PL-300 Manage and secure Power BI Practice Test 8 — 15 Questions

Question 1

You are configuring a Power BI data gateway for a scheduled refresh. The data source is an on-premises SQL Server database. Which authentication method should you use for the gateway to connect to the SQL Server?

Accepted Answer

Windows authentication (Kerberos). The gateway typically uses Windows authentication (Kerberos) for on-premises SQL Server to support single sign-on and pass-through. Option B is correct. Option A is wrong because OAuth is for cloud services. Option C is wrong because Basic is less secure and not recommended. Option D is wrong because Service Principal is for Azure resources.

Answer

OAuth 2.0

Answer

Service Principal

Answer

Basic authentication with SQL login

Question 2

You need to ensure that a Power BI report published to the service can be embedded in a secure internal SharePoint Online page. Only authenticated users from your Microsoft Entra ID tenant should be able to view the report. What should you do?

Accepted Answer

Use the 'Embed' option in Power BI service to generate a secure embed code, then add the Power BI web part in SharePoint.. Embedding a report securely requires using the 'embed' option with a secure embed code that respects user permissions, and then adding the report to SharePoint via the Power BI web part. Option C is correct. Option A is wrong because Publish to web is public. Option B is wrong because sharing with specific users without embedding is not embedding. Option D is wrong because allowing all authenticated users is too broad.

Answer

Use the 'Embed in SharePoint Online' option in Power BI service.

Answer

Share the report directly with all users and provide a direct link.

Answer

Use the 'Publish to web (public)' option and embed the iframe in SharePoint.

Question 3

Your Power BI tenant has a capacity-based license (Premium). You want to enforce that only reports with a specific sensitivity label from Microsoft Purview can be exported to PDF. What feature should you use?

Accepted Answer

Sensitivity labels from Microsoft Purview. Sensitivity labels in Power BI can be used to control export actions. Option B is correct because sensitivity labels can restrict exporting based on label. Option A is wrong because data loss prevention (DLP) policies in Power BI are for preventing data exfiltration but not specifically tied to export formats. Option C is wrong because app protection policies are for mobile devices. Option D is wrong because conditional access policies control access, not export.

Answer

Microsoft Intune app protection policies

Answer

Data loss prevention (DLP) policies for Power BI

Answer

Conditional Access policies in Microsoft Entra ID

Question 4

You are a Power BI administrator. A user reports that they are unable to share a dashboard with an external user from a partner organization. The external user has a Microsoft Entra ID account in their own tenant. What is the most likely reason?

Accepted Answer

The 'Share content with external users' tenant setting is disabled.. Sharing with external users requires enabling B2B collaboration in Microsoft Entra ID and configuring Power BI tenant settings to allow sharing with external users. Option A is correct. Option B is wrong because guest user accounts are exactly for this. Option C is wrong because Power BI guest users can view reports. Option D is wrong because licensing via viral trial is possible.

Answer

External users cannot view Power BI content; they need a Power BI license.

Answer

The dashboard is based on a dataset that uses RLS and the external user is not in the role.

Answer

External users must be added as members in the same tenant.

Question 5

Your organization uses Power BI with Premium capacity. You need to configure a scheduled refresh for a dataset that connects to an Azure SQL Database. The refresh must complete before 6:00 AM every day. The dataset currently takes 45 minutes to refresh. What is the most important consideration?

Accepted Answer

Schedule the refresh to start early enough to complete by 6:00 AM, considering any other scheduled refreshes.. Scheduled refresh times are limited by the number of daily refreshes and the capacity's concurrency limits. Option D is correct because the refresh time must be within the available window and not conflict with other refreshes. Option A is wrong because Premium allows up to 48 refreshes per day. Option B is wrong because incremental refresh is optional, not required. Option C is wrong because gateway is not needed for Azure SQL.

Answer

Use an on-premises data gateway to connect to Azure SQL.

Answer

Configure incremental refresh to reduce the refresh time.

Answer

Ensure the dataset does not exceed the maximum number of daily refreshes (8 for shared, 48 for Premium).

Question 6

You are a Power BI administrator. You need to audit all activities related to sharing reports and dashboards in the Power BI service. Which tool should you use?

Accepted Answer

Power BI activity log (via admin API or portal). The Power BI activity log provides auditing of all user activities, including sharing. Option A is correct. Option B is wrong because Microsoft Purview compliance portal has audit log but Power BI activity log is more specific and detailed. Option C is wrong because diagnostic settings export logs to other destinations, not for direct querying. Option D is wrong because Microsoft Sentinel collects logs but is not the primary auditing tool.

Answer

Microsoft Purview compliance portal audit log

Answer

Azure diagnostic settings for Power BI

Answer

Microsoft Sentinel

Question 7

You create a Power BI report that uses a live connection to an Azure Analysis Services (AAS) model. You want to enforce row-level security defined in the AAS model. What should you do?

Accepted Answer

No additional configuration needed; RLS from AAS is automatically applied.. With a live connection, Power BI respects the RLS defined in the source model. Option A is correct. Option B is wrong because you cannot add RLS in Power BI for a live connection. Option C is wrong because you cannot define RLS in Power BI for live connections. Option D is wrong because you do not need to redefine.

Answer

Use object-level security (OLS) instead.

Answer

Use Power BI service to create RLS roles on the dataset.

Answer

Define the same RLS roles in Power BI Desktop and publish.

Question 8

Which TWO actions should you take to ensure that sensitive columns (e.g., customer names) are not visible to certain users in a Power BI report? (Select exactly two.)

Accepted Answer

Use object-level security (OLS) to hide the columns for specific roles.. Object-level security (OLS) can hide entire columns from roles. Row-level security (RLS) filters rows but cannot hide columns. Building separate datasets is one way but not efficient. Option A and B are correct. Option C is wrong because RLS does not hide columns. Option D is wrong because that controls access to the report, not column visibility. Option E is wrong because masking is not available in Power BI.

Answer

Apply dynamic data masking on the dataset in Power BI service.

Answer

Use row-level security (RLS) to filter out rows containing sensitive data.

Answer

Set the report to not allow users with certain roles to view the report.

Question 9

Which THREE features are available in Power BI Premium capacity but not in Power BI shared capacity? (Select exactly three.)

Accepted Answer

AI visuals and cognitive services integration.. Premium capacity offers larger data storage, XMLA endpoints for write operations, and AI features. Option A, B, and C are correct. Option D is wrong because incremental refresh is available in shared capacity (with limitations). Option E is wrong because automatic page refresh is available in shared capacity for DirectQuery.

Answer

Incremental refresh.

Answer

Automatic page refresh.

Question 10

Which TWO are valid methods to secure access to a Power BI dataset? (Select exactly two.)

Accepted Answer

Row-level security (RLS). Row-level security (RLS) and object-level security (OLS) are the two primary methods. Option A is correct, Option B is correct. Option C is wrong because column-level security is not a separate feature; it's OLS. Option D is wrong because app permissions control access to the app, not the dataset directly. Option E is wrong because data encryption is not a dataset-level access control.

Answer

Column-level security (CLS)

Answer

App permissions

Answer

Data encryption at rest

Question 11

Refer to the exhibit. You have a Power BI dataset configured with the refresh schedule shown. On Monday at 04:00 UTC, you check the refresh history and see the refresh failed. What is the most likely cause?

Accepted Answer

The service principal used for authentication has expired or lacks permissions.. The connection string uses 'ActiveDirectoryServicePrincipal' which requires a service principal to be registered in Microsoft Entra ID. If the service principal does not have the correct permissions or the secret expired, the refresh will fail. Option B is correct. Option A is wrong because the gateway is not needed for Azure SQL. Option C is wrong because the refresh time is on the hour. Option D is wrong because the refresh schedule is set only on weekdays, but Monday is a weekday, so that's fine.

Answer

The on-premises data gateway is not installed.

Answer

The refresh time is set to 03:00 UTC, but the dataset is in a different time zone.

Answer

The refresh schedule only runs on weekdays, but Monday is considered a weekend in some regions.

Question 12

Refer to the exhibit. You are implementing a sensitivity label policy in Microsoft Purview for Power BI. The policy shown is intended to block users in the SalesTeam group from exporting reports with the 'Confidential' label to PDF. However, users in SalesTeam can still export PDF. What is the most likely issue?

Accepted Answer

The sensitivity label 'Confidential' has not been applied to the reports.. The policy syntax is incorrect; the 'Action' should be 'Block' but the condition needs to be structured correctly. However, the likely issue is that the sensitivity label 'Confidential' is not applied to the reports, or the policy is not published. Option D is correct. Option A is wrong because the condition is valid. Option B is wrong because 'ExportReportToPDF' is a valid activity. Option C is wrong because the group membership is not necessarily the issue.

Answer

The 'ExportReportToPDF' activity name is incorrect; it should be 'ExportToPDF'.

Answer

The SalesTeam group does not contain the users.

Answer

The 'Action' should be 'Deny' instead of 'Block'.

Question 13

Refer to the exhibit. You define an RLS role in Power BI Desktop as shown. You publish the dataset and assign the user 'user@contoso.com' to the role. When the user views a report that uses this dataset, they see no data. What is the most likely cause?

Accepted Answer

The Region values in the data have leading spaces or are not exactly 'North' (e.g., 'North ').. The filter expression uses a string comparison that might not match due to case sensitivity or leading/trailing spaces. Option A is correct. Option B is wrong because the role name is valid. Option C is wrong because the user is assigned to the role. Option D is wrong because RLS works in the service.

Answer

The role name is invalid; it must not contain spaces.

Answer

RLS is not applied in Power BI service for tables with less than 100 rows.

Answer

The user is not assigned to the role correctly.

Question 14

You are a Power BI administrator. A user reports they cannot publish a report to a shared workspace because they receive an error 'You need at least a Contributor role to publish to this workspace.' The user is a member of a security group that has been assigned the Viewer role on the workspace. What should you do to allow the user to publish?

Accepted Answer

Add the user as a Contributor directly to the workspace, or change the security group role to Contributor.. Option C is correct because the Viewer role does not allow publishing; the user needs at least a Contributor role. Adding them directly as a Contributor overrides the group assignment. Option A is wrong because Power BI does not allow granting permissions on individual reports in a workspace. Option B is wrong because Viewer allows viewing only. Option D is wrong because the app workspace already exists.

Answer

Grant the user Read permission on the report in the workspace.

Answer

Change the user's role to Viewer on the workspace and ask them to use the 'Publish to web' option.

Answer

Create a new workspace and add the user as a Member.

Question 15

Your organization uses Power BI with a shared capacity (no Premium capacity). You need to implement row-level security (RLS) on a dataset that is used by multiple reports. Which of the following is a limitation you must consider?

Accepted Answer

RLS cannot be applied when the dataset uses DirectQuery to a data source that requires single sign-on (SSO) because the user's identity is passed through, and the source must enforce RLS.. Option B is correct because in shared capacity, RLS cannot be applied to datasets that use DirectQuery to Azure Analysis Services or other sources that require single sign-on (SSO) – RLS must be defined in the source. Option A is wrong because RLS works in shared capacity. Option C is wrong because RLS is defined in Power BI Desktop and works with import mode. Option D is wrong because RLS can be defined in Power BI Desktop using DAX.

Answer

RLS is not supported in shared capacity; you need a Premium license.

Answer

RLS roles must be created in the Power BI service after publishing; they cannot be created in Power BI Desktop.

Answer

RLS can only be applied to tables that are imported, not to tables using DirectQuery.