PL-300 Manage and secure Power BI Practice Test 9 — 15 Questions

Question 1

Refer to the exhibit. A Power BI dataset has the scheduled refresh configuration shown in the JSON. The refresh fails on Monday, March 2, 2026. Who will be notified?

Accepted Answer

The dataset owner.. In Power BI, when a scheduled refresh fails, the dataset owner is notified by default. Other workspace admins, tenant admins, or all users are not automatically notified unless explicitly configured. Therefore, the dataset owner will be notified.

Answer

All workspace admins.

Answer

The Power BI tenant admin.

Answer

All users with access to the dataset.

Question 2

A company uses Power BI Premium with a capacity-based license. The capacity is frequently reaching its memory limit, causing reports to be evicted. You need to reduce memory pressure on the capacity. What should you do?

Accepted Answer

Enable the 'Large dataset storage format' for all datasets.. Enabling the Large dataset storage format reduces memory pressure by offloading dataset storage to disk, allowing the model to exceed memory limits without keeping the entire dataset in memory. RLS (D) limits data per user at query time but does not reduce the in-memory dataset size and may even increase processing overhead. Moving datasets to shared capacity (B) would not reduce pressure on the Premium capacity and may degrade performance. Increasing refresh frequency (C) increases memory usage during refresh, making memory pressure worse.

Answer

Move all datasets to a shared capacity.

Answer

Increase the scheduled refresh frequency to every hour.

Answer

Implement row-level security (RLS) to limit data loaded per user.

Question 3

You need to ensure that a Power BI report containing sensitive financial data is not accessible to users outside your organization. The report is published to a workspace in the Power BI service. What should you do?

Accepted Answer

Disable 'Allow external sharing' in the Power BI admin portal.. Disabling 'Allow external sharing' at the tenant level prevents external users from accessing content in the Power BI service, including reports. Option A is incorrect because removing the report and distributing via email exposes the data to unauthorized recipients and lacks access control. Option B is incorrect because sensitivity labels classify data and can enforce protection policies, but they do not inherently block external access; additional policies like Azure Information Protection would be needed. Option D is incorrect because disabling 'Publish to web' prevents public embedding, but external users could still be shared to explicitly via direct sharing.

Answer

Remove the report from the Power BI service and distribute it via email.

Answer

Apply a sensitivity label of 'Highly Confidential' to the report.

Answer

Disable 'Publish to web' in the tenant settings.

Question 4

Your organization uses Microsoft Entra ID for identity management. You have a Power BI dataset that uses DirectQuery to an Azure Analysis Services (AAS) model. The AAS model is configured to use service principal authentication. Users report that when they open a report connected to this dataset, they see an error: 'Cannot connect to the data source. The credentials provided are invalid.' What is the most likely cause?

Accepted Answer

The service principal secret or certificate used for authentication has expired.. The service principal credentials may have expired or been revoked, leading to invalid credentials. Option B is incorrect because the error indicates invalid credentials (authentication failure), not an issue with row-level security (authorization). Option C is incorrect because lacking 'Read' permissions would cause an authorization error, not an invalid credentials error. Option D is incorrect because the dataset uses DirectQuery, so there is no scheduled refresh; the error is unrelated to import mode.

Answer

Row-level security (RLS) on the AAS model is not configured correctly.

Answer

The service principal does not have 'Read' permission on the AAS model.

Answer

The dataset is in Import mode and requires a scheduled refresh.

Question 5

Which TWO of the following are required to configure a Power BI deployment pipeline?

Accepted Answer

The user must be a workspace admin.. Options A and C are correct. A Premium workspace (Premium per user or Premium capacity) is required because deployment pipelines are a Premium feature. The user must have admin privileges on the workspace to create and manage pipelines. Option B is incorrect because Power BI Desktop is not required; pipelines are managed through the Power BI service. Option D is incorrect because a Power BI Pro license is not required; a Premium license (per user or capacity) is needed for the workspace. Option E is incorrect because 'Build' permission on the dataset is not required for configuring pipelines.

Answer

Power BI Desktop installed on the admin's machine.

Answer

A Power BI Pro license for all users.

Answer

Users must have 'Build' permission on the dataset.

Question 6

Which THREE of the following are valid methods to secure a Power BI dataset at the row level?

Accepted Answer

Row-level security using the USERPRINCIPALNAME() DAX function.. Options A, C, and E are correct. Static RLS uses roles defined in Power BI Desktop. Dynamic RLS uses USERNAME() or USERPRINCIPALNAME() to filter data based on the logged-in user. Object-level security (OLS) is for table/column security, not row-level. Option B is wrong because Azure RBAC is for managing access to Azure resources, not for Power BI row-level security.

Answer

Azure role-based access control (Azure RBAC) on the data source.

Answer

Object-level security (OLS) to restrict access to specific columns.

Question 7

Which TWO of the following actions can be performed by a user who has the 'Contributor' role on a Power BI workspace?

Accepted Answer

Create new reports and dashboards in the workspace.. Options B and C are correct. Contributors can create and edit content in the workspace, and they can share items (like reports) with others if sharing is enabled by the admin. Option A is wrong because only admins can update the workspace description. Option D is wrong because only admins can add members to the workspace. Option E is wrong because only admins can delete the workspace.

Answer

Update the workspace description.

Answer

Delete the workspace.

Answer

Add new members to the workspace.

Question 8

You are a Power BI administrator for a large enterprise. The company has a Premium capacity (P3) that hosts over 200 datasets and 500 reports. Recently, users have reported that some reports take a long time to load, and the capacity metrics show high CPU usage during business hours. You need to optimize the capacity performance without adding additional capacity. The business requires that all reports remain available during business hours (9 AM to 5 PM). You have the following options:

A. Enable 'Autoscale' on the Premium capacity to automatically add additional v-cores during peak times.
B. Implement a 'Query caching' policy for frequently used datasets.
C. Move all datasets to shared capacity to reduce Premium load.
D. Schedule dataset refreshes to occur only during business hours.

Which option should you choose?

Accepted Answer

Implement a 'Query caching' policy for frequently used datasets.. Implementing a query caching policy for frequently used datasets reduces CPU usage by storing query results in cache, improving report load times without adding capacity. Option A is wrong because Autoscale adds additional v-cores during peak times, increasing cost. Option C is wrong because moving datasets to shared capacity would degrade performance due to lower limits. Option D is wrong because scheduling refreshes during business hours would increase CPU usage during peak times, worsening performance.

Answer

Enable 'Autoscale' on the Premium capacity to automatically add additional v-cores during peak times.

Answer

Move all datasets to shared capacity to reduce Premium load.

Answer

Schedule dataset refreshes to occur only during business hours.

Question 9

You are a Power BI data analyst at a financial services company. You have created a Power BI dataset that uses a live connection to an Azure Analysis Services (AAS) tabular model. The AAS model contains sensitive financial data. You need to implement row-level security (RLS) such that each user can only see data for their assigned region. The user's region is stored in a SQL Server database table called 'UserRegion' that maps user principal names (UPNs) to region IDs. The AAS model already has a 'Region' dimension table with a 'RegionID' column. You are not allowed to modify the AAS model. What should you do?

Accepted Answer

In Power BI Desktop, import the 'UserRegion' table from SQL Server and define an RLS role that filters the 'Region' table using the USERPRINCIPALNAME() function.. With a live connection to AAS, you cannot modify the AAS model, but you can implement RLS in Power BI Desktop by importing the 'UserRegion' table and defining an RLS role that uses the USERPRINCIPALNAME() function to filter the 'Region' table. Option A is wrong because Power Query runs at refresh time and cannot dynamically filter based on the current user with a live connection. Option B is wrong because you are not allowed to modify the AAS model. Option D is wrong because it also requires modifying the AAS model.

Answer

Use Power Query to filter the 'Region' table based on the current user's region stored in the SQL database.

Answer

Define RLS roles directly in the AAS model using the USERNAME() function.

Answer

Modify the AAS model to include the 'UserRegion' table and define RLS roles in AAS.

Question 10

You are a Power BI administrator for a small business. The company uses Power BI Pro licenses for all users. You need to ensure that all data sources used in Power BI reports are documented and that sensitive data is classified. You have been asked to set up a process that automatically scans Power BI datasets for sensitive data and adds classification labels. You have the following options:

A. Use Microsoft Purview to scan Power BI datasets and apply sensitivity labels.
B. Use Power BI's built-in data classification feature to manually label datasets.
C. Use Microsoft Sentinel to monitor data access and apply labels.
D. Use Azure Policy to enforce labeling on Power BI datasets.

Which option should you choose?

Accepted Answer

Use Microsoft Purview to scan Power BI datasets and apply sensitivity labels.. Microsoft Purview can automatically scan Power BI datasets for sensitive data and apply sensitivity labels based on classification rules. Option B is wrong because manual labeling is not automatic. Option C is wrong because Microsoft Sentinel is a SIEM, not a data classification tool. Option D is wrong because Azure Policy does not directly integrate with Power BI for labeling.

Answer

Use Power BI's built-in data classification feature to manually label datasets.

Answer

Use Azure Policy to enforce labeling on Power BI datasets.

Answer

Use Microsoft Sentinel to monitor data access and apply labels.

Question 11

Your company uses Microsoft Purview Information Protection sensitivity labels. You publish a Power BI dataset that includes columns containing personally identifiable information (PII). You want to automatically apply sensitivity labels based on column sensitivity. What should you configure?

Accepted Answer

Configure an auto-labeling policy in Microsoft Purview.. Auto-labeling policies in Microsoft Purview can scan and label Power BI datasets. Option B is wrong because Microsoft Defender for Cloud Apps applies labels based on app-level behavior, not column data. Option C is wrong because sensitivity labels in Power BI are manual or inherited from data sources. Option D is wrong because Microsoft Sentinel is for security information and event management.

Answer

Use Microsoft Defender for Cloud Apps session controls.

Answer

Apply a sensitivity label to the dataset manually in Power BI Service.

Answer

Enable Microsoft Sentinel to label Power BI assets.

Question 12

You need to enforce that only users with a specific sensitivity label can access a Power BI report. Which TWO actions should you take?

Accepted Answer

Enable sensitivity labels for Power BI in Microsoft Purview.. To enforce access control based on sensitivity labels, you must first enable sensitivity labels for Power BI in Microsoft Purview (option B). Then, you create a label-based access control policy in Microsoft Purview to restrict access to the report based on the label (option E). Options A and C are incorrect: workspace roles and row-level security do not consider sensitivity labels for access. Option D sets a default label, not an access control policy.

Answer

Assign users to the Viewer role in the workspace.

Answer

Configure row-level security (RLS) on the dataset.

Answer

Set the default sensitivity label for the workspace.

Question 13

Refer to the exhibit. You have a Power BI dataset with the JSON policy shown. You add a user to the USOnly role. What happens when that user views a report based on this dataset?

Accepted Answer

The user sees only rows where Region is 'US' in the Sales table.. Row-level security (RLS) restricts data: only rows where Region is 'US' are visible. Option A is wrong because RLS does not hide the entire table. Option C is wrong because RLS does not affect columns. Option D is wrong because RLS does not affect other tables unless defined.

Answer

The user sees all rows in the Sales table.

Answer

The user sees all rows but the SalesAmount column is hidden.

Answer

The user sees all rows in all tables of the dataset.

Question 14

You have a Power BI dataset that uses a live connection to an Azure Analysis Services (AAS) model. The AAS model has object-level security (OLS) that hides certain measures. Your Power BI report users need to see those measures. What should you do?

Accepted Answer

Modify the object-level security roles in Azure Analysis Services to include the measures.. The measures are hidden by object-level security (OLS) in the Azure Analysis Services model. To make them visible to Power BI report users, you must modify the OLS roles in AAS to include those measures. Options A, B, and C are incorrect because: A) Power BI Desktop OLS is only applicable in import mode, not with live connections; B) Row-level security (RLS) controls row-level data access, not measure visibility; C) Changing to import mode is unnecessary and would sacrifice the benefits of a live connection; the proper solution is to adjust security at the AAS level.

Answer

Use Power BI Desktop object-level security to override AAS settings.

Answer

Configure row-level security (RLS) in Power BI to grant access.

Answer

Change the dataset to import mode and then apply OLS in Power BI.

Question 15

You are a Power BI administrator for a large enterprise. The company has a Power BI tenant with thousands of workspaces. You need to audit all shared links (shareable links) that have been created across the tenant to identify any that are shared with external users. You also need to revoke any links that were created more than 90 days ago. You want to use a PowerShell script to accomplish this efficiently. The script must output a CSV file with columns: LinkId, WorkspaceName, ReportName, CreatedDate, ExternalSharing. What should you do?

Accepted Answer

Use the Power BI REST API cmdlet Get-PowerBIShareableLink to retrieve and filter links by CreatedDate, then revoke with Remove-PowerBIShareableLink.. The Power BI REST API (via PowerShell) can retrieve shareable links and filter by creation date. Option A is wrong because the admin portal lacks automation. Option C is wrong because Microsoft Graph API does not directly manage Power BI shareable links. Option D is wrong because Log Analytics does not provide shareable link metadata.

Answer

Enable Power BI activity logs and query Log Analytics for shareable links.

Answer

Use Microsoft Graph API to audit and manage Power BI shareable links.

Answer

Use the Power BI admin portal to manually export shareable links.