PL-300 Manage and secure Power BI Practice Test 9 — 15 Questions

Question 1

You are a Power BI administrator. A user reports that they receive an error 'You cannot view this report because it is not shared with you' when trying to open a report in a workspace where they are a Member. What is the most likely cause?

Accepted Answer

The report has restricted access set at the report level, and the user is not in the allowed list.. Option A is correct because report-level permissions are separate from workspace roles; the report owner may have restricted access to specific users. Option B is wrong because Member role allows viewing all content unless restricted. Option C is wrong because the report is in the workspace. Option D is wrong because if the user is a Member, they should be able to view unless explicitly denied.

Answer

The report is stored in a different workspace.

Answer

The user's role is Viewer, not Member.

Answer

The user's Power BI license is expired.

Question 2

Which TWO of the following are valid methods to share a Power BI report with external users (outside your organization)? (Choose two.)

Accepted Answer

Invite the external user as a guest in your Microsoft Entra ID (Azure AD) and share the report directly with them.. Options A and D are correct. Option A: Using Azure AD B2B, you can invite external users as guest users and share reports directly. Option D: Publish to web (public) makes the report available to anyone. Option B is wrong because sharing a link via email requires the recipient to have a Power BI license; if they are external, they need to be guest users. Option C is wrong because exporting to PDF is a manual process, not a sharing method. Option E is wrong because embedding in a public website is essentially Publish to web, but requires enabling the feature.

Answer

Export the report to PDF and email it to the external user.

Answer

Send the external user a direct link to the report via email; they can view it without any additional setup.

Answer

Embed the report in a SharePoint Online page using the Power BI web part.

Question 3

Which THREE of the following are required to configure Microsoft Purview Information Protection sensitivity labels for Power BI? (Choose three.)

Accepted Answer

Users must have appropriate permissions (e.g., Azure Information Protection rights) to apply labels.. Options A, C, and D are correct. Sensitivity labels in Power BI require enabling in the tenant settings, having the labels published in Microsoft 365 Compliance Center, and the user must have the appropriate permissions to apply the labels. Option B is wrong because Power BI Premium is not a requirement; labels work in shared capacity too. Option E is wrong because a Power BI Pro license is required for the user to apply labels, but it's not a configuration step.

Answer

Each user must have a Power BI Pro license.

Answer

Have a Power BI Premium capacity assigned to the workspace.

Question 4

Which TWO of the following are valid ways to enforce row-level security (RLS) on a Power BI dataset? (Choose two.)

Accepted Answer

Define roles and role members in Power BI Desktop using DAX filter expressions.. Options A and C are correct. RLS can be defined in Power BI Desktop using static roles, and in DirectQuery with SSO, RLS can be enforced in the source database. Option B is wrong because RLS is not applied via the Power BI service interface for datasets; it's defined in Desktop. Option D is wrong because RLS in Power BI is not based on Microsoft Entra ID groups; it's based on roles defined in the model. Option E is wrong because RLS is not configured in Excel.

Answer

Use Power BI Report Builder to define RLS on paginated reports.

Answer

Create RLS rules directly in the Power BI service under dataset security.

Answer

Assign users to security groups in Microsoft Entra ID and map those groups to RLS roles in the Power BI service.

Question 5

You are a Power BI administrator. A user reports that their scheduled data refresh fails every day with the error 'The credentials provided for the data source are invalid.' The user has verified the credentials are correct. What is the most likely cause?

Accepted Answer

The data source requires OAuth authentication, and the refresh token has expired.. Option D is correct because if the data source uses OAuth, the refresh token may expire and need to be refreshed. Option A is wrong because the gateway status would show a different error. Option B is wrong because the user already verified credentials. Option C is wrong because incremental refresh does not affect credential validity.

Answer

The user changed their password after configuring the refresh.

Answer

The on-premises data gateway is offline.

Answer

The dataset uses incremental refresh, which requires Premium capacity.

Question 6

Your organization uses Power BI Premium and wants to enforce that users can only see data relevant to their department (Sales, Marketing, Finance) using row-level security (RLS). The dataset contains a 'Department' column. You have created three RLS roles, each with a filter like [Department] = "Sales". You publish the dataset and add users to the roles. However, users in the Sales role can see all data. What is the most likely cause?

Accepted Answer

The users are also assigned to workspace roles (e.g., Member) that grant them access to the dataset without RLS restrictions.. Option B is correct because if the users have workspace-level permissions that allow them to see all data (e.g., Admin, Member, Contributor), RLS is bypassed. Option A is wrong because the filter syntax is correct. Option C is wrong because RLS works in Power BI Desktop preview. Option D is wrong because multiple roles don't cause this issue; they are additive.

Answer

The RLS roles were created in the Power BI service, not in Power BI Desktop.

Answer

The users are members of multiple RLS roles, so they see all data.

Answer

The RLS filter uses a string comparison that is case-sensitive and the data contains mixed case.

Question 7

You manage a Power BI environment. A user wants to share a dashboard with an external partner. You need to ensure the partner cannot export data or share the dashboard further. What should you do?

Accepted Answer

Add the partner as a guest user in Microsoft Entra ID and share the dashboard directly, ensuring the 'Allow recipients to share' and 'Allow users to export data' options are unchecked.. Option C is correct because sharing with an external user as a guest restricts them based on their guest permissions; you can disable export and resharing in the sharing dialog. Option A is wrong because Publish to web makes it public. Option B is wrong because building a composite model is not a sharing method. Option D is wrong because the partner would need to be a guest anyway.

Answer

Create a composite model on top of the dataset and share the report as an app.

Answer

Create a new workspace and add the partner as a Viewer.

Answer

Publish the dashboard to a public website using 'Publish to web'.

Question 8

Your organization uses Power BI and has deployed Microsoft Purview Data Loss Prevention (DLP) policies. You want to prevent users from exporting data from Power BI reports that contain credit card numbers. What should you configure?

Accepted Answer

Create a DLP policy in Microsoft Purview that detects credit card numbers in Power BI and set the action to block export.. Option D is correct because DLP policies in Power BI can be applied to datasets and reports, and they can block export of data that matches sensitive info types like credit card numbers. Option A is wrong because sensitivity labels alone do not block export. Option B is wrong because RLS restricts data visibility, not export. Option C is wrong because tenant settings control general export capabilities but not based on content.

Answer

Configure row-level security (RLS) to hide the credit card column from users.

Answer

Apply a Microsoft Purview sensitivity label 'Highly Confidential' to the dataset and configure the label to prevent export.

Answer

Disable the 'Export to Excel' and 'Export to CSV' settings in the Power BI admin portal.

Question 9

You are a Power BI administrator. A user reports that they cannot see any data when they open a report that uses row-level security (RLS). The user is a member of the 'Sales' RLS role, which filters data to [Region] = 'North America'. However, the report shows blank visuals. What is the most likely cause?

Accepted Answer

The RLS filter uses an exact string match, but the actual region values in the data are different (e.g., 'North America' vs 'North America ' or 'NA').. Option D is correct because if the 'North America' region name in the data does not exactly match the filter (e.g., 'North America' vs 'NA'), the filter will not match any rows. Option A is wrong because the user can see the report, just no data. Option B is wrong because RLS roles are usually defined in Desktop. Option C is wrong because the user is in the Sales role, so they should see data.

Answer

The user does not have permission to view the report.

Answer

The user is also a member of a workspace role that overrides RLS.

Answer

The RLS role was defined in the Power BI service after publishing, but the user was not added.

Question 10

You need to ensure that only the Finance team can access a specific Power BI dashboard. What is the most efficient way to accomplish this?

Accepted Answer

Share the dashboard directly with the Finance team security group, granting only 'View' permissions.. Option A is correct because sharing the dashboard directly with the Finance team security group is the simplest and most efficient method. Option B is wrong because it would require moving the dashboard. Option C is wrong because apps are for distributing multiple items. Option D is wrong because it would affect all content in the workspace.

Answer

Create a new workspace, add the Finance team as Members, and move the dashboard to that workspace.

Answer

Add the Finance team as Admins of the workspace containing the dashboard.

Answer

Publish the dashboard as an app and assign the Finance team as the audience.

Question 11

Your organization uses Power BI and has implemented Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security). A user reports that they are unable to export data from a Power BI report. The Power BI tenant settings allow export. What could be the cause?

Accepted Answer

A Microsoft Defender for Cloud Apps session policy is blocking the export based on the user's risk level or the report's sensitivity.. Option D is correct because Defender for Cloud Apps can create session policies that block downloads based on risk or sensitivity. Option A is wrong because the tenant setting allows export. Option B is wrong because the user is not a guest. Option C is wrong because sensitivity labels alone do not block export; they need DLP policies.

Answer

The 'Export to Excel' setting is disabled in the Power BI admin portal.

Answer

A sensitivity label with high classification is applied to the report, automatically blocking export.

Answer

The user is an external guest user.

Question 12

You are a Power BI administrator. A user in your organization wants to share a report with an external user who does not have a Power BI license. You want to allow the external user to view the report without requiring them to sign in. What should you do?

Accepted Answer

Use the 'Publish to web' option to generate an embed code and send the link to the external user.. Option C is correct because 'Publish to web' creates a public embed code that anyone can view without authentication. Option A is wrong because sharing directly requires the external user to have a Power BI license or be a guest. Option B is wrong because the external user must authenticate as a guest. Option D is wrong because the external user would need a license to access the Power BI service.

Answer

Create a new user account in your Microsoft Entra ID for the external user and assign a Power BI Pro license.

Answer

Share the report directly with the external user's email address.

Answer

Invite the external user as a guest in Microsoft Entra ID, then share the report.

Question 13

Refer to the exhibit. You are configuring a Microsoft Purview Data Loss Prevention (DLP) policy for Power BI. The policy rule shown is intended to block downloads from datasets that have the 'Confidential' sensitivity label and are sourced from SharePoint or SQL Server. However, users are still able to download data from these datasets. What is the most likely reason?

Accepted Answer

The action 'blockDownload' is not a valid action; the correct action should be 'Block' or 'BlockDownload' might require additional configuration.. Option B is correct because in the Power BI DLP policy, you must specify the action as 'Block' for download to be prevented. The exhibit shows 'blockDownload', but the correct action syntax is likely 'Block' (or the policy is not fully configured). Option A is wrong because the condition uses 'dataSource' which is valid. Option C is wrong because the exhibit shows a single condition with both label and source. Option D is wrong because the target is datasets.

Answer

The target should be 'reports' instead of 'datasets'.

Answer

The condition uses 'dataSource' which is not a valid property in Power BI DLP policies.

Answer

The policy rule is missing the 'and' operator between the two conditions.

Question 14

You are the Power BI administrator for Contoso Ltd. The company has a Premium capacity workspace named 'Sales Analytics' that contains a dataset named 'SalesData' and several reports. The dataset uses DirectQuery to an Azure SQL Database. Row-level security (RLS) is configured in Power BI Desktop with roles: 'SalesManager' (filters to SalesManager rows), 'SalesRep' (filters to SalesRep rows). After publishing, you assign users to the roles in the Power BI service. However, when a user assigned to the 'SalesRep' role opens a report, they see all data instead of only their own rows. You have verified that the RLS role definition is correct and that the user is the only member of the 'SalesRep' role. The user has no other workspace permissions. The dataset is set to use single sign-on (SSO) for the DirectQuery connection. What is the most likely cause of the issue?

Accepted Answer

Configure RLS in the Azure SQL Database itself using security predicates or views that filter based on the user's identity (e.g., USER_NAME() or SUSER_SNAME()).. Option A is correct because when using DirectQuery with SSO, the user's identity is passed to the data source. If the Azure SQL Database does not enforce RLS (e.g., via security predicates or user mappings), all data is returned. Power BI RLS is bypassed in this scenario. Option B is wrong because the user is not a workspace member with edit permissions. Option C is wrong because the user is the only member. Option D is wrong because RLS in Power BI works with DirectQuery, but SSO changes the behavior.

Answer

Add the user to multiple RLS roles to ensure the filters are applied.

Answer

Change the dataset storage mode from DirectQuery to Import.

Answer

Remove the user from the 'SalesRep' role and add them as a Viewer on the workspace to force RLS.

Question 15

You are a Power BI administrator for a large enterprise. The organization uses Microsoft Purview Information Protection sensitivity labels. You have enabled sensitivity labels in the Power BI admin portal and published labels in the Microsoft 365 Compliance Center. Users have been assigned the appropriate licenses. However, when a user tries to apply a sensitivity label to a report in the Power BI service, the label options are grayed out. The user has a Power BI Pro license and is a Member of the workspace where the report resides. The report is stored in a workspace that is backed by a Premium capacity. What is the most likely reason the user cannot apply the label?

Accepted Answer

The user does not have the required Azure Rights Management (Azure RMS) license or permissions to apply labels.. Option C is correct because to apply sensitivity labels in Power BI, the user must have the 'Azure Information Protection' (AIP) rights (e.g., 'Rights Management' or 'Protection') enabled. Even with a Pro license, if the user does not have the AIP add-on or the rights assigned, they cannot apply labels. Option A is wrong because the workspace is backed by Premium, but labels work in shared capacity too. Option B is wrong because the user is a Member, which allows editing. Option D is wrong because the labels are published.

Answer

The sensitivity labels have not been published to the user's security group.

Answer

The workspace is not enabled for sensitivity labels; you need to enable labels at the workspace level.

Answer

The user's role in the workspace is insufficient; they need at least Contributor role to apply labels.