PL-300 Manage and secure Power BI Practice Test 6 — 15 Questions

Question 1

A company is deploying Power BI for the entire organization. They need to prevent users from sharing reports with external email addresses. Which configuration should the Power BI admin use?

Accepted Answer

Disable 'Share content with external users' in the Power BI admin portal.. Option D is correct because the admin portal has a setting to control sharing with external users. Option A is wrong because tenant-level sharing settings are in the admin portal, not Microsoft Entra ID. Option B is wrong because sensitivity labels classify data but do not block sharing. Option C is wrong because sharing settings are not in workspace settings.

Answer

Configure a Conditional Access policy in Microsoft Entra ID.

Answer

Apply a Microsoft Purview sensitivity label.

Answer

Set the workspace sharing settings to 'Only existing users'.

Question 2

A Power BI dataset uses DirectQuery to a Snowflake data warehouse. Users report that the report takes more than 5 minutes to load. The dataset has complex DAX measures. The admin wants to improve performance without changing the data source. Which action is most effective?

Accepted Answer

Reduce the number of visuals and simplify measures.. Option B is correct because reducing the number of visuals and simplifying measures can significantly reduce query time. Option A is wrong because Import mode would change the source architecture. Option C is wrong because aggregations help but building them requires changes. Option D is wrong because increasing capacity does not optimize query performance.

Answer

Create aggregations in the dataset.

Answer

Switch the dataset to Import mode and schedule refresh.

Answer

Increase the Power BI Premium capacity size.

Question 3

A Power BI admin needs to audit which users have accessed a specific report in the last 30 days. Which log should the admin use?

Accepted Answer

Power BI activity log (audit log) in the Power BI admin portal.. Option A is correct because the Power BI activity log captures user access events. Option B is wrong because the audit log in Microsoft 365 Defender may not have detailed Power BI access events. Option C is wrong because usage metrics reports show view counts but not per-user details. Option D is wrong because the Microsoft Purview audit log is for compliance, not detailed access logs.

Answer

Microsoft Defender XDR audit log.

Answer

Power BI usage metrics report.

Answer

Microsoft Purview audit log.

Question 4

A company has Power BI Premium capacity. They want to allow developers to deploy datasets using the XMLA endpoint with a service principal. What must the admin configure?

Accepted Answer

Enable service principal access in the Power BI admin portal under 'Developer settings'.. Option C is correct because service principals need to be enabled in the capacity settings and assigned to the workspace. Option A is wrong because service principals need specific permissions, not just reader. Option B is wrong because the gateway is not required for cloud sources. Option D is wrong because app registration is needed but enabling in capacity is the key step.

Answer

Install an on-premises data gateway.

Answer

Add the service principal as a member of the workspace.

Answer

Create an app registration in Microsoft Entra ID.

Question 5

A Power BI report uses a composite model combining Import and DirectQuery sources. When a user filters a visual, the report takes a long time to update. The admin wants to diagnose performance issues. Which tool should the admin use?

Accepted Answer

Performance Analyzer in Power BI Desktop.. Option C is correct because Performance Analyzer shows query durations for each visual, helping identify slow queries. Option A is wrong because DAX Studio analyzes DAX queries but not the full report performance. Option B is wrong because the activity log shows events but not query-level details. Option D is wrong because the gateway log is for gateway activities.

Answer

DAX Studio.

Answer

Power BI activity log.

Answer

On-premises data gateway log.

Question 6

A data analyst creates a Power BI report using a dataset that contains sensitive salary information. The analyst needs to ensure that only HR managers can see salary columns. What should the analyst use?

Accepted Answer

Object-level security (OLS).. Option B is correct because object-level security (OLS) hides columns from specific roles. Option A is wrong because RLS filters rows, not columns. Option C is wrong because sensitivity labels are for classification, not access control. Option D is wrong because the dataset's security settings do not support column-level security natively.

Answer

Row-level security (RLS).

Answer

Microsoft Purview sensitivity labels.

Answer

Set the dataset security to 'Restrict access'.

Question 7

Which TWO actions should a Power BI admin take to ensure compliance with data residency requirements? (Choose two.)

Accepted Answer

Configure the default storage location in the Power BI admin portal.. Options A and D are correct because data residency can be controlled by choosing the region where the tenant is created and by using Multi-Geo capabilities for Premium capacities. Option B is wrong because data is stored in the region of the capacity. Option C is wrong because the admin portal does not allow users to choose residency. Option E is wrong because Azure Data Lake is not a storage for Power BI data.

Answer

Enable 'Data residency' settings in the admin portal.

Answer

Use Power BI Report Server for on-premises data.

Answer

Store datasets in Azure Data Lake Storage.

Question 8

Which THREE conditions are required to use a service principal with Power BI? (Choose three.)

Accepted Answer

The service principal must have a Power BI Pro or Premium Per User license.. Options A, C, and E are correct. A: Service principal must have a Power BI license (Pro or Premium Per User). C: The service principal must be enabled in the admin portal. E: Service principal must be a member of the workspace. Option B is wrong because a gateway is not required. Option D is wrong because XMLA endpoints are not required for all operations.

Answer

An on-premises data gateway must be installed.

Answer

The service principal must use XMLA endpoints.

Question 9

Which TWO methods can a Power BI admin use to enforce the use of sensitivity labels on reports? (Choose two.)

Accepted Answer

Apply labels automatically using Microsoft Purview Information Protection.. Options A and D are correct because the admin can enable mandatory labeling in the admin portal and use Microsoft Purview Information Protection to apply labels. Option B is wrong because labels are not applied in Power BI Desktop. Option C is wrong because RLS does not enforce labels. Option E is wrong because there is no such policy in Microsoft Intune.

Answer

Deploy a Microsoft Intune policy to block unlabeled reports.

Answer

Configure default labels in Power BI Desktop.

Answer

Use row-level security to hide unlabeled reports.

Question 10

Refer to the exhibit. A Power BI dataset uses a service principal to connect to an Azure SQL Database. The dataset fails to refresh with an authentication error. What is the most likely cause?

Accepted Answer

The service principal credentials are not configured in the data gateway.. Option C is correct because the service principal (client secret or certificate) must be stored in the gateway cluster credentials. Option A is wrong because the database name is correct. Option B is wrong because server name is correct. Option D is wrong because service principal has an ID, but the password/secret is missing from the exhibit; the credentials need to be configured in the gateway.

Answer

The database name is incorrect.

Answer

The service principal ID is invalid.

Answer

The server name is incorrect.

Question 11

Refer to the exhibit. A user is a member of both 'HRManager' and 'Executive' RLS roles. The dataset uses DirectQuery. When the user views a report showing all employees, what data will they see?

Accepted Answer

Rows where Department is 'HR' or 'Executive' (union).. Option B is correct because in Power BI, when a user belongs to multiple RLS roles, the filters are combined using OR logic, so the user sees rows satisfying either role. Option A is wrong because it would require intersection (AND). Option C is wrong because all rows are not returned. Option D is wrong because both roles are applied.

Answer

All rows in the Employees table.

Answer

Only rows where Department is both 'HR' and 'Executive' (intersection).

Answer

No rows because roles conflict.

Question 12

Refer to the exhibit. User2 wants to add a new user to the Finance workspace. Can User2 perform this action, and why?

Accepted Answer

No, because only Admins can add users.. Option B is correct because only workspace Admins can add users. User2 is a Member, which does not include the permission to manage membership. Option A is wrong because Contributors cannot add users. Option C is wrong because Member cannot add users. Option D is wrong because the capacity does not affect workspace membership permissions.

Answer

Yes, because User2 is a Contributor.

Answer

Yes, because User2 is a Member.

Answer

No, because the Premium capacity does not allow adding users.

Question 13

Your organization uses Power BI Premium per capacity. You need to ensure that only users from a specific Microsoft Entra ID security group can access the Power BI service. What should you do?

Accepted Answer

Configure the Power BI tenant settings to 'Allow users to access Power BI service' and specify the security group.. Option A is correct because enabling tenant-level integration with Microsoft Entra ID allows restricting access to specific security groups. Option B is wrong because disabling public sharing doesn't restrict access. Option C is wrong because app security groups are for workspace access, not tenant access. Option D is wrong because capacity settings control resources, not user access.

Answer

Disable the 'Publish to web' setting in the tenant admin portal.

Answer

Set the capacity to a different SKU.

Answer

Create a security group in the workspace and add users to that group.

Question 14

You have a Power BI report that uses a dataset with row-level security (RLS) roles defined. Users report that they see no data when viewing the report. Which two checks should you perform first? (Assume all other configurations are correct.)

Accepted Answer

Verify that the dataset has the RLS roles applied and published.. Option A is correct because RLS roles must be applied to the dataset. Option D is correct because users must be members of the RLS role. Option B is wrong because app permissions are for sharing, not RLS. Option C is wrong because capacity is unrelated. Option E is wrong because the RLS role name is case-insensitive.

Answer

Confirm that the workspace is assigned to a Premium capacity.

Answer

Check that the report is published to a Power BI app.

Answer

Verify that the RLS role name matches exactly with the username.

Question 15

Your organization is implementing a data security strategy for Power BI. You need to ensure that sensitive data in datasets is protected at rest using customer-managed keys (CMK). What prerequisite must be met?

Accepted Answer

The workspace must be assigned to a Premium capacity (P or EM SKU).. Option B is correct because Power BI Premium capacity with reserved capacity is required for CMK. Option A is wrong because CMK is not available in shared capacity. Option C is wrong because Azure Key Vault is needed but not sufficient alone. Option D is wrong because Bring Your Own Key (BYOK) is for encryption keys, not CMK.

Answer

Azure Purview must be configured for the tenant.

Answer

The Power BI tenant must be in a shared capacity.

Answer

The organization must use Bring Your Own Key (BYOK) for SQL Server.