong because usage metrics reports show view counts but not per-user details. Option D is wrong because the Microsoft Purview audit log is for compliance, not detailed access logs.

Answer

Microsoft Defender XDR audit log.

Answer

Power BI usage metrics report.

Answer

Microsoft Purview audit log.

Question 5

A company has Power BI Premium capacity. They want to allow developers to deploy datasets using the XMLA endpoint with a service principal. What must the admin configure?

Accepted Answer

Enable service principal access in the Power BI admin portal under 'Developer settings'.. The correct option is A: enabling service principal access in the Power BI admin portal under 'Developer settings' is the specific tenant-level switch that permits service principals to call the XMLA endpoint for dataset deployment and management. Without this admin setting turned on, XMLA endpoint calls authenticated as a service principal are rejected even if the principal has workspace permissions. Option B is wrong because an on-premises data gateway is only needed for connecting to on-premises data sources, not for XMLA endpoint access. Option C is insufficient by itself because workspace membership does not enable service principal XMLA usage without the tenant setting. Option D is also insufficient alone, since creating an app registration is a prerequisite for the service principal but does not grant XMLA endpoint access.

Answer

Install an on-premises data gateway.

Answer

Add the service principal as a member of the workspace.

Answer

Create an app registration in Microsoft Entra ID.

Question 6

Which TWO actions should a Power BI admin take to ensure compliance with data residency requirements? (Choose two.)

Accepted Answer

Configure the default storage location in the Power BI admin portal.. Option A is correct because the Power BI admin portal's 'Tenant settings' includes a 'Default storage location' (also called 'Data residency') setting that lets the admin pin the tenant's default region for new workspaces, ensuring data is stored in the required geography. Option E is correct because with Power BI Premium Multi-Geo, admins can assign workspaces to capacities deployed in specific regions, so dataset and report data physically resides in the chosen geography to meet residency mandates. Option B is wrong because there is no separate 'Data residency' toggle in the admin portal; residency is controlled via the default storage location setting and Premium Multi-Geo capacity assignment. Option C is wrong because Power BI Report Server is an on-premises reporting solution, not a mechanism for meeting cloud data residency requirements, and it doesn't govern Power BI Service data location. Option D is wrong because storing datasets in Azure Data Lake Storage is a data-source/storage choice and does not by itself control where the Power BI Service stores the dataset or satisfy tenant-level residency configuration.

Answer

Enable 'Data residency' settings in the admin portal.

Answer

Use Power BI Report Server for on-premises data.

Answer

Store datasets in Azure Data Lake Storage.

Question 7

Which THREE conditions are required to use a service principal with Power BI? (Choose three.)

Accepted Answer

The service principal must have a Power BI Pro or Premium Per User license.. Option A is correct because a service principal used with Power BI requires a Power BI Pro or Premium Per User (PPU) license to authenticate and perform operations such as dataset refresh and workspace access. Option B is correct because the service principal must be explicitly added as a member or admin of the target workspace, since service principals do not inherit permissions through group membership or tenant-level roles. Option D is correct because a Power BI admin must enable the tenant setting 'Allow service principals to use Power BI APIs' in the Power BI admin portal before service principals can be used. Option C is incorrect because an on-premises data gateway is only needed when accessing on-premises data sources, not as a general requirement for using a service principal. Option E is incorrect because XMLA endpoints are only required for specific scenarios such as read/write operations on Premium datasets, not for general service principal usage.

Answer

An on-premises data gateway must be installed.

Answer

The service principal must use XMLA endpoints.

Question 8

Refer to the exhibit. A Power BI dataset uses a service principal to connect to an Azure SQL Database. The dataset fails to refresh with an authentication error. What is the most likely cause?

Accepted Answer

The service principal credentials are not configured in the data gateway.. The service principal (client secret or certificate) must be stored in the gateway cluster credentials. Option A is wrong because the database name is correct as shown in the exhibit. Option B is wrong because the service principal ID is likely correct; the authentication error is due to missing gateway credentials, not an invalid ID. Option D is wrong because the server name is correct; the error is not related to an incorrect server name.

Answer

The database name is incorrect.

Answer

The service principal ID is invalid.

Answer

The server name is incorrect.

Question 9

Your organization uses Power BI Premium per capacity. You need to ensure that only users from a specific Microsoft Entra ID security group can access the Power BI service. What should you do?

Accepted Answer

Configure the Power BI tenant settings to 'Allow users to access Power BI service' and specify the security group.. Option D is correct because Power BI tenant settings include the 'Allow users to access Power BI service' control, which can be scoped to a specific Microsoft Entra ID security group so that only members of that group can sign in to the Power BI service. This tenant-level setting is the supported mechanism for restricting service access to a defined Entra ID group. Option A is wrong because disabling 'Publish to web' only blocks public web publishing and does not restrict who can access the Power BI service. Option B is wrong because changing the capacity SKU affects capacity features and performance, not user access to the service. Option C is wrong because creating a workspace security group controls workspace content permissions, not tenant-wide access to the Power BI service.

Answer

Disable the 'Publish to web' setting in the tenant admin portal.

Answer

Set the capacity to a different SKU.

Answer

Create a security group in the workspace and add users to that group.

Question 10

You have a Power BI report that uses a dataset with row-level security (RLS) roles defined. Users report that they see no data when viewing the report. Which two checks should you perform first? (Assume all other configurations are correct.)

Accepted Answer

Verify that the dataset has the RLS roles applied and published.. The two correct options are C and D. Option C is right because RLS roles must be created in the dataset and then published to the Power BI Service; if the roles were defined only in Power BI Desktop and never published, or if the published dataset lacks the roles, users will be filtered to no rows. Option D is right because a user who is not assigned to any RLS role (directly or via an Microsoft Entra ID security group) will, by default, see no data when RLS is enabled on the dataset. Option A does not fit because Premium capacity is not required for RLS to function. Option B does not fit because app publication is not a prerequisite for RLS filtering. Option E does not fit because RLS role names are arbitrary labels and are never matched against usernames; membership is assigned through the role's Members list.

Answer

Confirm that the workspace is assigned to a Premium capacity.

Answer

Check that the report is published to a Power BI app.

Answer

Verify that the RLS role name matches exactly with the username.

Question 11

Your organization is implementing a data security strategy for Power BI. You need to ensure that sensitive data in datasets is protected at rest using customer-managed keys (CMK). What prerequisite must be met?

Accepted Answer

The workspace must be assigned to a Premium capacity (P or EM SKU).. The correct option is A: the workspace must be assigned to a Premium capacity (P or EM SKU). Customer-managed keys (CMK) for Power BI encryption at rest are only supported on Premium capacities, where the capacity's encryption key can be created and managed in Azure Key Vault and associated with the capacity. Shared capacity workspaces cannot use CMK, so C is wrong, and Azure Purview (B) is a governance/cataloging service unrelated to CMK encryption. BYOK for SQL Server (D) is a different feature and does not satisfy the Power BI CMK prerequisite.

Answer

Azure Purview must be configured for the tenant.

Answer

The Power BI tenant must be in a shared capacity.

Answer

The organization must use Bring Your Own Key (BYOK) for SQL Server.

Question 12

Refer to the exhibit. You are configuring row-level security (RLS) for a Power BI dataset. The JSON shows a role named 'RegionManager' with a filter expression. Users assigned to this role complain that they see all regions instead of only 'North'. What is the likely cause?

Accepted Answer

The filter expression uses incorrect DAX syntax; it should reference the table name, e.g., 'Sales[Region] = "North"'.. The correct option is D: the filter expression uses incorrect DAX syntax and must reference the table name, e.g., 'Sales[Region] = "North"'. In Power BI row-level security, a role filter is a DAX boolean expression evaluated against a table, so a bare column reference like [Region] = "North" without the table qualifier is invalid and the filter is not applied, causing users to see all regions. Option A is wrong because 'Read' is a valid dataset permission and RLS filters apply regardless of Read vs ReadAndExplore. Option B is wrong because role names are not required to match group names and are not used for membership matching in that way. Option C is wrong because RLS filters are written in DAX, not M, and DAX is the supported language for RLS filter expressions.

Answer

The 'Read' permission should be 'ReadAndExplore' to apply filters.

Answer

The role name 'RegionManager' is case-sensitive and must match the user's group name.

Answer

The filter expression is written in M language, which is not supported for RLS.

Question 13

Your organization has a Power BI Premium capacity. You need to ensure that data refresh operations for a specific dataset are not interrupted during peak hours. What should you configure?

Accepted Answer

Configure a 'priority' rule in the capacity workload settings for data refresh.. The correct option is D: configure a 'priority' rule in the capacity workload settings for data refresh. In Power BI Premium, workload settings let you assign a priority (for example, High) to specific workloads such as dataset refresh, so refresh operations for the chosen dataset are processed ahead of lower-priority jobs and are less likely to be delayed or interrupted during peak hours. Option A is wrong because disabling scheduled refresh stops the refresh entirely rather than protecting it. Option B is wrong because manually refreshing off-peak does not guarantee protection during peak hours and defeats the purpose of scheduled refresh. Option C is wrong because scaling to a higher SKU adds capacity resources but does not specifically prioritize this dataset's refresh operations.

Answer

Disable scheduled refresh for the dataset.

Answer

Set the dataset to 'Refresh now' manually during off-peak hours.

Answer

Increase the capacity size to a higher SKU.

Question 14

You are managing a Power BI environment that uses Microsoft Purview for data governance. You need to ensure that all new datasets automatically inherit sensitivity labels from their source data. What should you configure?

Accepted Answer

In Microsoft Purview, set up 'Automatic labeling' policies that propagate labels from source to Power BI datasets.. Microsoft Purview's automatic labeling policies can propagate sensitivity labels from source data to Power BI datasets automatically, ensuring new datasets inherit labels. Option A is incorrect because enabling sensitivity labels in Power BI tenant settings only allows manual labeling and does not enforce automatic inheritance from source data. Option C is incorrect because using Purview Data Map to scan and manually apply labels does not provide automatic propagation. Option D is incorrect because a Power Automate flow would require custom setup and is not the native mechanism for automatic label inheritance from source to Power BI.

Answer

Enable 'Sensitivity labels' in Power BI tenant settings and require labels on datasets.

Answer

Use Microsoft Purview Data Map to scan source data and manually apply labels.

Answer

Configure a Power Automate flow to apply labels based on dataset metadata.

Question 15

Your organization uses Microsoft Teams to collaborate on Power BI reports. You need to ensure that only members of a specific team can view a report embedded in a Teams tab. What should you do?

Accepted Answer

Share the report directly with the team in Microsoft Entra ID.. The correct option is A: share the report directly with the team in Microsoft Entra ID. In Power BI, you can grant access to a report by sharing it with a security group or Microsoft 365 group (which backs a Teams team), so only members of that team can view it. This satisfies the requirement of restricting visibility to a specific team. Option B does not control report access, as ownership is a workspace-level concept and does not limit viewers. Option C would make the report accessible to everyone in the tenant, violating the requirement. Option D grants the team workspace membership, which gives broader permissions than just viewing the report and does not scope access to the report itself.

Answer

Assign the team owner as the report owner.

Answer

Set the report to 'Public' in the tenant settings.

Answer

Add the team to the workspace as a 'Member' role.