PL-300 Manage and secure Power BI Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. You are troubleshooting an RLS configuration. The role 'SalesManager' is intended to restrict the user 'salesmanager@contoso.com' to see only their data. However, the user sees all data. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The filter expression compares the user's UPN to a static string, but there is no column in the table to filter against.. The correct option is B: the filter expression compares the user's UPN to a static string, but there is no column in the table to filter against. In Power BI row-level security, a DAX filter such as [Email] = USERPRINCIPALNAME() must reference an actual column in the table being secured; if the referenced column does not exist (or the expression is applied to a table lacking that field), the role cannot restrict rows and the user effectively sees all data. Option A is wrong because removing USERPRINCIPALNAME() and hard-coding the UPN would still require a valid column comparison and would not dynamically secure data. Option C is wrong because DirectQuery does support RLS in Power BI. Option D is wrong because 'ReadAndExplore' vs 'Read' concerns dataset permissions, not the RLS filter logic.

Answer

The filter expression should be '= "salesmanager@contoso.com"' without USERPRINCIPALNAME().

Answer

The dataset is using DirectQuery, which does not support RLS.

Answer

The model permission should be 'ReadAndExplore' instead of 'Read'.

Question 2

Your organization uses Power BI Premium per user. You need to ensure that a specific report is only accessible via a Power BI app and not directly in the workspace. What should you do?

Accepted Answer

In the workspace settings, set 'Allow users to access the workspace content directly' to disabled.. Disabling 'Allow users to access the workspace content directly' in workspace settings restricts users from accessing reports directly in the workspace, forcing them to use the Power BI app. Option B is incorrect because removing users from the workspace role removes their direct workspace access but does not affect their app access; app access is managed separately, so this does not ensure the report is accessible only via the app unless app access is explicitly granted. Option C is incorrect because moving the report to a different workspace does not prevent direct access in that workspace. Option D is incorrect because sharing the report only with app users does not prevent direct access in the workspace.

Answer

Remove the users from the workspace role.

Answer

Publish the report to a different workspace.

Answer

Share the report only with the app users.

Question 3

An Azure Policy is applied to your subscription with a rule that denies the creation or update of Power BI workspaces if the workspace SKU equals 'Premium'. What is the effect of this policy on Power BI workspaces?

Accepted Answer

It denies creation or update of workspaces assigned to Premium capacity.. The Azure Policy denies creation or update of workspaces with a 'Premium' SKU, meaning workspaces assigned to Premium capacity are denied. Option B is incorrect because the policy only applies to Premium capacity, not all workspaces. Option C is incorrect because the policy denies Premium workspaces, not non-Premium. Option D is incorrect because the policy applies to Premium, not Premium per user (PPU).

Answer

It denies creation of any new Power BI workspace.

Answer

It denies creation of workspaces that are not Premium.

Answer

It allows workspaces with Premium per user (PPU) SKU.

Question 4

You are a Power BI administrator. A user reports that they cannot see a specific dataset in the Power BI service, even though they have been assigned the 'Contributor' role on the workspace containing that dataset. The dataset was created by another user. What is most likely the cause?

Accepted Answer

The user needs 'Build' permission on the dataset.. The correct answer is A: the user needs 'Build' permission on the dataset. In Power BI, workspace roles like Contributor grant the ability to edit and manage workspace content, but seeing and consuming a specific dataset (especially for building reports on it) requires the Build permission, which is granted separately via dataset permissions or through the workspace role's implicit permissions. Since the dataset was created by another user, the Contributor role alone may not automatically confer Build rights on that dataset. Option B is unlikely because a Contributor role already requires a Pro or Premium Per User license, so licensing is not the typical cause. Option C is irrelevant because apps are a distribution method, not a prerequisite for viewing a dataset in the workspace. Option D is incorrect because Viewer is a lower-privilege role and would not resolve a missing dataset visibility issue for a Contributor.

Answer

The user's Power BI license is insufficient.

Answer

The dataset is published as an app and the user has not installed the app.

Answer

The user needs to be assigned the 'Viewer' role on the workspace.

Question 5

You are configuring a Power BI data gateway for a scheduled refresh. The data source is an on-premises SQL Server database. Which authentication method should you use for the gateway to connect to the SQL Server?

Accepted Answer

Windows authentication (Kerberos). Windows authentication (Kerberos) is correct because the on-premises data gateway impersonates the user or service account and uses Kerberos constrained delegation to pass credentials to the on-premises SQL Server, which is the supported and secure method for Windows-integrated SQL Server access. OAuth 2.0 is designed for cloud services and modern APIs, not for direct on-premises SQL Server connections through the gateway. Service Principal authentication is used for Microsoft Entra ID-based resources and Microsoft 365 services, not for on-premises SQL Server logins. Basic authentication with a SQL login can work only if SQL Server is configured for mixed-mode authentication, but it is not the recommended or default method and does not provide the integrated security that Kerberos offers.

Answer

OAuth 2.0

Answer

Service Principal

Answer

Basic authentication with SQL login

Question 6

You need to ensure that a Power BI report published to the service can be embedded in a secure internal SharePoint Online page. Only authenticated users from your Microsoft Entra ID tenant should be able to view the report. What should you do?

Accepted Answer

Use the 'Embed in SharePoint Online' option in Power BI service.. The 'Embed in SharePoint Online' option in Power BI service generates a secure embed code that respects Power BI permissions and requires users to authenticate with Microsoft Entra ID. This ensures that only authorized users in your tenant can view the report. It is the recommended method for embedding in SharePoint Online for internal users.

Answer

Share the report directly with all users and provide a direct link.

Answer

Use the 'Publish to web (public)' option and embed the iframe in SharePoint.

Answer

Use the 'Embed' option in Power BI service to generate a secure embed code, then add the Power BI web part in SharePoint.

Question 7

Your Power BI tenant has a capacity-based license (Premium). You want to enforce that only reports with a specific sensitivity label from Microsoft Purview can be exported to PDF. What feature should you use?

Accepted Answer

Sensitivity labels from Microsoft Purview. Sensitivity labels in Power BI can be used to control export actions. Option B is correct because sensitivity labels can restrict exporting based on label. Option A is wrong because data loss prevention (DLP) policies in Power BI are for preventing data exfiltration but not specifically tied to export formats. Option C is wrong because app protection policies are for mobile devices. Option D is wrong because conditional access policies control access, not export.

Answer

Microsoft Intune app protection policies

Answer

Data loss prevention (DLP) policies for Power BI

Answer

Conditional Access policies in Microsoft Entra ID

Question 8

Which TWO actions should you take to ensure that sensitive columns (e.g., customer names) are not visible to certain users in a Power BI report? (Select exactly two.)

Accepted Answer

Use object-level security (OLS) to hide the columns for specific roles.. Option A is correct because object-level security (OLS) in a Power BI semantic model lets you define roles that hide specific tables or columns (such as customer names) from certain users, so the sensitive columns are not visible in reports for those roles. Option D is correct because creating separate datasets—one including the sensitive columns and one excluding them—and granting permissions only to the appropriate dataset ensures users of the restricted dataset never see the sensitive columns at all. Option B is not correct because dynamic data masking is a SQL Server/Azure SQL feature and is not applied to a Power BI dataset in the Power BI service. Option C is not correct because row-level security (RLS) filters rows, not columns, so it cannot hide a sensitive column from users. Option E is not correct because blocking users from viewing the entire report is broader than needed and does not selectively hide sensitive columns while still allowing access to the report.

Answer

Apply dynamic data masking on the dataset in Power BI service.

Answer

Use row-level security (RLS) to filter out rows containing sensitive data.

Answer

Set the report to not allow users with certain roles to view the report.

Question 9

Which THREE features are available in Power BI Premium capacity but not in Power BI shared capacity? (Select exactly three.)

Accepted Answer

AI visuals and cognitive services integration.. Option A is correct because AI visuals and cognitive services integration (e.g., Azure Cognitive Services for text analytics, image tagging, and key phrase extraction) are Premium-only capabilities that are not available in shared capacity. Option B is correct because Power BI Premium (and Premium Gen2) supports large dataset storage up to 100 GB per dataset, whereas shared capacity limits datasets to 1 GB. Option D is correct because XMLA endpoints for read/write operations, which enable external tools like Tabular Editor and DAX Studio to modify datasets, require Premium capacity. Option C is not correct because incremental refresh is available in shared capacity (Pro), not exclusively in Premium. Option E is not correct because automatic page refresh is available in shared capacity with limitations, not as a Premium-only feature.

Answer

Incremental refresh.

Answer

Automatic page refresh.

Question 10

Refer to the exhibit. You have a Power BI dataset configured with the refresh schedule shown. On Monday at 04:00 UTC, you check the refresh history and see the refresh failed. What is the most likely cause?

Accepted Answer

The service principal used for authentication has expired or lacks permissions.. The correct answer is D: the service principal used for authentication has expired or lacks permissions. In a scheduled Power BI refresh, the dataset must authenticate to its data source at run time, and if the configured service principal's secret has expired or its permissions were revoked, the refresh will fail even though the schedule itself is valid. Options A and B do not fit because a missing on-premises data gateway or a time-zone mismatch would typically prevent the refresh from being scheduled or would shift its execution time, not cause a failure at the scheduled 04:00 UTC run. Option C is incorrect because Power BI schedules run on the days configured in the dataset settings, and Monday is not treated as a weekend by the service.

Answer

The on-premises data gateway is not installed.

Answer

The refresh time is set to 03:00 UTC, but the dataset is in a different time zone.

Answer

The refresh schedule only runs on weekdays, but Monday is considered a weekend in some regions.

Question 11

Refer to the exhibit. You are implementing a sensitivity label policy in Microsoft Purview for Power BI. The policy shown is intended to block users in the SalesTeam group from exporting reports with the 'Confidential' label to PDF. However, users in SalesTeam can still export PDF. What is the most likely issue?

Accepted Answer

The sensitivity label 'Confidential' has not been applied to the reports.. The most likely issue is that the sensitivity label 'Confidential' has not been applied to the reports (option A). Microsoft Purview DLP policies for Power BI only enforce export restrictions on items that actually carry the specified sensitivity label; if the reports lack the 'Confidential' label, the block action on ExportReportToPDF never triggers, so users can still export to PDF. The other options are not the likely cause: 'ExportReportToPDF' is the correct activity name for Power BI PDF export, the SalesTeam group membership is not indicated as the problem, and 'Block' is a valid action in this policy configuration.

Answer

The 'ExportReportToPDF' activity name is incorrect; it should be 'ExportToPDF'.

Answer

The SalesTeam group does not contain the users.

Answer

The 'Action' should be 'Deny' instead of 'Block'.

Question 12

Refer to the exhibit. You define an RLS role in Power BI Desktop as shown. You publish the dataset and assign the user 'user@contoso.com' to the role. When the user views a report that uses this dataset, they see no data. What is the most likely cause?

Accepted Answer

The Region values in the data have leading spaces or are not exactly 'North' (e.g., 'North ').. The correct option is D: the Region values in the data likely have leading/trailing spaces or are not exactly 'North' (e.g., 'North '), so the DAX filter [Region] = "North" evaluates to FALSE for every row and the user sees no data. Row-level security filters are applied as exact string comparisons, so any whitespace or casing difference (DAX string comparison is case-insensitive but not whitespace-insensitive) causes all rows to be excluded. Option A is wrong because role names may contain spaces; Power BI does not restrict them. Option B is wrong because RLS applies regardless of table row count. Option C is wrong because the scenario states the user was assigned to the role, so misassignment is not the most likely cause.

Answer

The role name is invalid; it must not contain spaces.

Answer

RLS is not applied in Power BI service for tables with less than 100 rows.

Answer

The user is not assigned to the role correctly.

Question 13

You are a Power BI administrator. A user reports that they receive an error 'You cannot view this report because it is not shared with you' when trying to open a report in a workspace where they are a Member. What is the most likely cause?

Accepted Answer

The report has restricted access set at the report level, and the user is not in the allowed list.. Report-level permissions are separate from workspace roles; the report owner may have restricted access to specific users. Option B is wrong because Member role allows viewing all content unless restricted. Option C is wrong because the report is in the workspace. Option D is wrong because if the user is a Member, they should be able to view unless explicitly denied.

Answer

The report is stored in a different workspace.

Answer

The user's role is Viewer, not Member.

Answer

The user's Power BI license is expired.

Question 14

Which TWO of the following are valid ways to enforce row-level security (RLS) on a Power BI dataset? (Choose two.)

Accepted Answer

Define roles and role members in Power BI Desktop using DAX filter expressions.. Option C is correct because RLS roles are authored in Power BI Desktop using DAX filter expressions (for example, [Region] = USERPRINCIPALNAME()) on tables, and role membership is then managed after publishing. Option E is correct because with DirectQuery and SSO, RLS can be enforced at the source database (for example, SQL Server row-level security or Oracle VPD) so the credentials passed through SSO determine which rows the query returns. Option A is not valid because Report Builder defines paginated report layouts and parameters, not dataset RLS. Option B is not valid because the Power BI service lets you add members to existing roles, but RLS rules themselves are created in Desktop or by using Tabular Editor/XMLA, not authored in the service. Option D is not valid because Entra ID security groups can be added as role members, but mapping groups to roles is membership management, not a way to define or enforce the RLS rules themselves.

Answer

Use Power BI Report Builder to define RLS on paginated reports.

Answer

Create RLS rules directly in the Power BI service under dataset security.

Answer

Assign users to security groups in Microsoft Entra ID and map those groups to RLS roles in the Power BI service.

Question 15

You are a Power BI administrator. A user reports that their scheduled data refresh fails every day with the error 'The credentials provided for the data source are invalid.' The user has verified the credentials are correct. What is the most likely cause?

Accepted Answer

The data source requires OAuth authentication, and the refresh token has expired.. The correct answer is B: the data source requires OAuth authentication and the refresh token has expired. In Power BI, OAuth-based connectors (such as those for SharePoint, Google Analytics, or certain cloud sources) rely on refresh tokens that expire or are revoked, causing scheduled refreshes to fail with an 'invalid credentials' error even when the user's password is unchanged. Option A is less likely because a password change would typically produce a different authentication failure and the user states credentials are correct. Option C would produce a gateway connectivity or offline error, not an invalid credentials message. Option D is incorrect because incremental refresh requires Premium or Fabric capacity for large datasets, but its absence does not cause credential errors.

Answer

The user changed their password after configuring the refresh.

Answer

The on-premises data gateway is offline.

Answer

The dataset uses incremental refresh, which requires Premium capacity.