PL-300 Manage and secure Power BI Practice Test 8 — 15 Questions

Question 1

Which TWO of the following are valid ways to enforce row-level security (RLS) on a Power BI dataset? (Choose two.)

Accepted Answer

Define roles and role members in Power BI Desktop using DAX filter expressions.. Options C and E are correct. RLS can be defined in Power BI Desktop using DAX filter expressions to create roles and assign members. Additionally, when using DirectQuery with SSO enabled, RLS can be enforced at the source database level. Option A is incorrect because RLS for Power BI datasets is not defined in Report Builder; it is defined in Power BI Desktop. Option B is incorrect because RLS roles are not created directly in the Power BI service; they are defined in Desktop and then applied in the service. Option D is incorrect because RLS roles in Power BI are based on DAX expressions and user principals, not directly on Microsoft Entra ID groups.

Answer

Use Power BI Report Builder to define RLS on paginated reports.

Answer

Create RLS rules directly in the Power BI service under dataset security.

Answer

Assign users to security groups in Microsoft Entra ID and map those groups to RLS roles in the Power BI service.

Question 2

You are a Power BI administrator. A user reports that their scheduled data refresh fails every day with the error 'The credentials provided for the data source are invalid.' The user has verified the credentials are correct. What is the most likely cause?

Accepted Answer

The data source requires OAuth authentication, and the refresh token has expired.. OAuth authentication uses tokens that can expire, requiring re-authentication. Even if the user's credentials are correct, the refresh token may have expired, causing the refresh to fail. Option A is incorrect because changing a password would produce a different error related to invalid credentials. Option C is incorrect because if the gateway were offline, the error would typically indicate that the gateway is unreachable. Option D is incorrect because incremental refresh itself does not affect credential validity; it is a feature for partitioning data loads.

Answer

The user changed their password after configuring the refresh.

Answer

The on-premises data gateway is offline.

Answer

The dataset uses incremental refresh, which requires Premium capacity.

Question 3

You manage a Power BI environment. A user wants to share a dashboard with an external partner. You need to ensure the partner cannot export data or share the dashboard further. What should you do?

Accepted Answer

Add the partner as a guest user in Microsoft Entra ID and share the dashboard directly, ensuring the 'Allow recipients to share' and 'Allow users to export data' options are unchecked.. You can add the external partner as a guest user in Microsoft Entra ID, then share the dashboard directly and uncheck 'Allow recipients to share' and 'Allow users to export data' to enforce restrictions. Option A is wrong because creating a composite model and sharing as an app does not provide the required granular control over export and resharing permissions for external users. Option B is wrong because adding the partner as a Viewer in a new workspace grants access to the entire workspace content and may allow export or resharing depending on workspace settings, and it does not directly restrict these actions on the dashboard. Option D is wrong because 'Publish to web' makes the dashboard publicly accessible with no restrictions, violating the security requirement.

Answer

Create a composite model on top of the dataset and share the report as an app.

Answer

Create a new workspace and add the partner as a Viewer.

Answer

Publish the dashboard to a public website using 'Publish to web'.

Question 4

Your organization uses Power BI and has deployed Microsoft Purview Data Loss Prevention (DLP) policies. You want to prevent users from exporting data from Power BI reports that contain credit card numbers. What should you configure?

Accepted Answer

Create a DLP policy in Microsoft Purview that detects credit card numbers in Power BI and set the action to block export.. You can create a DLP policy in Microsoft Purview that detects sensitive info types like credit card numbers and block export actions. Option A is wrong because RLS restricts data visibility, not export. Option C is wrong because sensitivity labels alone do not block export; they require integration with DLP. Option D is wrong because disabling export in the admin portal is a blanket setting that blocks all exports, not just those containing credit card numbers.

Answer

Configure row-level security (RLS) to hide the credit card column from users.

Answer

Apply a Microsoft Purview sensitivity label 'Highly Confidential' to the dataset and configure the label to prevent export.

Answer

Disable the 'Export to Excel' and 'Export to CSV' settings in the Power BI admin portal.

Question 5

You are a Power BI administrator. A user reports that they cannot see any data when they open a report that uses row-level security (RLS). The user is a member of the 'Sales' RLS role, which filters data to [Region] = 'North America'. However, the report shows blank visuals. What is the most likely cause?

Accepted Answer

The RLS filter uses an exact string match, but the actual region values in the data are different (e.g., 'North America' vs 'North America ' or 'NA').. If the 'North America' region name in the data does not exactly match the filter (e.g., 'North America' vs 'NA'), the filter will not match any rows. Option A is wrong because the user can see the report, just no data. Option B is wrong because RLS roles are usually defined in Desktop. Option C is wrong because the user is in the Sales role, so they should see data.

Answer

The user does not have permission to view the report.

Answer

The user is also a member of a workspace role that overrides RLS.

Answer

The RLS role was defined in the Power BI service after publishing, but the user was not added.

Question 6

You need to ensure that only the Finance team can access a specific Power BI dashboard. What is the most efficient way to accomplish this?

Accepted Answer

Share the dashboard directly with the Finance team security group, granting only 'View' permissions.. Sharing the dashboard directly with the Finance team security group with View permissions is the most efficient and targeted method; it grants access only to that dashboard without affecting other workspace content. Option A is wrong because creating a new workspace and moving the dashboard is inefficient and disrupts existing access. Option C is wrong because adding the team as Admins of the workspace would give them full control over all workspace content, not just the dashboard. Option D is wrong because publishing as an app is intended for distributing multiple items and is more complex than simple sharing.

Answer

Create a new workspace, add the Finance team as Members, and move the dashboard to that workspace.

Answer

Add the Finance team as Admins of the workspace containing the dashboard.

Answer

Publish the dashboard as an app and assign the Finance team as the audience.

Question 7

Your organization uses Power BI and has implemented Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security). A user reports that they are unable to export data from a Power BI report. The Power BI tenant settings allow export. What could be the cause?

Accepted Answer

A Microsoft Defender for Cloud Apps session policy is blocking the export based on the user's risk level or the report's sensitivity.. Microsoft Defender for Cloud Apps can apply session policies that monitor and block data export actions in real time based on user risk or sensitivity label. Option A is wrong because the tenant setting explicitly allows export. Option B is wrong because a sensitivity label alone does not block export; it requires an accompanying data loss prevention (DLP) policy or a Defender for Cloud Apps session policy to enforce blockage. Option C is wrong because external guest users are not inherently blocked from export; the issue is policy-driven, not user type.

Answer

The 'Export to Excel' setting is disabled in the Power BI admin portal.

Answer

A sensitivity label with high classification is applied to the report, automatically blocking export.

Answer

The user is an external guest user.

Question 8

You are a Power BI administrator. A user in your organization wants to share a report with an external user who does not have a Power BI license. You want to allow the external user to view the report without requiring them to sign in. What should you do?

Accepted Answer

Use the 'Publish to web' option to generate an embed code and send the link to the external user.. 'Publish to web' creates a public embed code that anyone can view without authentication, satisfying the requirement that the external user does not need to sign in or have a license. Option A is wrong because creating a new user account and assigning a Pro license requires the user to sign in and involves cost. Option B is wrong because sharing directly with an email address requires the recipient to sign in as a guest or have a license. Option C is wrong because inviting as a guest also requires the guest to sign in with their own credentials, which contradicts the requirement of no sign-in.

Answer

Create a new user account in your Microsoft Entra ID for the external user and assign a Power BI Pro license.

Answer

Share the report directly with the external user's email address.

Answer

Invite the external user as a guest in Microsoft Entra ID, then share the report.

Question 9

Refer to the exhibit. You are configuring a Microsoft Purview Data Loss Prevention (DLP) policy for Power BI. The policy rule shown is intended to block downloads from datasets that have the 'Confidential' sensitivity label and are sourced from SharePoint or SQL Server. However, users are still able to download data from these datasets. What is the most likely reason?

Accepted Answer

The condition uses 'dataSource' which is not a valid property in Power BI DLP policies.. The 'dataSource' property is not a valid condition in Power BI DLP policies. DLP policies for Power BI support conditions based on sensitivity labels and specific workspace/dataset properties, but not data source (e.g., SharePoint or SQL Server). The policy rule as shown uses an invalid condition, so the rule is ignored, allowing downloads. Option A is wrong because 'datasets' is a valid target. Option B is wrong because 'blockDownload' is a valid action. Option D is wrong because the conditions are correctly separated by the 'and' logic in the policy editor.

Answer

The target should be 'reports' instead of 'datasets'.

Answer

The action 'blockDownload' is not a valid action; the correct action should be 'Block' or 'BlockDownload' might require additional configuration.

Answer

The policy rule is missing the 'and' operator between the two conditions.

Question 10

You are the Power BI administrator for Contoso Ltd. The company has a Premium capacity workspace named 'Sales Analytics' that contains a dataset named 'SalesData' and several reports. The dataset uses DirectQuery to an Azure SQL Database. Row-level security (RLS) is configured in Power BI Desktop with roles: 'SalesManager' (filters to SalesManager rows), 'SalesRep' (filters to SalesRep rows). After publishing, you assign users to the roles in the Power BI service. However, when a user assigned to the 'SalesRep' role opens a report, they see all data instead of only their own rows. You have verified that the RLS role definition is correct and that the user is the only member of the 'SalesRep' role. The user has no other workspace permissions. The dataset is set to use single sign-on (SSO) for the DirectQuery connection. What is the most likely cause of the issue?

Accepted Answer

Change the dataset storage mode from DirectQuery to Import.. The user sees all data despite being assigned to the 'SalesRep' RLS role because the dataset uses DirectQuery with SSO. With DirectQuery, Power BI RLS is applied in addition to any source-level security. However, if SSO is enabled, the user's own identity is passed to the data source, which may bypass the Power BI RLS if the source returns all rows (e.g., no row-level filtering at the source). Changing the storage mode to Import ensures that RLS is enforced entirely within Power BI, as the data is loaded into memory and filtered based on the user's role. Options A, B, and D are incorrect: A suggests configuring RLS at the database level, but the issue is that Power BI RLS should already be applied; B recommends adding the user to multiple roles, which would actually broaden access; D removing the user from the role and adding as Viewer does not enforce RLS.

Answer

Configure RLS in the Azure SQL Database itself using security predicates or views that filter based on the user's identity (e.g., USER_NAME() or SUSER_SNAME()).

Answer

Add the user to multiple RLS roles to ensure the filters are applied.

Answer

Remove the user from the 'SalesRep' role and add them as a Viewer on the workspace to force RLS.

Question 11

You are a Power BI administrator for a large enterprise. The organization uses Microsoft Purview Information Protection sensitivity labels. You have enabled sensitivity labels in the Power BI admin portal and published labels in the Microsoft 365 Compliance Center. Users have been assigned the appropriate licenses. However, when a user tries to apply a sensitivity label to a report in the Power BI service, the label options are grayed out. The user has a Power BI Pro license and is a Member of the workspace where the report resides. The report is stored in a workspace that is backed by a Premium capacity. What is the most likely reason the user cannot apply the label?

Accepted Answer

The user does not have the required Azure Rights Management (Azure RMS) license or permissions to apply labels.. Applying sensitivity labels in Power BI requires the user to have an Azure Rights Management (Azure RMS) license or permissions. Even with a valid Power BI Pro license and appropriate workspace permissions (Member role), if the user lacks the required Azure RMS license (e.g., part of Azure Information Protection P1/P2 or Microsoft 365 E5) or the Rights Management use rights, the label options remain grayed out. Option B is incorrect because sensitivity labels are published to users via the Microsoft 365 Compliance Center, and while security group publishing can restrict label availability, the question states labels are published and the user has the appropriate license; the issue is specifically about applying labels, not seeing them. Option C is incorrect because sensitivity label enablement in Power BI is a tenant-level setting in the admin portal, not a workspace-level setting; once enabled at the tenant, all workspaces (including those backed by Premium capacity) inherit the ability to use labels. Option D is incorrect because the user is a Member of the workspace, which is sufficient to apply labels; the ability to apply labels is not tied to workspace roles but to Azure RMS permissions.

Answer

The sensitivity labels have not been published to the user's security group.

Answer

The workspace is not enabled for sensitivity labels; you need to enable labels at the workspace level.

Answer

The user's role in the workspace is insufficient; they need at least Contributor role to apply labels.

Question 12

A data analyst publishes a Power BI dataset to a Premium workspace and grants 'Build' permission to a group of report creators. One report creator complains that they cannot see certain tables in the dataset when building a new report. What is the most likely cause?

Accepted Answer

Object-level security (OLS) is configured on the dataset, hiding some tables.. Object-level security (OLS) can hide entire tables or columns from users based on their roles. With Build permission, if OLS is configured, a user may not see certain tables, even if they have access to the dataset. Row-level security (RLS), on the other hand, filters rows but does not hide tables, so D is the correct answer. Option A is incorrect because direct query permissions to the data source are not required for building reports from a dataset; Build permission on the dataset is sufficient. Option B is incorrect because the user already has Build permission. Option C is incorrect as service principal authentication is irrelevant to table visibility in this context.

Answer

The user lacks direct query permissions to the underlying data source.

Answer

The user does not have 'Build' permission on the dataset.

Answer

The dataset is configured with service principal authentication, and the user is not using a service principal.

Question 13

Your organization uses Microsoft Purview to catalog Power BI assets. You need to ensure that all published reports and dashboards are automatically scanned and added to the catalog. What should you do?

Accepted Answer

Register the Power BI tenant as a data source in Microsoft Purview.. Registering the Power BI tenant as a data source in Microsoft Purview enables automatic scanning of all Power BI assets, including reports and dashboards. Option B is wrong because enabling 'Allow Azure Active Directory authentication' is not required for Purview scanning and does not add assets to the catalog. Option C is wrong because sensitivity labels help with classification and protection but do not trigger automatic scanning. Option D is wrong because creating a new workspace does not initiate scanning; the tenant must be registered as a data source in Purview.

Answer

Enable 'Allow Azure Active Directory authentication' in the Power BI admin portal.

Answer

Apply sensitivity labels to all assets.

Answer

Create a new workspace in Power BI and assign the catalog admin role.

Question 14

You manage a Power BI environment where users frequently share reports by sending the URL from the browser. However, external recipients often receive an error saying they cannot access the report. What is the most likely reason?

Accepted Answer

The 'Share content with external users' setting is disabled in the tenant.. The most likely reason is that the 'Share content with external users' setting is disabled in the tenant. By default, this setting must be enabled in the Power BI admin portal for external users to access shared reports. Option B is incorrect because external users do not require a Power BI Pro license if the report is shared to them; they can view it with the appropriate setting enabled. Option C is incorrect because external users can access the report even if they are not in the same Microsoft Entra tenant, provided the sharing setting is enabled. Option D is incorrect because the report is already published to the Power BI service; the issue is not about publication but about sharing configuration.

Answer

External users do not have a Power BI Pro license.

Answer

External users are not part of the same Microsoft Entra tenant.

Answer

The report is not published to the Power BI service.

Question 15

You need to audit which users have accessed a specific Power BI dashboard in the last 30 days. What should you use?

Accepted Answer

Power BI Activity Log (audit log) in the Microsoft 365 admin center.. The Power BI Activity Log, accessible through the Microsoft 365 admin center or via PowerShell, records detailed user access events for dashboards and reports. Option A is incorrect because Microsoft Sentinel is a SIEM tool that can ingest Power BI logs but is not the primary source for auditing dashboard access. Option C is incorrect because Microsoft Purview compliance portal provides data governance and compliance features but does not directly capture Power BI access logs. Option D is incorrect because the Power BI REST API 'Get Datasets' endpoint returns dataset metadata, not user access audit information.

Answer

Microsoft Sentinel.

Answer

Microsoft Purview compliance portal.

Answer

Power BI REST API 'Get Datasets' endpoint.