PL-300 Manage and secure Power BI Practice Test 4 — 15 Questions

Question 1

You are deploying a Power BI solution for a multinational company. The data contains personally identifiable information (PII) subject to GDPR. You need to ensure that users outside the European Union cannot access the underlying data when viewing reports in the Power BI service. What should you implement?

Accepted Answer

Configure Power BI multi-geo and implement row-level security (RLS) based on user region.. Option D is correct because Power BI allows setting geographic data residency at the tenant level, ensuring data is stored in a specific region. Additionally, row-level security (RLS) can restrict data access based on user location, but the question specifically mentions preventing access from outside the EU, which is best achieved by combining multi-geo with RLS. Option A is wrong because Microsoft Entra ID Conditional Access can block access to the service, but not to the data within reports. Option B is wrong because data classification restricts actions but not access. Option C is wrong because sensitivity labels do not block access.

Answer

Apply data classification labels to the datasets and configure protection policies.

Answer

Use Microsoft Entra ID Conditional Access policies to block access from non-EU IP addresses.

Answer

Use Microsoft Purview sensitivity labels to restrict access to EU users only.

Question 2

You have a Power BI workspace that contains a dataset with a live connection to Azure Analysis Services. You need to configure the dataset so that when a user views a report in the Power BI service, the underlying data is queried from the Azure Analysis Services model using the user's identity. What should you configure in the Power BI dataset settings?

Accepted Answer

Configure the 'Effective identity' settings on the dataset.. Option B is correct because when using a live connection to Azure Analysis Services, the 'Effective identity' setting in Power BI allows you to pass the viewing user's identity to the source, enabling row-level security defined in Azure Analysis Services. Option A is wrong because single sign-on (SSO) is for data sources like SQL Server, not for Analysis Services live connections. Option C is wrong because the 'Use current user's credentials' is not available for live connections; it's for direct query mode. Option D is wrong because RLS in Power BI is separate from Analysis Services RLS; for live connections, RLS is defined in Analysis Services.

Answer

Enable single sign-on (SSO) for the dataset.

Answer

Set the authentication method to 'Use current user's credentials'.

Answer

Define row-level security (RLS) roles in Power BI Desktop.

Question 3

You need to ensure that only members of the 'Sales' security group can edit reports in the 'Sales Reports' workspace. The workspace currently has four members: three from Sales and one from Marketing. What should you do?

Accepted Answer

Add the Sales security group as a workspace Admin and remove the Marketing user.. Option C is correct because by assigning the 'Sales' group as the workspace admin or contributor, you can control access. However, the scenario requires that only Sales members can edit; the Marketing member must be removed or assigned a lower role. Removing the Marketing user from the workspace ensures they cannot edit. Option A is wrong because adding the Sales group as Admin does not automatically remove the Marketing user. Option B is wrong because workspace roles cannot be assigned per user role; they are workspace-wide. Option D is wrong because app permissions do not control editing access.

Answer

Configure the workspace to allow only specific users to edit by using the 'Restrict editing' option.

Answer

Publish the reports to a Power BI app and grant the Sales group 'Build' permissions.

Answer

Assign the Sales security group the 'Contributor' role and keep the Marketing user as 'Member'.

Question 4

Your organization uses Power BI Premium capacity. You notice that reports are slow during peak hours. You need to identify which workspaces are consuming the most CPU resources on the capacity. What should you use?

Accepted Answer

Install and review the Power BI Premium Capacity Metrics app.. Option C is correct because the Power BI Premium Capacity Metrics app provides detailed metrics on CPU consumption per workspace, helping identify resource-intensive workspaces. Option A is wrong because the Admin portal shows overall capacity usage but not per workspace. Option B is wrong because Azure Monitor works only for Azure resources, not Power BI Premium capacities. Option D is wrong because Power BI Desktop cannot monitor capacity usage.

Answer

Open the dataset in Power BI Desktop and view the performance analyzer.

Answer

Enable diagnostic logging in Azure Monitor for the capacity.

Answer

Check the 'Capacity settings' in the Power BI admin portal.

Question 5

You need to prevent users from sharing Power BI reports with people outside your organization. What should you configure in the Power BI admin portal?

Accepted Answer

Disable the 'Share content with external users' setting.. Option D is correct because the 'Share content with external users' tenant setting controls whether users can share reports and dashboards with external users. Disabling this setting prevents external sharing. Option A is wrong because 'Export to Excel' is a separate setting. Option B is wrong because 'Publish to web' is for public embedding. Option C is wrong because 'Create email subscriptions' does not control external sharing.

Answer

Disable the 'Export to Excel' setting.

Answer

Disable the 'Publish to web' setting.

Answer

Disable the 'Allow users to create email subscriptions' setting.

Question 6

You have a Power BI dataset that uses DirectQuery to a SQL Server data warehouse. You need to ensure that when users view reports, they see only data relevant to their department. The data warehouse contains a 'Department' column. What should you implement?

Accepted Answer

Define row-level security (RLS) roles in Power BI Desktop and assign users.. Option B is correct because row-level security (RLS) in Power BI allows you to filter data based on the user's identity. By defining roles and using DAX filters like 'Department = USERPRINCIPALNAME()', you can restrict data. Option A is wrong because object-level security (OLS) controls access to tables/columns, not rows. Option C is wrong because data source credentials are used for connection, not for filtering. Option D is wrong because Power BI does not support query passthrough for RLS; RLS is implemented in Power BI.

Answer

Configure the data source credentials to pass the user's identity.

Answer

Create separate datasets for each department and grant access accordingly.

Answer

Implement object-level security (OLS) on the 'Department' column.

Question 7

You need to audit Power BI activities such as viewing reports, sharing dashboards, and exporting data. Which TWO actions should you take to enable and access audit logs? (Choose two.)

Accepted Answer

Access the audit log from the Microsoft 365 compliance portal.. Options A and C are correct. Enabling the audit log in the Power BI admin portal is the first step. Option C is correct because audit logs are stored in the Microsoft 365 compliance portal. Option B is wrong because Microsoft Defender for Cloud Apps is not the primary storage for audit logs. Option D is wrong because Azure Monitor is not used for Power BI audit logs. Option E is wrong because Power BI itself does not store audit logs; it sends them to the Microsoft 365 audit log.

Answer

Configure Microsoft Defender for Cloud Apps to forward logs to Microsoft Sentinel.

Answer

Use the 'Export' feature in Power BI to export audit logs to a CSV file.

Answer

Set up a diagnostic setting in Azure Monitor to collect Power BI logs.

Question 8

Your organization uses Power BI Premium with a shared capacity. You need to ensure that a specific workspace's data stays in the European region. Which TWO actions should you take? (Choose two.)

Accepted Answer

Create a Power BI Premium capacity in the European region.. Options A and C are correct. Creating a Premium capacity assigned to a European region ensures data residency. Moving the workspace to that capacity ensures the data is stored in Europe. Option B is wrong because sensitivity labels do not control data residency. Option D is wrong because the default region is set at the tenant level, not per workspace. Option E is wrong because Power BI does not allow per-dataset regional settings.

Answer

Configure the default geographic region for the tenant to Europe.

Answer

Set the data residency option in the dataset settings to Europe.

Answer

Apply a Microsoft Purview sensitivity label with encryption to the datasets.

Question 9

You need to restrict access to a Power BI report that contains sensitive financial data. The report is published to a workspace. Which THREE actions can you take to control access? (Choose three.)

Accepted Answer

Implement row-level security (RLS) to filter data based on user identity.. Options A, C, and D are correct. Assigning workspace roles controls who can view content in the workspace. Sharing the report with specific users allows granular access. Row-level security (RLS) can filter data per user. Option B is wrong because sensitivity labels do not control access; they classify data. Option E is wrong because the 'Export to Excel' setting controls export, not access.

Answer

Disable the 'Export to Excel' setting for the report.

Answer

Apply a sensitivity label that restricts access to the report.

Question 10

Refer to the exhibit. You run a PowerShell script to list workspaces and their users. You need to ensure that only members of the sales security group can access the Sales workspace. What should you do?

Accepted Answer

Remove the individual users (user1 and user2) from the Sales workspace.. Option B is correct because the exhibit shows that the sales security group is already an Admin in the workspace. However, user1 and user2 are individual users with Member and Contributor roles. To restrict access to only the security group, you must remove these individual users. Option A is wrong because the security group is already added as Admin, which is sufficient for access. Option C is wrong because the Marketing workspace is deleted and irrelevant. Option D is wrong because changing the security group role to Viewer would reduce permissions, but the core issue is the individual users.

Answer

Restore the Marketing workspace and move the reports there.

Answer

Add the sales security group as a Contributor to the Sales workspace.

Answer

Change the sales security group's role to Viewer.

Question 11

Refer to the exhibit. You are reviewing the configuration of a Power BI dataset with row-level security (RLS). A user named 'user@contoso.com' reports that they can see all data when they should see only data for their region. What is the most likely cause?

Accepted Answer

The 'effectiveIdentity' is set to the user's email, bypassing RLS.. Option C is correct because the 'effectiveIdentity' property in the exhibit is set to 'user@contoso.com', which overrides RLS and allows that user to see all data. In Power BI, the effective identity is used for testing but in production, it should not be set for a specific user if RLS is intended. Option A is wrong because the roles include users, so RLS is configured. Option B is wrong because the exhibit does not indicate a missing role mapping. Option D is wrong because the roles are defined; the issue is the effective identity.

Answer

The RLS roles are missing the 'SalesRole' mapping to the dataset.

Answer

The dataset does not have any RLS roles defined.

Answer

The user is not assigned to any RLS role.

Question 12

Refer to the exhibit. The Power BI admin settings are shown. A user reports that they cannot share a dashboard with an external partner. What is the most likely reason?

Accepted Answer

The 'externalSharingEnabled' setting is disabled.. Option B is correct because the setting 'externalSharingEnabled' is set to false, which prevents users from sharing content with external users. Option A is wrong because 'workspaceCreationEnabled' is true, allowing workspace creation. Option C is wrong because 'exportDataEnabled' is true. Option D is wrong because 'publishToWebEnabled' is true and unrelated to sharing.

Answer

The 'exportDataEnabled' setting is disabled.

Answer

The 'publishToWebEnabled' setting is disabled.

Answer

The 'workspaceCreationEnabled' setting is disabled.

Question 13

Your organization uses Power BI in a shared capacity model. A report developer complains that a new report published to a workspace does not appear in the 'My workspace' area. They have the Contributor role on the workspace. What is the most likely cause?

Accepted Answer

Reports published to a workspace do not appear in 'My workspace' unless the user manually saves a copy there.. Option A is correct because reports published to a workspace are stored in that workspace, not in 'My workspace'. The Contributor role allows publishing to the workspace, but the report will appear in the workspace, not the user's personal workspace. Option B is wrong because the Contributor role can publish content. Option C is wrong because there is no license issue. Option D is wrong because the report is not automatically added to 'My workspace'.

Answer

The Contributor role does not have permission to publish reports to the workspace.

Answer

The report was automatically added to 'My workspace' but was deleted by an administrator.

Answer

The user does not have a Power BI Pro license.

Question 14

You are configuring row-level security (RLS) for a Power BI dataset. The sales data includes a 'Region' column. You want users in the 'Sales Managers' group to see data only for their assigned region, which is stored in a separate mapping table. You create the following DAX filter: [Region] = LOOKUPVALUE(EmployeeRegion[Region], EmployeeRegion[UserPrincipalName], USERPRINCIPALNAME()). When testing, a user in 'Sales Managers' sees no data. What is the most likely issue?

Accepted Answer

The LOOKUPVALUE function returns multiple values for the user, causing an error.. Option C is correct because LOOKUPVALUE returns an error if multiple values are found (e.g., duplicate user entries in the mapping table), causing the filter to fail and return no data. Option A is wrong because RLS does not require Premium. Option B is wrong because the USERPRINCIPALNAME function is correct for Power BI Service. Option D is wrong because the DAX itself is syntactically correct; the issue is with data.

Answer

The USERPRINCIPALNAME function is not supported in RLS filters.

Answer

The DAX filter syntax is incorrect; it should use CALCULATE.

Answer

RLS requires a Premium capacity license.

Question 15

A Power BI report in a shared workspace needs to be embedded in a SharePoint Online page. Users accessing the page must see the report without signing in again. Which capability is required?

Accepted Answer

Use the 'Embed for SharePoint' option in Power BI.. Option A is correct because 'Embed for SharePoint' allows seamless integration with SharePoint Online, leveraging the user's existing authentication. Option B is wrong because 'Publish to web' makes the report public. Option C is wrong because that method is for custom apps. Option D is wrong because direct sharing requires sign-in.

Answer

Use the 'Embed for your organization' option.

Answer

Share the report directly with each user via email.

Answer

Publish the report to the web and embed the iframe.