PL-300 Manage and secure Power BI Practice Test 6 — 15 Questions

Question 1

You have a Power BI report that uses a dataset with row-level security (RLS) roles defined. Users report that they see no data when viewing the report. Which two checks should you perform first? (Assume all other configurations are correct.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the dataset has the RLS roles applied and published.. RLS roles must be applied and published to the dataset for them to take effect. Option D is correct because users must be assigned as members of the appropriate RLS role to see data. Option A is incorrect because RLS works in any workspace capacity, not just Premium. Option B is incorrect because an app publishes reports but does not control RLS membership. Option E is incorrect because RLS role membership is based on user security groups or email addresses, not a matching role name with username.

Answer

Confirm that the workspace is assigned to a Premium capacity.

Answer

Check that the report is published to a Power BI app.

Answer

Verify that the RLS role name matches exactly with the username.

Question 2

Your organization is implementing a data security strategy for Power BI. You need to ensure that sensitive data in datasets is protected at rest using customer-managed keys (CMK). What prerequisite must be met?

Accepted Answer

The workspace must be assigned to a Premium capacity (P or EM SKU).. Customer-Managed Key (CMK) for Power BI datasets at rest requires a Premium capacity (P or EM SKU) workspace. This is a prerequisite because CMK is only available in Premium capacities, not shared capacity. Option B is incorrect because Azure Purview is not a prerequisite; it is a data governance service unrelated to CMK. Option C is incorrect because shared capacity does not support CMK. Option D is incorrect because BYOK for SQL Server is a separate capability and not required for Power BI CMK.

Answer

Azure Purview must be configured for the tenant.

Answer

The Power BI tenant must be in a shared capacity.

Answer

The organization must use Bring Your Own Key (BYOK) for SQL Server.

Question 3

Refer to the exhibit. You are configuring row-level security (RLS) for a Power BI dataset. The JSON shows a role named 'RegionManager' with a filter expression. Users assigned to this role complain that they see all regions instead of only 'North'. What is the likely cause?

Accepted Answer

The filter expression uses incorrect DAX syntax; it should reference the table name, e.g., 'Sales[Region] = "North"'.. In Power BI RLS, filter expressions must reference columns with the full table name, e.g., 'Sales[Region] = "North"'. The JSON shows '[Region] = "North"', which lacks the table name and thus is invalid DAX syntax. Option A is incorrect because 'Read' permission is sufficient for RLS to filter data; 'ReadAndExplore' is not required. Option B is incorrect because role names are not case-sensitive in Power BI RLS. Option C is incorrect because RLS filters use DAX, not M language.

Answer

The 'Read' permission should be 'ReadAndExplore' to apply filters.

Answer

The role name 'RegionManager' is case-sensitive and must match the user's group name.

Answer

The filter expression is written in M language, which is not supported for RLS.

Question 4

You are a Power BI administrator. You need to prevent users from exporting underlying data from reports. Which tenant setting should you disable?

Accepted Answer

'Export data'. 'Export data' controls the ability to export underlying data. Option B is wrong because 'Export reports as PowerPoint' is for exporting the report itself. Option C is wrong because 'Export reports as PDF' is for static exports. Option D is wrong because 'Export reports as MHTML' is also for report export.

Answer

'Export reports as PowerPoint presentations'

Answer

'Export reports as PDF files'

Answer

'Export reports as MHTML files'

Question 5

Your organization has a Power BI Premium capacity. You need to ensure that data refresh operations for a specific dataset are not interrupted during peak hours. What should you configure?

Accepted Answer

Configure a 'priority' rule in the capacity workload settings for data refresh.. In Power BI Premium capacity, you can configure priority rules in the capacity workload settings for data refresh. Priority levels ensure that high-priority datasets receive resources even during peak hours, preventing interruptions. Option C is incorrect because increasing the capacity SKU adds cost and may not be necessary; priority rules provide a more targeted solution. Option A is incorrect because disabling scheduled refresh stops all automatic refreshes, causing interruption. Option B is incorrect because manual refresh still faces resource contention and does not guarantee uninterrupted execution during peak hours.

Answer

Disable scheduled refresh for the dataset.

Answer

Set the dataset to 'Refresh now' manually during off-peak hours.

Answer

Increase the capacity size to a higher SKU.

Question 6

Your organization uses Microsoft Teams to collaborate on Power BI reports. You need to ensure that only members of a specific team can view a report embedded in a Teams tab. What should you do?

Accepted Answer

Share the report directly with the team in Microsoft Entra ID.. Sharing the report with the team in Microsoft Entra ID ensures that only members of that specific team can view the report embedded in the Teams tab. This method leverages Azure AD groups to control access. Option B is incorrect because assigning the team owner as the report owner does not grant access to all team members. Option C is incorrect because setting the report to 'Public' would allow anyone with the link to view it, not just the team. Option D is incorrect because adding the team to the workspace as a 'Member' gives them workspace-level access, which may include other reports and datasets, and does not specifically restrict viewing to a single report embedded in Teams.

Answer

Assign the team owner as the report owner.

Answer

Set the report to 'Public' in the tenant settings.

Answer

Add the team to the workspace as a 'Member' role.

Question 7

Refer to the exhibit. You are troubleshooting an RLS configuration. The role 'SalesManager' is intended to restrict the user 'salesmanager@contoso.com' to see only their data. However, the user sees all data. What is the most likely issue?

Accepted Answer

The filter expression compares the user's UPN to a static string, but there is no column in the table to filter against.. The filter expression uses DAX's USERPRINCIPALNAME() to retrieve the current user's UPN, but then compares it to a static string 'salesmanager@contoso.com'. For Row-Level Security (RLS) to work, the filter must compare a column in the table (e.g., a 'UserEmail' column) to the function result. Since no such column exists, the filter cannot restrict any rows, and the user sees all data. Option A is incorrect because removing USERPRINCIPALNAME() would not help; the core issue is the missing column. Option C is incorrect because DirectQuery does support RLS as long as the filter uses valid columns. Option D is incorrect because 'Read' permission is sufficient for RLS; changing to 'ReadAndExplore' is not necessary.

Answer

The filter expression should be '= "salesmanager@contoso.com"' without USERPRINCIPALNAME().

Answer

The dataset is using DirectQuery, which does not support RLS.

Answer

The model permission should be 'ReadAndExplore' instead of 'Read'.

Question 8

Your organization is deploying Power BI content to multiple stages (dev, test, prod) using deployment pipelines. You need to ensure that test data is not visible to production users. What is the best approach?

Accepted Answer

Use deployment pipelines with separate datasets per stage and configure data source parameters to point to different databases.. Deployment pipelines in Power BI support assigning separate datasets to each stage. By configuring data source parameters to point to different databases (e.g., dev, test, prod), you ensure that production users never see test data. Option A is incorrect because manually replacing the dataset is error-prone and not scalable. Option B is incorrect because row-level security (RLS) filters rows within a single dataset, but does not prevent test data from being in the production dataset entirely. Option C is incorrect because using separate Power BI tenants is unnecessary and overly complex; deployment pipelines within a single tenant provide the required isolation.

Answer

Manually replace the dataset in the production workspace after deployment.

Answer

Apply row-level security to filter test data in production.

Answer

Create separate Power BI tenants for each stage.

Question 9

You need to audit Power BI activity for compliance. Which tool should you use to access detailed logs of user actions?

Accepted Answer

Microsoft Purview compliance portal (Audit). Microsoft Purview compliance portal (Audit) provides unified audit logs that capture detailed user actions in Power BI, such as viewing reports, creating dashboards, and accessing data. Option A is incorrect because Microsoft Defender XDR is primarily used for threat detection and security monitoring, not for compliance auditing of user actions. Option C is incorrect because Microsoft Purview Data Map is designed for data cataloging and mapping, not for auditing user activities. Option D is incorrect because the Power BI Premium capacity metrics app is used to monitor performance and capacity utilization, not to access detailed audit logs of user actions.

Answer

Microsoft Defender XDR

Answer

Microsoft Purview Data Map

Answer

Power BI Premium capacity metrics app

Question 10

Your organization uses Power BI Premium per user. You need to ensure that a specific report is only accessible via a Power BI app and not directly in the workspace. What should you do?

Accepted Answer

In the workspace settings, set 'Allow users to access the workspace content directly' to disabled.. Disabling 'Allow users to access the workspace content directly' in workspace settings restricts users from accessing reports directly in the workspace, forcing them to use the Power BI app. Option B is incorrect because removing users from the workspace role removes their direct workspace access but does not affect their app access; app access is managed separately, so this does not ensure the report is accessible only via the app unless app access is explicitly granted. Option C is incorrect because moving the report to a different workspace does not prevent direct access in that workspace. Option D is incorrect because sharing the report only with app users does not prevent direct access in the workspace.

Answer

Remove the users from the workspace role.

Answer

Publish the report to a different workspace.

Answer

Share the report only with the app users.

Question 11

You have a Power BI dataset that connects to an Azure SQL Database. You need to use single sign-on (SSO) so that users' identities are passed to the database. What authentication method should you configure?

Accepted Answer

OAuth2 with Microsoft Entra ID. OAuth2 with Microsoft Entra ID, is correct because it enables single sign-on (SSO) by passing the user's identity from Power BI to the Azure SQL Database. Windows authentication (A) is for on-premises environments and does not work with Azure SQL Database. Key authentication (B) is used for Azure Storage, not SQL Database. Basic authentication with a service account (D) uses a fixed identity and does not provide SSO.

Answer

Windows authentication

Answer

Key authentication

Answer

Basic authentication with a service account

Question 12

An Azure Policy is applied to your subscription with a rule that denies the creation or update of Power BI workspaces if the workspace SKU equals 'Premium'. What is the effect of this policy on Power BI workspaces?

Accepted Answer

It denies creation or update of workspaces assigned to Premium capacity.. The Azure Policy denies creation or update of workspaces with a 'Premium' SKU, meaning workspaces assigned to Premium capacity are denied. Option B is incorrect because the policy only applies to Premium capacity, not all workspaces. Option C is incorrect because the policy denies Premium workspaces, not non-Premium. Option D is incorrect because the policy applies to Premium, not Premium per user (PPU).

Answer

It denies creation of any new Power BI workspace.

Answer

It denies creation of workspaces that are not Premium.

Answer

It allows workspaces with Premium per user (PPU) SKU.

Question 13

Your organization uses Microsoft Intune to manage devices. You need to ensure that Power BI reports can only be viewed on managed devices that are compliant with company policies. What should you configure?

Accepted Answer

Conditional Access policy in Microsoft Entra ID requiring device compliance.. Conditional Access policies in Microsoft Entra ID can require that devices are compliant with company policies (e.g., via Intune compliance policies). This ensures Power BI reports are only accessible on managed, compliant devices. Option A is incorrect because there is no 'Restrict access to mobile devices' setting in Power BI Premium capacity. Option C is incorrect because requiring users to sign in with Microsoft Entra ID does not enforce device compliance. Option D is incorrect because MAM policies protect app data, not device compliance for accessing reports.

Answer

Power BI Premium capacity setting 'Restrict access to mobile devices'.

Answer

Power BI tenant setting 'Require users to sign in with Microsoft Entra ID'.

Answer

Mobile app management (MAM) policy in Microsoft Intune.

Question 14

You are a Power BI administrator. A user reports that they cannot see a specific dataset in the Power BI service, even though they have been assigned the 'Contributor' role on the workspace containing that dataset. The dataset was created by another user. What is most likely the cause?

Accepted Answer

The user needs 'Build' permission on the dataset.. The 'Contributor' role in a Power BI workspace allows users to edit and delete content, but does not grant implicit visibility to datasets created by others. To view a dataset created by another user, the 'Build' permission is required on that dataset. This permission allows the user to see the dataset in the workspace and use it to build reports. Without 'Build' permission, the dataset is hidden from the user. Option A is therefore correct. Option B is incorrect because the user's license (Pro or Premium Per User) does not affect visibility of datasets; it affects features available. Option C is incorrect because the dataset is in the same workspace, not published as an app. Option D is incorrect because 'Viewer' role would actually reduce access; 'Contributor' already includes read access.

Answer

The user's Power BI license is insufficient.

Answer

The dataset is published as an app and the user has not installed the app.

Answer

The user needs to be assigned the 'Viewer' role on the workspace.

Question 15

Your organization uses row-level security (RLS) in Power BI. You have a table 'Sales' with a column 'Region'. You define a role 'RegionManagers' with the filter: [Region] = "North". A user named Alice is a member of this role. However, when Alice views a report that uses this dataset, she sees all regions. What is the most likely reason?

Accepted Answer

Alice is the dataset owner.. The most likely reason is that Alice is the dataset owner. Dataset owners (or users with Build permission) bypass RLS and see all data. Option B is correct. Option A is incorrect because RLS works in DirectQuery mode. Option C is incorrect because static filters are valid; USERNAME()/USERPRINCIPALNAME() is only needed for dynamic RLS. Option D is incorrect because RLS applies in the Power BI service.

Answer

The dataset uses DirectQuery mode, which does not support RLS.

Answer

The filter must use USERNAME() or USERPRINCIPALNAME() function.

Answer

RLS is only applied in Power BI Desktop, not in the service.