PL-300 Manage and secure Power BI Practice Test 6 — 15 Questions

Question 1

Your organization uses Power BI Premium and wants to enforce that users can only see data relevant to their department (Sales, Marketing, Finance) using row-level security (RLS). The dataset contains a 'Department' column. You have created three RLS roles, each with a filter like [Department] = "Sales". You publish the dataset and add users to the roles. However, users in the Sales role can see all data. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The users are also assigned to workspace roles (e.g., Member) that grant them access to the dataset without RLS restrictions.. In Power BI, users assigned to workspace roles (Admin, Member, Contributor) have dataset-level permissions that bypass Row-Level Security (RLS). Since these users can access the dataset directly, RLS filters are not applied. Option A is incorrect because RLS roles are typically created in Power BI Desktop before publishing. Option B is incorrect; multiple roles combine filters using OR logic, so users in multiple roles see union of all allowed data, not all data. Option C is incorrect because RLS filters are case-insensitive by default. Option D correctly identifies that workspace roles override RLS.

Answer

The RLS roles were created in the Power BI service, not in Power BI Desktop.

Answer

The users are members of multiple RLS roles, so they see all data.

Answer

The RLS filter uses a string comparison that is case-sensitive and the data contains mixed case.

Question 2

You manage a Power BI environment. A user wants to share a dashboard with an external partner. You need to ensure the partner cannot export data or share the dashboard further. What should you do?

Accepted Answer

Add the partner as a guest user in Microsoft Entra ID and share the dashboard directly, ensuring the 'Allow recipients to share' and 'Allow users to export data' options are unchecked.. Option C is correct because adding the partner as a guest user (B2B collaboration) in Microsoft Entra ID and sharing the dashboard directly with the 'Allow recipients to share' and 'Allow users to export data' options unchecked enforces exactly the required restrictions: the external partner can view the dashboard but cannot re-share it or export its underlying data. Guest users can be granted access to specific Power BI items without giving them broader workspace permissions, keeping the sharing scope tightly controlled. Option A does not address sharing restrictions, since a composite model and app distribution do not prevent export or re-sharing. Option B would give the partner Viewer access to an entire workspace, which is broader than needed and does not disable export or re-share. Option D is wrong because 'Publish to web' makes the dashboard publicly accessible to anyone, which is the opposite of the required restriction.

Answer

Create a composite model on top of the dataset and share the report as an app.

Answer

Create a new workspace and add the partner as a Viewer.

Answer

Publish the dashboard to a public website using 'Publish to web'.

Question 3

You are a Power BI administrator. A user reports that they cannot see any data when they open a report that uses row-level security (RLS). The user is a member of the 'Sales' RLS role, which filters data to [Region] = 'North America'. However, the report shows blank visuals. What is the most likely cause?

Accepted Answer

The RLS filter uses an exact string match, but the actual region values in the data are different (e.g., 'North America' vs 'North America ' or 'NA').. If the 'North America' region name in the data does not exactly match the filter (e.g., 'North America' vs 'NA'), the filter will not match any rows. Option A is wrong because the user can see the report, just no data. Option B is wrong because RLS roles are usually defined in Desktop. Option C is wrong because the user is in the Sales role, so they should see data.

Answer

The user does not have permission to view the report.

Answer

The user is also a member of a workspace role that overrides RLS.

Answer

The RLS role was defined in the Power BI service after publishing, but the user was not added.

Question 4

You need to ensure that only the Finance team can access a specific Power BI dashboard. What is the most efficient way to accomplish this?

Accepted Answer

Share the dashboard directly with the Finance team security group, granting only 'View' permissions.. Option B is correct because sharing the dashboard directly with the Finance team security group and granting only 'View' permissions is the most efficient way to restrict access to just that team without restructuring workspaces or granting broader rights. In Power BI, direct sharing lets you target a specific security group and assign read-only access, which matches the requirement precisely. Option A is unnecessary because creating and moving content to a new workspace is more overhead than simply sharing the existing dashboard. Option C is wrong because workspace Admins get full control over the workspace, far more access than the Finance team needs. Option D is also overkill, since publishing an app and configuring an audience involves more setup than direct sharing for a single dashboard.

Answer

Create a new workspace, add the Finance team as Members, and move the dashboard to that workspace.

Answer

Add the Finance team as Admins of the workspace containing the dashboard.

Answer

Publish the dashboard as an app and assign the Finance team as the audience.

Question 5

Refer to the exhibit. You are configuring a Microsoft Purview Data Loss Prevention (DLP) policy for Power BI. The policy rule shown is intended to block downloads from datasets that have the 'Confidential' sensitivity label and are sourced from SharePoint or SQL Server. However, users are still able to download data from these datasets. What is the most likely reason?

Accepted Answer

The condition uses 'dataSource' which is not a valid property in Power BI DLP policies.. The 'dataSource' property is not a valid condition in Power BI DLP policies. DLP policies for Power BI support conditions based on sensitivity labels and specific workspace/dataset properties, but not data source (e.g., SharePoint or SQL Server). The policy rule as shown uses an invalid condition, so the rule is ignored, allowing downloads. Option A is wrong because 'datasets' is a valid target. Option B is wrong because 'blockDownload' is a valid action. Option D is wrong because the conditions are correctly separated by the 'and' logic in the policy editor.

Answer

The target should be 'reports' instead of 'datasets'.

Answer

The action 'blockDownload' is not a valid action; the correct action should be 'Block' or 'BlockDownload' might require additional configuration.

Answer

The policy rule is missing the 'and' operator between the two conditions.

Question 6

You are the Power BI administrator for Contoso Ltd. The company has a Premium capacity workspace named 'Sales Analytics' that contains a dataset named 'SalesData' and several reports. The dataset uses DirectQuery to an Azure SQL Database. Row-level security (RLS) is configured in Power BI Desktop with roles: 'SalesManager' (filters to SalesManager rows), 'SalesRep' (filters to SalesRep rows). After publishing, you assign users to the roles in the Power BI service. However, when a user assigned to the 'SalesRep' role opens a report, they see all data instead of only their own rows. You have verified that the RLS role definition is correct and that the user is the only member of the 'SalesRep' role. The user has no other workspace permissions. The dataset is set to use single sign-on (SSO) for the DirectQuery connection. What is the most likely cause of the issue?

Accepted Answer

Change the dataset storage mode from DirectQuery to Import.. The user sees all data despite being assigned to the 'SalesRep' RLS role because the dataset uses DirectQuery with SSO. With DirectQuery, Power BI RLS is applied in addition to any source-level security. However, if SSO is enabled, the user's own identity is passed to the data source, which may bypass the Power BI RLS if the source returns all rows (e.g., no row-level filtering at the source). Changing the storage mode to Import ensures that RLS is enforced entirely within Power BI, as the data is loaded into memory and filtered based on the user's role. Options A, B, and D are incorrect: A suggests configuring RLS at the database level, but the issue is that Power BI RLS should already be applied; B recommends adding the user to multiple roles, which would actually broaden access; D removing the user from the role and adding as Viewer does not enforce RLS.

Answer

Configure RLS in the Azure SQL Database itself using security predicates or views that filter based on the user's identity (e.g., USER_NAME() or SUSER_SNAME()).

Answer

Add the user to multiple RLS roles to ensure the filters are applied.

Answer

Remove the user from the 'SalesRep' role and add them as a Viewer on the workspace to force RLS.

Question 7

You are a Power BI administrator for a large enterprise. The organization uses Microsoft Purview Information Protection sensitivity labels. You have enabled sensitivity labels in the Power BI admin portal and published labels in the Microsoft 365 Compliance Center. Users have been assigned the appropriate licenses. However, when a user tries to apply a sensitivity label to a report in the Power BI service, the label options are grayed out. The user has a Power BI Pro license and is a Member of the workspace where the report resides. The report is stored in a workspace that is backed by a Premium capacity. What is the most likely reason the user cannot apply the label?

Accepted Answer

The user does not have the required Azure Rights Management (Azure RMS) license or permissions to apply labels.. The correct answer is A: the user lacks the required Azure Rights Management (Azure RMS) license or permissions to apply labels. Even when sensitivity labels are enabled in the Power BI admin portal, published in the Microsoft 365 Compliance Center, and the user has a Power BI Pro license, applying a label requires the user to be licensed and enabled for Azure Information Protection/Azure RMS so the label's encryption and protection can be enforced. Without that RMS entitlement, the label picker in the Power BI service appears grayed out. Option B is unlikely because the scenario states labels were published in the Compliance Center and users were assigned appropriate licenses, and the issue is specifically the RMS protection dependency. Option C is incorrect because sensitivity labels are enabled tenant-wide via the Power BI admin portal, not per workspace. Option D is incorrect because workspace roles such as Member or Contributor are not the gating factor for applying sensitivity labels; the RMS license/permission is.

Answer

The sensitivity labels have not been published to the user's security group.

Answer

The workspace is not enabled for sensitivity labels; you need to enable labels at the workspace level.

Answer

The user's role in the workspace is insufficient; they need at least Contributor role to apply labels.

Question 8

A data analyst publishes a Power BI dataset to a Premium workspace and grants 'Build' permission to a group of report creators. One report creator complains that they cannot see certain tables in the dataset when building a new report. What is the most likely cause?

Accepted Answer

Object-level security (OLS) is configured on the dataset, hiding some tables.. Object-level security (OLS) can hide entire tables or columns from users based on their roles. With Build permission, if OLS is configured, a user may not see certain tables, even if they have access to the dataset. Row-level security (RLS), on the other hand, filters rows but does not hide tables, so D is the correct answer. Option A is incorrect because direct query permissions to the data source are not required for building reports from a dataset; Build permission on the dataset is sufficient. Option B is incorrect because the user already has Build permission. Option C is incorrect as service principal authentication is irrelevant to table visibility in this context.

Answer

The user lacks direct query permissions to the underlying data source.

Answer

The user does not have 'Build' permission on the dataset.

Answer

The dataset is configured with service principal authentication, and the user is not using a service principal.

Question 9

A Power BI report uses a DirectQuery dataset connected to an Azure SQL Database. Users report that the report takes over 30 seconds to load. You need to improve performance without changing the data model. What should you recommend?

Accepted Answer

Enable 'Reduce cardinality by using aggregation' in the dataset settings.. In DirectQuery mode, Power BI pushes queries to the source and the visual's performance is dominated by the number of rows and the granularity of data returned. Enabling 'Reduce cardinality by using aggregation' (the aggregation table / automatic aggregations feature) lets Power BI cache pre-aggregated results and serve many visuals from the in-memory cache instead of hitting Azure SQL for every query, cutting load time without altering the model's structure. This is the only option that improves performance while keeping the DirectQuery dataset intact.

Answer

Increase the 'Maximum connections per user' setting in the Premium capacity.

Answer

Convert the dataset to Import mode.

Answer

Disable 'Cross-report data binding' in the report settings.

Question 10

You manage a Power BI environment where users frequently share reports by sending the URL from the browser. However, external recipients often receive an error saying they cannot access the report. What is the most likely reason?

Accepted Answer

The 'Share content with external users' setting is disabled in the tenant.. The 'Share content with external users' setting is disabled in the tenant. In Power BI, the tenant admin controls external sharing via the 'Allow external users to receive shares' / 'Share content with external users' setting in the Admin portal, and when it is disabled, recipients outside the organization get an access error even if the URL is valid. Option B is not the most likely cause because external recipients can be granted access through guest users or B2B collaboration without needing their own Pro license in many scenarios. Option C is not the root cause because external users are expected to be outside the tenant, and Power BI supports sharing with them via Microsoft Entra B2B guest accounts. Option D is unlikely because the users are sharing a browser URL from a report that is already accessible in the Power BI service.

Answer

External users do not have a Power BI Pro license.

Answer

External users are not part of the same Microsoft Entra tenant.

Answer

The report is not published to the Power BI service.

Question 11

A company uses Power BI Premium with a capacity-based license. The capacity is frequently reaching its memory limit, causing reports to be evicted. You need to reduce memory pressure on the capacity. What should you do?

Accepted Answer

Enable the 'Large dataset storage format' for all datasets.. Enabling the Large dataset storage format reduces memory pressure by offloading dataset storage to disk, allowing the model to exceed memory limits without keeping the entire dataset in memory. RLS (D) limits data per user at query time but does not reduce the in-memory dataset size and may even increase processing overhead. Moving datasets to shared capacity (B) would not reduce pressure on the Premium capacity and may degrade performance. Increasing refresh frequency (C) increases memory usage during refresh, making memory pressure worse.

Answer

Move all datasets to a shared capacity.

Answer

Increase the scheduled refresh frequency to every hour.

Answer

Implement row-level security (RLS) to limit data loaded per user.

Question 12

You need to ensure that a Power BI report containing sensitive financial data is not accessible to users outside your organization. The report is published to a workspace in the Power BI service. What should you do?

Accepted Answer

Disable 'Allow external sharing' in the Power BI admin portal.. The correct option is C: disabling 'Allow external sharing' in the Power BI admin portal prevents users from sharing reports with external users, which directly addresses the requirement that the sensitive financial report not be accessible outside the organization. This tenant-level setting blocks external sharing of Power BI content, ensuring only internal users can access the published report. Option A is not a valid security control and removes the report from the governed Power BI service. Option B, applying a 'Highly Confidential' sensitivity label, helps classify and protect data but does not by itself prevent external sharing. Option D, disabling 'Publish to web', only blocks public embedding of reports and does not stop authenticated external sharing.

Answer

Remove the report from the Power BI service and distribute it via email.

Answer

Apply a sensitivity label of 'Highly Confidential' to the report.

Answer

Disable 'Publish to web' in the tenant settings.

Question 13

Your organization uses Microsoft Entra ID for identity management. You have a Power BI dataset that uses DirectQuery to an Azure Analysis Services (AAS) model. The AAS model is configured to use service principal authentication. Users report that when they open a report connected to this dataset, they see an error: 'Cannot connect to the data source. The credentials provided are invalid.' What is the most likely cause?

Accepted Answer

The service principal secret or certificate used for authentication has expired.. The service principal credentials may have expired or been revoked, leading to invalid credentials. Option B is incorrect because the error indicates invalid credentials (authentication failure), not an issue with row-level security (authorization). Option C is incorrect because lacking 'Read' permissions would cause an authorization error, not an invalid credentials error. Option D is incorrect because the dataset uses DirectQuery, so there is no scheduled refresh; the error is unrelated to import mode.

Answer

Row-level security (RLS) on the AAS model is not configured correctly.

Answer

The service principal does not have 'Read' permission on the AAS model.

Answer

The dataset is in Import mode and requires a scheduled refresh.

Question 14

Which TWO of the following are required to configure a Power BI deployment pipeline?

Accepted Answer

The user must be a workspace admin.. Option A is correct because configuring and managing a deployment pipeline requires the user to be an admin of the workspaces assigned to the pipeline stages, since only workspace admins can add workspaces to pipeline stages and deploy content between them. Option C is correct because deployment pipelines require the workspaces to reside on Premium capacity or Premium Per User (PPU) capacity; they are not supported on shared (Pro-only) capacity. Option B is not required because pipeline configuration is performed in the Power BI service (browser), not in Power BI Desktop. Option D is not required because while users need a Pro or PPU license to access workspaces, the question asks about configuring the pipeline itself, and a Pro license for all users is not a prerequisite for pipeline configuration. Option E is not required because 'Build' permission on a dataset is unrelated to creating or configuring a deployment pipeline; pipeline management depends on workspace admin rights and Premium/PPU capacity.

Answer

Power BI Desktop installed on the admin's machine.

Answer

A Power BI Pro license for all users.

Answer

Users must have 'Build' permission on the dataset.

Question 15

Which THREE of the following are valid methods to secure a Power BI dataset at the row level?

Accepted Answer

Row-level security using the USERPRINCIPALNAME() DAX function.. Options A, C, and E are correct. Static RLS uses roles defined in Power BI Desktop. Dynamic RLS uses USERNAME() or USERPRINCIPALNAME() to filter data based on the logged-in user. Object-level security (OLS) is for table/column security, not row-level. Option B is wrong because Azure RBAC is for managing access to Azure resources, not for Power BI row-level security.

Answer

Azure role-based access control (Azure RBAC) on the data source.

Answer

Object-level security (OLS) to restrict access to specific columns.