PL-300 Manage and secure Power BI Practice Test 5 — 15 Questions

Question 1

A company uses Power BI Premium per capacity. A report developer needs to share a report with external users who do not have Power BI licenses. The report uses a live connection to an Azure Analysis Services model. What should the admin configure to allow external access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Bring Your Own Tenant (BYOT) with Azure B2B.. Bring Your Own Tenant (BYOT) with Azure B2B allows external users to access Power BI content using their own organization's identities, without requiring them to have Power BI licenses or be added as guest users in the hosting tenant. Option A is incorrect because enabling Publish to web makes the report publicly accessible, which is not secure for sharing with specific external users. Option C is incorrect because while Azure B2B guest users can access content in a Premium capacity, they would need to be invited and managed as guests in the tenant, and BYOT is a more suitable solution when external users have their own tenant. Option D is incorrect because sharing directly with external email addresses requires the external users to have Power BI Pro licenses.

Answer

Enable Publish to web for the report.

Answer

Configure Azure B2B guest users in the same tenant.

Answer

Share the report directly with external email addresses.

Question 2

A Power BI admin receives a support ticket that a user cannot see any data in a report that uses row-level security (RLS). The report is based on a dataset with a single table 'Sales' and RLS roles defined. The user is assigned to the role 'SalesManager' which filters Sales[Region] = 'West'. The dataset uses Import mode. The user can see the report but all visuals show blank. What is the most likely cause?

Accepted Answer

The RLS filter removes all rows for the user's role.. The most likely cause is that the RLS filter for the 'SalesManager' role removes all rows for the user. Since the role filters Sales[Region] = 'West' and there are no rows meeting that condition, visuals appear blank. Option A correctly identifies this. Option B is incorrect because the user can see the report page, indicating they have permission. Option C is incorrect because the scenario explicitly states the user is viewing a report, not a dashboard tile; RLS does apply to dashboard tiles pinned from reports with RLS, so this would not explain the blank visuals. Option D is incorrect because the dataset refresh method does not cause blank visuals; RLS is applied at query time regardless of how data is refreshed.

Answer

The user does not have permission to view the report page.

Answer

The user is viewing a dashboard tile instead of the report.

Answer

The dataset was refreshed using an RLS bypass account.

Question 3

A data analyst needs to ensure that a Power BI dataset used in a shared workspace is refreshed daily at 6 AM. The data source is an Azure SQL Database. The analyst's account has database permissions. What should the analyst configure?

Accepted Answer

Configure scheduled refresh in the dataset settings.. A scheduled refresh in the dataset settings allows configuring refresh frequency and time. Option A is wrong because XMLA endpoints are for advanced management, not scheduling refresh. Option C is wrong because an on-premises data gateway is needed only for on-premises data sources, not for Azure SQL Database. Option D is wrong because the refresh is scheduled on the dataset, not the report.

Answer

Enable XMLA endpoints for the workspace.

Answer

Install an on-premises data gateway.

Answer

Configure refresh in the report settings.

Question 4

A Power BI dataset uses DirectQuery to a Snowflake data warehouse. Users report that the report takes more than 5 minutes to load. The dataset has complex DAX measures. The admin wants to improve performance without changing the data source. Which action is most effective?

Accepted Answer

Create aggregations in the dataset.. Creating aggregations in the dataset (Option A) is the most effective way to improve DirectQuery performance without changing the underlying data source. Aggregations pre-summarize data at different granularities, allowing Power BI to answer many queries from the local aggregation tables rather than sending queries to Snowflake. This significantly reduces query load and response time. Option C (reducing visuals and simplifying measures) may help but is not as impactful as aggregations. Option B (switching to Import mode) would require changing the data storage mode, which might be considered a change incompatible with the constraint if the intention is to keep DirectQuery. Option D (increasing capacity) does not optimize query performance of the existing DirectQuery setup.

Answer

Switch the dataset to Import mode and schedule refresh.

Answer

Reduce the number of visuals and simplify measures.

Answer

Increase the Power BI Premium capacity size.

Question 5

A Power BI admin needs to audit which users have accessed a specific report in the last 30 days. Which log should the admin use?

Accepted Answer

Power BI activity log (audit log) in the Power BI admin portal.. The Power BI activity log captures user access events. Option B is wrong because the audit log in Microsoft 365 Defender may not have detailed Power BI access events. Option C is wrong because usage metrics reports show view counts but not per-user details. Option D is wrong because the Microsoft Purview audit log is for compliance, not detailed access logs.

Answer

Microsoft Defender XDR audit log.

Answer

Power BI usage metrics report.

Answer

Microsoft Purview audit log.

Question 6

A company has Power BI Premium capacity. They want to allow developers to deploy datasets using the XMLA endpoint with a service principal. What must the admin configure?

Accepted Answer

Enable service principal access in the Power BI admin portal under 'Developer settings'.. To allow service principals to use the XMLA endpoint, the admin must enable service principal access in the Power BI admin portal under 'Developer settings'. Option B is incorrect because an on-premises data gateway is not required for cloud-based data sources. Option C is incorrect because adding the service principal as a member of the workspace is necessary but not sufficient; the admin must also enable the setting at the tenant level. Option D is incorrect because creating an app registration in Microsoft Entra ID is a prerequisite for using a service principal, but the specific configuration needed is enabling service principal access in Power BI.

Answer

Install an on-premises data gateway.

Answer

Add the service principal as a member of the workspace.

Answer

Create an app registration in Microsoft Entra ID.

Question 7

A Power BI report uses a composite model combining Import and DirectQuery sources. When a user filters a visual, the report takes a long time to update. The admin wants to diagnose performance issues. Which tool should the admin use?

Accepted Answer

Performance Analyzer in Power BI Desktop.. Performance Analyzer in Power BI Desktop is the correct tool because it shows the duration of each visual's queries, including both Import and DirectQuery sources, allowing the admin to identify slow-performing visuals and analyze query execution. Option A (DAX Studio) is primarily for analyzing and optimizing DAX queries but does not provide a visual-level performance breakdown for a composite model. Option C (Power BI activity log) records user activities and access events but not query performance details. Option D (On-premises data gateway log) is relevant only for gateway connectivity issues, not for report rendering performance.

Answer

DAX Studio.

Answer

Power BI activity log.

Answer

On-premises data gateway log.

Question 8

A data analyst creates a Power BI report using a dataset that contains sensitive salary information. The analyst needs to ensure that only HR managers can see salary columns. What should the analyst use?

Accepted Answer

Object-level security (OLS).. Object-level security (OLS) hides columns from specific roles. Option A is wrong because RLS filters rows, not columns. Option B is wrong because sensitivity labels are for classification, not access control. Option D is wrong because the dataset's security settings do not support column-level security natively.

Answer

Row-level security (RLS).

Answer

Microsoft Purview sensitivity labels.

Answer

Set the dataset security to 'Restrict access'.

Question 9

Which TWO actions should a Power BI admin take to ensure compliance with data residency requirements? (Choose two.)

Accepted Answer

Configure the default storage location in the Power BI admin portal.. Options A and E are correct because data residency can be controlled by configuring the default storage location in the Power BI admin portal (A) and by using Multi-Geo capabilities for Premium capacities to assign workspaces to specific regions (E). Option B is wrong because there is no separate 'Data residency' setting; residency is managed through capacity region and storage location. Option C is wrong because Power BI Report Server is an on-premises solution, not a direct control for cloud data residency compliance. Option D is wrong because Azure Data Lake Storage is a separate storage service and not a configuration setting within Power BI for enforcing data residency.

Answer

Enable 'Data residency' settings in the admin portal.

Answer

Use Power BI Report Server for on-premises data.

Answer

Store datasets in Azure Data Lake Storage.

Question 10

Which THREE conditions are required to use a service principal with Power BI? (Choose three.)

Accepted Answer

The service principal must have a Power BI Pro or Premium Per User license.. Options A, B, and D are correct. A: A service principal requires a Power BI Pro or Premium Per User license to access Power BI content. B: The service principal must be added as a member or admin of the workspace to interact with its content. D: Service principal access must be enabled in the Power BI admin portal under Tenant settings. Option C is incorrect because an on-premises data gateway is not required for service principal operations. Option E is incorrect because XMLA endpoints are not mandatory for using a service principal; they are used for specific scenarios like programmatic management.

Answer

An on-premises data gateway must be installed.

Answer

The service principal must use XMLA endpoints.

Question 11

Which TWO methods can a Power BI admin use to enforce the use of sensitivity labels on reports? (Choose two.)

Accepted Answer

Apply labels automatically using Microsoft Purview Information Protection.. Options C and D are correct. An admin can enforce sensitivity labels by requiring users to apply labels when publishing reports (option D) in the admin portal setting 'Mandatory labeling'. Additionally, labels can be applied automatically using Microsoft Purview Information Protection (option C) via auto-labeling policies. Option A is incorrect because Intune policies are not used to block unlabeled reports in Power BI; mandatory labeling is configured in the Power BI admin portal. Option B is incorrect because default labels in Power BI Desktop are not enforced by the admin; they are client-side settings. Option E is incorrect because row-level security controls data access, not sensitivity label enforcement.

Answer

Deploy a Microsoft Intune policy to block unlabeled reports.

Answer

Configure default labels in Power BI Desktop.

Answer

Use row-level security to hide unlabeled reports.

Question 12

Refer to the exhibit. A Power BI dataset uses a service principal to connect to an Azure SQL Database. The dataset fails to refresh with an authentication error. What is the most likely cause?

Accepted Answer

The service principal credentials are not configured in the data gateway.. The service principal (client secret or certificate) must be stored in the gateway cluster credentials. Option A is wrong because the database name is correct as shown in the exhibit. Option B is wrong because the service principal ID is likely correct; the authentication error is due to missing gateway credentials, not an invalid ID. Option D is wrong because the server name is correct; the error is not related to an incorrect server name.

Answer

The database name is incorrect.

Answer

The service principal ID is invalid.

Answer

The server name is incorrect.

Question 13

Refer to the exhibit. A user is a member of both 'HRManager' and 'Executive' RLS roles. The dataset uses DirectQuery. When the user views a report showing all employees, what data will they see?

Accepted Answer

Rows where Department is 'HR' or 'Executive' (union).. In Power BI, when a user belongs to multiple RLS roles, the filters are combined using OR logic, so the user sees rows that satisfy either role (union). Option A is incorrect because it would require no filters. Option B describes intersection (AND), which is not how Power BI combines roles. Option C is incorrect because roles do not conflict; they are combined with OR.

Answer

All rows in the Employees table.

Answer

Only rows where Department is both 'HR' and 'Executive' (intersection).

Answer

No rows because roles conflict.

Question 14

Refer to the exhibit. User2 wants to add a new user to the Finance workspace. Can User2 perform this action, and why?

Accepted Answer

No, because only Admins can add users.. Only workspace Admins can add users to a workspace. User2 is a Member, which does not include the permission to manage membership. Option A is wrong because Contributors cannot add users. Option B is wrong because Members cannot add users. Option C is wrong because the Premium capacity does not affect workspace membership permissions.

Answer

Yes, because User2 is a Contributor.

Answer

Yes, because User2 is a Member.

Answer

No, because the Premium capacity does not allow adding users.

Question 15

Your organization uses Power BI Premium per capacity. You need to ensure that only users from a specific Microsoft Entra ID security group can access the Power BI service. What should you do?

Accepted Answer

Configure the Power BI tenant settings to 'Allow users to access Power BI service' and specify the security group.. To restrict access to the Power BI service to a specific Microsoft Entra ID security group, you configure the 'Allow users to access Power BI service' tenant setting and specify that security group. This setting controls which users can sign in to the Power BI service at the tenant level. Option A is incorrect because disabling 'Publish to web' prevents public sharing but does not restrict access to the service. Option B is incorrect because changing the capacity SKU affects resource limits, not user access. Option C is incorrect because workspace security groups control access to specific workspaces, not to the Power BI service itself.

Answer

Disable the 'Publish to web' setting in the tenant admin portal.

Answer

Set the capacity to a different SKU.

Answer

Create a security group in the workspace and add users to that group.