PL-300 Manage and secure Power BI Practice Test 8 — 15 Questions

Question 1

You are a Power BI administrator. You need to ensure that users can share Power BI reports with external users (guest users) in Microsoft Entra ID, but only if the external users have been invited and have accepted the invitation. Which two tenant settings should you configure in the Power BI admin portal? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Allow Azure Active Directory guest users to access Power BI. To allow sharing with external guest users who have accepted invitations, you must enable the tenant setting that allows Microsoft Entra ID guest users to access Power BI, and the setting that allows inviting external users to the organization. These two settings together enable the invitation process and guest access. The other options either grant excessive permissions, are not specific to invited guests, or are configured outside Power BI.

Answer

Enable Microsoft Entra ID B2B collaboration

Answer

Allow external guest users to edit and manage content in the organization

Answer

Allow users to share content with external users

Question 2

You are a Power BI administrator for a large organization. You need to ensure that when users create new workspaces, the workspaces are automatically assigned to a specific capacity and that only a designated security group can create workspaces. Which two actions should you perform? (Choose two.)

Accepted Answer

In the Power BI admin portal, enable 'Create workspaces (new workspace experience)' and restrict it to a security group.. The correct actions are to restrict workspace creation to a security group via the tenant setting, and to note that automatic capacity assignment is not a built-in feature. Since the question asks for two actions but only one is valid, the intended answer is the tenant setting. However, the question is flawed because it asks for two actions when only one is correct. In the context of PL-300, the valid action is to restrict workspace creation. The other options are not valid or do not meet the requirement.

Answer

In the Power BI admin portal, set 'Users can create workspaces' to 'Off' for the entire organization.

Answer

Use the Power BI REST API to create a script that assigns new workspaces to the capacity and runs on a schedule.

Answer

Configure a workspace assignment rule to automatically assign new workspaces to a specific capacity.

Question 3

You are a Power BI administrator for a company that uses Microsoft Entra ID. The security team wants to ensure that when users sign in to Power BI, they are required to use multi-factor authentication (MFA) and that the sign-in is evaluated by Conditional Access policies. You need to configure the tenant setting that enforces this requirement. Which setting should you enable in the Power BI admin portal?

Accepted Answer

Azure Active Directory Conditional Access. The security team requires MFA and Conditional Access evaluation for Power BI sign-ins. In the Power BI admin portal, the 'Microsoft Entra ID Conditional Access' setting must be enabled to allow Entra ID Conditional Access policies to apply. Without it, Power BI may not enforce these policies. The other settings either control authentication type, guest access, or do not exist as described.

Answer

Guest users can access Microsoft Entra ID content

Answer

Multi-factor authentication

Answer

Azure Active Directory authentication

Question 4

You are a Power BI administrator. Your organization has a Microsoft Purview sensitivity label named 'Confidential' that is published to Power BI. You need to ensure that when users export data from Power BI reports to Excel, the exported file inherits the 'Confidential' label and its protection settings. Which two actions should you perform? (Choose two.)

Accepted Answer

Enable the 'Apply sensitivity labels to exported data' tenant setting in the Power BI admin portal.. To ensure exported files inherit sensitivity labels, two actions are needed: the label must be published to Power BI from Microsoft Purview, and the tenant setting 'Apply sensitivity labels to exported data' must be enabled. Publishing makes the label available; the setting ensures it propagates to exports. Other options relate to labeling content or export permissions but do not directly enable export inheritance.

Answer

Enable the 'Users can apply sensitivity labels' tenant setting.

Answer

Assign the 'Confidential' label to the dataset in Power BI Desktop before publishing.

Answer

Configure the 'Export data' setting to allow users to export data with labels.

Question 5

You are a Power BI administrator. The compliance department requires that all Power BI activity logs, including report views and dataset refreshes, be retained for auditing purposes beyond the default retention period. You need to configure Power BI to send activity logs to a centralized repository for long-term retention. What should you do?

Accepted Answer

Configure the 'Audit and usage settings' in the Power BI admin portal to export activity logs to Azure Log Analytics.. To retain Power BI activity logs beyond the default 90 days, you must export them to a centralized repository. Azure Log Analytics is a common choice. The 'Audit and usage settings' in the Power BI admin portal allow you to connect to Log Analytics and send activity logs there. Other options either do not exist or do not provide the required retention capability. This configuration ensures compliance with long-term auditing needs.

Answer

Enable the 'Users can view activity logs' tenant setting.

Answer

Enable the 'Usage metrics for content creators' tenant setting.

Answer

Set the 'Activity log retention' period to 7 years in the Power BI admin portal.

Question 6

You are a Power BI administrator. Your organization has a Microsoft 365 E5 tenant and uses Microsoft Purview sensitivity labels. You need to ensure that when a user applies a sensitivity label with encryption to a Power BI report, the label and its protection settings are honored when the report is exported to Excel. What should you do?

Accepted Answer

Enable the tenant setting 'Apply sensitivity labels to exported data' in the Power BI admin portal.. To ensure sensitivity labels and their encryption are applied to data exported from Power BI to Excel, the tenant setting 'Apply sensitivity labels to exported data' must be enabled. This setting enforces label inheritance and protection on export. Other actions, such as publishing labels or configuring DLP, do not by themselves apply labels to exported files.

Answer

In Microsoft Purview, create a sensitivity label with encryption and publish it to the Power BI service.

Answer

In the Power BI admin portal, enable 'Users can apply sensitivity labels to their content'.

Answer

Configure a data loss prevention (DLP) policy in Microsoft Purview that blocks export of labeled content.

Question 7

You are a Power BI administrator for a company that uses Power BI Premium. A department has published a new app workspace that contains sensitive financial data. The security team requires that only members of the 'Finance Analysts' security group can view the reports in this workspace. You need to configure the workspace so that only these users can access the content, and you must ensure that other users in the organization cannot even see that the workspace exists. What should you do?

Accepted Answer

Assign the 'Finance Analysts' group the Viewer role and ensure that no other users or groups are added to the workspace.. To restrict access to only the Finance Analysts group and hide the workspace from others, assign the group the Viewer role and ensure no other users or groups are members. The Viewer role grants read-only access, which is sufficient for viewing reports. This approach also ensures that the workspace is not visible to non-members, satisfying the security requirement.

Answer

Create a new workspace, add the 'Finance Analysts' group as Members, and configure the workspace to be private.

Answer

Assign the 'Finance Analysts' group the Admin role and remove all other users from the workspace.

Answer

Share the reports directly with the 'Finance Analysts' group from the workspace and remove all other users from the workspace.

Question 8

You are a Power BI administrator. A report uses a dataset that connects to an on-premises SQL Server using an on-premises data gateway. Users report that scheduled refresh fails with the error 'Unable to connect to the data source'. You confirm that the gateway is online and that the dataset credentials are correct. You need to resolve the refresh failure. What should you do?

Accepted Answer

Grant the gateway connection 'Can use' permission to the dataset owner.. Scheduled refresh through an on-premises data gateway requires that the dataset owner or the user configuring refresh has 'Can use' permission on the gateway connection. If this permission is missing, refresh fails with a connection error even when credentials are correct. Granting the permission resolves the issue without unnecessary changes to the gateway or dataset.

Answer

Change the dataset connection to use DirectQuery instead of Import.

Answer

Add the IP address of the Power BI service to the firewall allow list.

Answer

Restart the on-premises data gateway service on the gateway server.

Question 9

A Power BI administrator needs to enforce that all datasets published to the service use certified data sources only. Which two settings should be configured? (Choose two.)

Accepted Answer

Enable 'Certification' for dataflows in the Power BI tenant settings.. To enforce that all datasets use certified data sources only, an administrator should enable certification for data sources (Option C) and enable certification for dataflows (Option B). Option C allows data source owners to certify data sources, and Option B allows dataflow owners to certify dataflows. Combined, these settings promote the use of certified components. Option A (monitoring with Sentinel) only detects non-certified sources, it does not enforce. Option D (RLS) and Option E (B2B permissions) are unrelated to data source certification.

Answer

Use Microsoft Sentinel to audit Power BI activity logs and flag non-certified data sources.

Answer

Configure row-level security (RLS) on all datasets.

Answer

Set up B2B guest user permissions to restrict external data sources.

Question 10

You are a Power BI administrator. A user reports that their scheduled data refresh fails with error 'The data source credentials are no longer valid.' The dataset uses a SQL Server database with Windows authentication. What should you do first to resolve the issue?

Accepted Answer

Ask the user to update the data source credentials in the Power BI service dataset settings.. The first step is to ask the user to update the data source credentials in the Power BI service dataset settings. The error explicitly states that credentials are no longer valid, so refreshing them is the direct fix. This is a common issue when passwords expire or service accounts change.

Answer

Reinstall the on-premises data gateway on the server.

Answer

Reassign the dataset to a different Premium capacity.

Answer

Modify the dataset to use 'Impersonate the authenticated user' for data sources.

Question 11

You are a Power BI administrator. Your organization uses Microsoft Purview to manage sensitivity labels. You need to ensure that when a report is exported to PDF, the sensitivity label is automatically applied to the PDF file. What should you configure?

Accepted Answer

Enable the tenant setting 'Apply sensitivity labels to exported data' in the Power BI admin portal.. Option A is correct because the Power BI tenant setting 'Apply sensitivity labels to exported data' (in the Power BI admin portal) is specifically what causes the sensitivity label on a report to be inherited by exported files such as PDF, PPTX, and XLSX. When this setting is enabled, Power BI propagates the report's label to the exported artifact so the PDF carries the same protection. Option B is incorrect because Purview Information Protection encryption settings govern encryption behavior, not the propagation of labels to Power BI exports. Option C is incorrect because setting a workspace default label only assigns labels to new items in that workspace; it does not control label inheritance on exported PDFs. Option D is incorrect because a Purview auto-labeling policy applies labels based on content inspection and does not govern the export-labeling behavior of Power BI reports.

Answer

Enable 'Microsoft Purview Information Protection' file encryption settings.

Answer

Set the default sensitivity label for the workspace to 'Confidential'.

Answer

Configure a Microsoft Purview auto-labeling policy for Power BI reports.

Question 12

A Power BI administrator wants to allow users to create dashboards and reports, but prevent them from sharing content outside the organization. Which two settings should be configured in the Power BI admin portal? (Choose two.)

Accepted Answer

Disable 'Share content with external users' in the tenant settings.. Option D is correct because disabling 'Share content with external users' in the Power BI admin portal tenant settings blocks users from sharing dashboards and reports with recipients outside the organization, directly satisfying the requirement to prevent external sharing. Option E is correct because disabling 'Publish to web' prevents users from publishing reports to public websites, which is another channel for exposing content outside the organization. Option A is incorrect because disabling 'Create workspaces' would prevent users from creating workspaces, conflicting with the goal of allowing them to create dashboards and reports. Option B is incorrect because disabling 'Export data' restricts exporting underlying data rather than sharing dashboards and reports externally. Option C is incorrect because 'Featured tables' relates to promoting tables in Excel's data types gallery and has no bearing on external sharing.

Answer

Disable 'Create workspaces' in the tenant settings.

Answer

Disable 'Export data' in the tenant settings.

Answer

Disable 'Featured tables' in the tenant settings.

Question 13

You are a Power BI administrator. A Power BI dataset owner reports that the dataset is not refreshing automatically, but manual refreshes work fine. The dataset uses a cloud data source (Azure SQL Database) with OAuth2 credentials. What is the most likely cause?

Accepted Answer

The OAuth2 token used for the data source credentials has expired.. The OAuth2 token used for the data source credentials has expired. In Power BI, scheduled refreshes run unattended using the stored credentials; if the OAuth2 access/refresh token for the Azure SQL Database source is no longer valid, the scheduled refresh fails while an interactive manual refresh can still succeed because the user re-authenticates on the spot. Options A, B, and C do not fit: RLS misconfiguration would typically cause permission or data-visibility errors rather than a refresh failure, an on-premises data gateway is irrelevant for a cloud data source like Azure SQL Database, and exceeding the capacity refresh limit would affect both scheduled and manual refreshes, not just automatic ones.

Answer

Row-level security (RLS) is misconfigured.

Answer

The on-premises data gateway is offline.

Answer

The dataset exceeds the refresh limit for the assigned capacity.

Question 14

You are a Power BI administrator. A user in the Sales department needs to create reports using a shared dataset, but should not be able to modify the dataset or share it with others. What is the minimum permission level you should assign to the user on the dataset?

Accepted Answer

Build. The correct option is B, Build, because the Build permission on a shared dataset allows a user to create new reports and content based on that dataset without granting rights to edit the dataset itself or reshare it. This matches the requirement of report creation with no dataset modification or sharing capability. Reshare (A) would allow the user to share the dataset with others, which is explicitly prohibited. Write (C) grants broader editing rights over the dataset, and Read (D) only permits viewing existing content, not authoring new reports from the dataset.

Answer

Reshare

Answer

Write

Answer

Read

Question 15

A Power BI administrator needs to audit which users have exported data from a specific report in the last 30 days. What is the most efficient way to retrieve this information?

Accepted Answer

Query the Power BI activity log using the audit log search in the Microsoft 365 Defender portal.. The correct option is C: query the Power BI activity log using the audit log search in the Microsoft 365 Defender portal, because Power BI audit events such as ExportReport, ExportData, and ExportToFile are centralized in the unified Microsoft 365 audit log, which supports filtering by user, date range, and activity type for the last 30 days. This is the most efficient way to identify exactly which users exported data from a specific report, since the audit log records per-user, per-item activity. Option A is not the right tool because Microsoft Purview compliance portal search is oriented toward compliance and eDiscovery scenarios rather than granular Power BI report export auditing. Option B only provides aggregated usage metrics (view counts and similar statistics) without per-user export detail. Option D is incorrect because Azure Monitor for Power BI Premium focuses on capacity and resource telemetry, not user-level export auditing.

Answer

Use the Microsoft Purview compliance portal to search for 'Export' events.

Answer

Check the report's usage metrics report for export counts.

Answer

Review the 'Export to Excel' metrics in the Azure Monitor for Power BI Premium.