PL-300 Manage and secure Power BI Practice Test 7 — 15 Questions

Question 1

Which TWO of the following actions can be performed by a user who has the 'Contributor' role on a Power BI workspace?

Accepted Answer

Create new reports and dashboards in the workspace.. Options B and C are correct. Contributors can create and edit content in the workspace, and they can share items (like reports) with others if sharing is enabled by the admin. Option A is wrong because only admins can update the workspace description. Option D is wrong because only admins can add members to the workspace. Option E is wrong because only admins can delete the workspace.

Answer

Update the workspace description.

Answer

Delete the workspace.

Answer

Add new members to the workspace.

Question 2

You are a Power BI administrator for a large enterprise. The company has a Premium capacity (P3) that hosts over 200 datasets and 500 reports. Recently, users have reported that some reports take a long time to load, and the capacity metrics show high CPU usage during business hours. You need to optimize the capacity performance without adding additional capacity. The business requires that all reports remain available during business hours (9 AM to 5 PM). You have the following options:

A. Enable 'Autoscale' on the Premium capacity to automatically add additional v-cores during peak times.
B. Implement a 'Query caching' policy for frequently used datasets.
C. Move all datasets to shared capacity to reduce Premium load.
D. Schedule dataset refreshes to occur only during business hours.

Which option should you choose?

Accepted Answer

Implement a 'Query caching' policy for frequently used datasets.. Implementing a query caching policy for frequently used datasets reduces CPU usage by storing query results in cache, improving report load times without adding capacity. Option A is wrong because Autoscale adds additional v-cores during peak times, increasing cost. Option C is wrong because moving datasets to shared capacity would degrade performance due to lower limits. Option D is wrong because scheduling refreshes during business hours would increase CPU usage during peak times, worsening performance.

Answer

Enable 'Autoscale' on the Premium capacity to automatically add additional v-cores during peak times.

Answer

Move all datasets to shared capacity to reduce Premium load.

Answer

Schedule dataset refreshes to occur only during business hours.

Question 3

You are a Power BI data analyst at a financial services company. You have created a Power BI dataset that uses a live connection to an Azure Analysis Services (AAS) tabular model. The AAS model contains sensitive financial data. You need to implement row-level security (RLS) such that each user can only see data for their assigned region. The user's region is stored in a SQL Server database table called 'UserRegion' that maps user principal names (UPNs) to region IDs. The AAS model already has a 'Region' dimension table with a 'RegionID' column. You are not allowed to modify the AAS model. What should you do?

Accepted Answer

In Power BI Desktop, import the 'UserRegion' table from SQL Server and define an RLS role that filters the 'Region' table using the USERPRINCIPALNAME() function.. The correct answer is C: importing the 'UserRegion' table into the Power BI Desktop model and defining an RLS role that filters the 'Region' table using USERPRINCIPALNAME(). Because the dataset uses a live connection to AAS, RLS must be defined in the Power BI dataset (not in AAS), and USERPRINCIPALNAME() returns the signed-in user's UPN, which can be matched against the UPN column in the imported 'UserRegion' table to filter the 'Region' dimension by RegionID. Option A is wrong because Power Query filtering is static and cannot dynamically evaluate the current user at query time for RLS. Option B is wrong because the scenario forbids modifying the AAS model, and USERNAME() in AAS would require model changes. Option D is also wrong because it requires modifying the AAS model, which is explicitly not allowed.

Answer

Use Power Query to filter the 'Region' table based on the current user's region stored in the SQL database.

Answer

Define RLS roles directly in the AAS model using the USERNAME() function.

Answer

Modify the AAS model to include the 'UserRegion' table and define RLS roles in AAS.

Question 4

You are a Power BI administrator for a small business. The company uses Power BI Pro licenses for all users. You need to ensure that all data sources used in Power BI reports are documented and that sensitive data is classified. You have been asked to set up a process that automatically scans Power BI datasets for sensitive data and adds classification labels. You have the following options:

A. Use Microsoft Purview to scan Power BI datasets and apply sensitivity labels.
B. Use Power BI's built-in data classification feature to manually label datasets.
C. Use Microsoft Sentinel to monitor data access and apply labels.
D. Use Azure Policy to enforce labeling on Power BI datasets.

Which option should you choose?

Accepted Answer

Use Microsoft Purview to scan Power BI datasets and apply sensitivity labels.. Microsoft Purview can automatically scan Power BI datasets for sensitive data and apply sensitivity labels based on classification rules. Option B is wrong because manual labeling is not automatic. Option C is wrong because Microsoft Sentinel is a SIEM, not a data classification tool. Option D is wrong because Azure Policy does not directly integrate with Power BI for labeling.

Answer

Use Power BI's built-in data classification feature to manually label datasets.

Answer

Use Azure Policy to enforce labeling on Power BI datasets.

Answer

Use Microsoft Sentinel to monitor data access and apply labels.

Question 5

Your company uses Microsoft Purview Information Protection sensitivity labels. You publish a Power BI dataset that includes columns containing personally identifiable information (PII). You want to automatically apply sensitivity labels based on column sensitivity. What should you configure?

Accepted Answer

Configure an auto-labeling policy in Microsoft Purview.. Auto-labeling policies in Microsoft Purview can scan and label Power BI datasets. Option B is wrong because Microsoft Defender for Cloud Apps applies labels based on app-level behavior, not column data. Option C is wrong because sensitivity labels in Power BI are manual or inherited from data sources. Option D is wrong because Microsoft Sentinel is for security information and event management.

Answer

Use Microsoft Defender for Cloud Apps session controls.

Answer

Apply a sensitivity label to the dataset manually in Power BI Service.

Answer

Enable Microsoft Sentinel to label Power BI assets.

Question 6

You need to enforce that only users with a specific sensitivity label can access a Power BI report. Which TWO actions should you take?

Accepted Answer

Enable sensitivity labels for Power BI in Microsoft Purview.. Option B is correct because sensitivity labels must first be enabled and published for Power BI in Microsoft Purview before any label can be applied to reports or used for access decisions; without this integration, Power BI cannot recognize or enforce the label. Option E is correct because a label-based access control policy in Microsoft Purview is the mechanism that actually restricts access so that only users with the specified sensitivity label can open the Power BI report. Option A is not correct because assigning users to the Viewer role in the workspace grants access to workspace content regardless of sensitivity label, so it does not enforce label-based restriction. Option C is not correct because row-level security filters rows within a dataset for users who already have access; it does not gate access based on a sensitivity label. Option D is not correct because setting a default sensitivity label for a workspace only applies a label automatically to new items, it does not restrict access to only users holding that label.

Answer

Assign users to the Viewer role in the workspace.

Answer

Configure row-level security (RLS) on the dataset.

Answer

Set the default sensitivity label for the workspace.

Question 7

You manage a Power BI tenant. You need to prevent users from sharing reports with external users. Which THREE actions should you take?

Accepted Answer

Create a Microsoft Entra ID conditional access policy to block external users.. Options A, B, and C are correct. Creating a Microsoft Entra ID conditional access policy blocks external users from accessing resources. Disabling 'Publish to web' prevents public embedding of reports. Disabling 'Share content with external users' in the admin portal prevents sharing with external users. Option D is wrong because disabling 'Create app workspaces' does not prevent sharing with external users; it prevents creation of workspaces. Option E is wrong because disabling 'Export to Excel' does not affect sharing.

Answer

Disable 'Create app workspaces' for non-admins.

Answer

Disable 'Export to Excel' for all reports.

Question 8

You are a Power BI administrator for a large enterprise. The company has a Power BI tenant with thousands of workspaces. You need to audit all shared links (shareable links) that have been created across the tenant to identify any that are shared with external users. You also need to revoke any links that were created more than 90 days ago. You want to use a PowerShell script to accomplish this efficiently. The script must output a CSV file with columns: LinkId, WorkspaceName, ReportName, CreatedDate, ExternalSharing. What should you do?

Accepted Answer

Use the Power BI REST API cmdlet Get-PowerBIShareableLink to retrieve and filter links by CreatedDate, then revoke with Remove-PowerBIShareableLink.. The Power BI REST API (via PowerShell) can retrieve shareable links and filter by creation date. Option A is wrong because the admin portal lacks automation. Option C is wrong because Microsoft Graph API does not directly manage Power BI shareable links. Option D is wrong because Log Analytics does not provide shareable link metadata.

Answer

Enable Power BI activity logs and query Log Analytics for shareable links.

Answer

Use Microsoft Graph API to audit and manage Power BI shareable links.

Answer

Use the Power BI admin portal to manually export shareable links.

Question 9

You have a Power BI workspace that contains several dashboards and reports. You need to ensure that the workspace is certified and that only certified datasets can be used in reports across the tenant. You also want to display a certification badge on the workspace. What should you do?

Accepted Answer

Apply certification to the datasets in the workspace via the dataset settings.. Certification is applied to individual datasets, not to workspaces. To make your datasets certified, apply certification via the dataset settings in Power BI. The certification badge will appear on the datasets (and can be shown in reports that use them), not on the workspace itself. Therefore, the requirement to display a certification badge on the workspace is not directly achievable; if the goal is to have certified content, you must certify the datasets individually. Option B is incorrect because updating the workspace description does not certify anything. Option C is incorrect because marking the workspace as 'Featured' is unrelated to certification. Option D is incorrect because endorsement is the umbrella term that includes both promotion and certification; enabling endorsement does not automatically certify content.

Answer

Update the workspace description to include 'Certified'.

Answer

Mark the workspace as 'Featured' in the admin portal.

Answer

Enable the 'Endorsement' setting for the workspace.

Question 10

Your organization uses Power BI and has a requirement that all reports must be accessible to users with screen readers. You need to configure the Power BI service to enforce accessibility compliance. What should you do?

Accepted Answer

In the Power BI admin portal, enable the 'Enforce accessibility requirements' setting.. The correct option is D: in the Power BI admin portal, enable the 'Enforce accessibility requirements' setting. This tenant-level setting is the designated Power BI service control that enforces accessibility compliance across reports, matching the requirement to configure the service rather than individual artifacts or client devices. Option A is wrong because Microsoft Entra ID conditional access governs authentication and access conditions, not report accessibility. Option B is wrong because Microsoft Intune manages device configuration and compliance policies, not Power BI report accessibility. Option C is wrong because setting accessibility properties on each report individually is a per-artifact authoring task and does not enforce compliance at the service level.

Answer

Use Microsoft Entra ID to enforce conditional access for accessibility.

Answer

Use Microsoft Intune to enforce accessibility policies on user devices.

Answer

Set accessibility properties on each report individually.

Question 11

You are a Power BI administrator. Your company has a Power BI tenant with a large number of workspaces. A new regulation requires that all shared dashboards must have a data retention policy that deletes data older than 6 months. You need to implement this for all existing and future dashboards. The solution must be automated and not require manual intervention. What should you do?

Accepted Answer

Use Microsoft Purview data lifecycle management to apply retention labels.. To enforce automated data retention at the tenant level for shared dashboards, you must use Microsoft Purview data lifecycle management to apply retention labels to the underlying datasets. This ensures data older than 6 months is deleted automatically without manual intervention. Option A is incorrect because the Power BI admin portal does not support tenant-level data retention policies for dashboards. Option B is incorrect because manual configuration does not scale and is not automated. Option D is incorrect because deleting dashboards via the REST API removes the analysis surface but not the actual data, and it requires ongoing script execution.

Answer

Configure a tenant-level data retention policy in the Power BI admin portal.

Answer

Set a retention period on each dashboard manually in the dashboard settings.

Answer

Develop a PowerShell script using the Power BI REST API to regularly delete dashboards older than 6 months.

Question 12

Your Power BI workspace contains a dataset that uses a DirectQuery connection to Azure SQL Database. You need to ensure that only users with the 'Viewer' role in the workspace can query the dataset, but they should not be able to see the underlying SQL credentials. What should you do?

Accepted Answer

Configure the dataset to use a service principal with a credential stored in Power BI.. Option C is correct because storing the SQL credential in Power BI and having the dataset connect through a service principal keeps the underlying Azure SQL credentials hidden from workspace Viewers, who only need read access to the dataset. In DirectQuery, the data source connection is made by the dataset's configured identity, not by each Viewer, so Viewers can query the dataset without ever seeing or supplying the SQL credentials. Option A is wrong because using each user's Windows credentials would require Viewers to have their own SQL access and would expose the authentication context rather than hiding credentials. Option B is wrong because RLS filters rows returned to users; it does not manage or conceal data source credentials. Option D is wrong because OLS hides specific tables or columns from report users and has nothing to do with protecting SQL credentials.

Answer

Use Windows authentication with the user's own credentials.

Answer

Use row-level security (RLS) to restrict query access.

Answer

Use object-level security (OLS) to hide the credential columns.

Question 13

You are the administrator of a Power BI tenant. Your organization has a Microsoft 365 E5 license and uses sensitivity labels published from Microsoft Purview. You need to ensure that when a user applies a sensitivity label to a Power BI report, the label and its protection settings are automatically inherited by the semantic model that the report is built on, even if the model is stored in a different workspace. What should you do first?

Accepted Answer

Enable the tenant setting 'Allow semantic models to inherit sensitivity labels from reports' in the Power BI admin portal.. Enabling the tenant setting 'Allow semantic models to inherit sensitivity labels from reports' is the required first step. This setting enables the automatic propagation of sensitivity labels and their protection settings from reports to their underlying semantic models, even across workspaces. Without it, labels applied to reports do not flow to models, leaving data unprotected. Other actions, such as publishing label policies or assigning roles, do not control this inheritance behavior.

Answer

Assign the 'Data Protection' role to the report authors in Microsoft Purview.

Answer

Publish a sensitivity label policy from Microsoft Purview that includes the 'Power BI' workload and set the label to auto-apply to all semantic models.

Answer

In the workspace settings for the semantic model, enable 'Apply sensitivity labels from reports'.

Question 14

You manage a Power BI tenant with a workspace named 'Finance'. The workspace contains a semantic model and several reports. You need to ensure that users in the 'Auditors' security group can view the reports but cannot modify the semantic model or the reports. Additionally, these users must be able to see the data in the reports but must not be able to export the underlying data to Excel. Which workspace role should you assign to the 'Auditors' group?

Accepted Answer

A custom role that includes only the 'View' permission on reports and excludes the 'Export' permission.. A custom role that grants only the 'View' permission on reports and excludes 'Export' is the correct solution. It ensures Auditors can view reports without modifying the semantic model or reports and prevents data export. Standard roles like Viewer allow export by default, while Contributor and Member grant edit rights. Custom roles provide the necessary granularity to meet both viewing and security requirements in this scenario.

Answer

Contributor

Answer

Viewer

Answer

Member

Question 15

You are a Power BI administrator for a large organization. You need to ensure that when users share Power BI reports with external users (guest users from other Microsoft Entra tenants), the external users can only view the reports and cannot reshare them with others. Which two actions should you perform? (Choose two.)

Accepted Answer

In Microsoft Entra ID, configure the external collaboration settings to restrict guest users from inviting other guests.. The correct actions are to disable the Power BI tenant setting that allows external guest users to edit and manage content, and to configure Microsoft Entra ID external collaboration settings to restrict guests from inviting other guests. Together, these ensure external users have view-only access and cannot reshare reports. Enabling guest access to Power BI is necessary but not sufficient, and disabling it would block all access.

Answer

In the Power BI admin portal, disable the setting 'Allow external guest users to access Power BI'.

Answer

In the Power BI admin portal, enable the setting 'Allow external guest users to edit and manage content in the organization'.

Answer

In the Power BI admin portal, enable the setting 'Allow external guest users to access Power BI'.