PL-300 Manage and secure Power BI Practice Test 9 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing a Power BI activity log entry. What action should you take to ensure compliance if the user who created the report should not have access to 'Confidential' data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Investigate the user's permissions on the dataset 'SalesDataset' to verify they are authorized to access confidential data.. The correct action is C: investigate the user's permissions on the dataset 'SalesDataset' to verify they are authorized to access confidential data. In a Power BI activity log, a report creation event alone does not prove a compliance breach; the actual access control is enforced through the dataset's permissions and the sensitivity label applied to the data, so you must confirm whether the user legitimately has access to 'Confidential' data before taking any remediation. Option A is wrong because deleting the report is a destructive action that does not address the underlying permission issue and could destroy legitimate work. Option B is wrong because changing the sensitivity label to 'General' would misclassify the data and could itself create a compliance violation. Option D is wrong because simply ignoring the event fails to verify whether the user's access was authorized, which is the required compliance check.

Answer

Delete the report immediately.

Answer

Change the sensitivity label on the report to 'General'.

Answer

Ignore the event because the report creation is logged but not necessarily a violation.

Question 2

You are a Power BI administrator. Your organization uses Microsoft Entra ID for identity management. You need to ensure that only users from specific security groups can access the Power BI service. What should you configure?

Accepted Answer

Create a conditional access policy in Microsoft Entra ID that grants access to Power BI only for members of the allowed security groups.. Option B is correct because Microsoft Entra ID Conditional Access is the supported mechanism to restrict sign-in to a cloud app such as Power BI based on group membership: you create a policy assigned to the Power BI cloud app, target the specific security groups under Users, and grant access while blocking everyone else. This enforces the restriction at authentication time across the tenant, which is exactly what the scenario requires. Option A is wrong because the Power BI admin portal's 'Allow users to access Power BI' setting is a tenant-wide on/off toggle that cannot be scoped to specific security groups. Option C is wrong because B2B guest settings govern external collaboration and domain allow/deny lists, not which internal security groups may use Power BI. Option D is wrong because workspace access permissions only control content within individual workspaces and do not prevent users from signing in to the Power BI service.

Answer

In the Power BI admin portal, configure the 'Allow users to access Power BI' setting to specify the security groups.

Answer

Configure the 'B2B guest user settings' to allow only specific domains.

Answer

Modify the workspace access permissions to include only the allowed security groups.

Question 3

A Power BI administrator needs to ensure that all reports in a workspace are labeled with a sensitivity label automatically when created. The workspace is used by multiple departments. What should the administrator configure?

Accepted Answer

Set a default sensitivity label for the workspace in the workspace settings.. The correct option is A: setting a default sensitivity label for the workspace in the workspace settings. In Power BI, a workspace admin can assign a default sensitivity label at the workspace level, so any new report or dataset created in that workspace automatically inherits that label without user action, which fits the requirement that all reports be labeled automatically on creation. Option B does not fit because Microsoft Purview auto-labeling policies apply to supported workloads like Exchange, SharePoint, and OneDrive, not directly to Power BI workspace-created items. Option C is incorrect because a tenant-wide default label is not the mechanism for per-workspace automatic labeling of new reports. Option D is incorrect because manual labeling by users is not automatic and would not guarantee consistent labeling.

Answer

Configure a Microsoft Purview auto-labeling policy for the workspace.

Answer

Set the default sensitivity label for the entire Power BI tenant.

Answer

Instruct all users to manually apply the sensitivity label when creating reports.

Question 4

A Power BI administrator needs to ensure that reports containing sensitive financial data are only accessible to users who have completed mandatory training and are using compliant devices. The organization uses Microsoft Entra ID and Microsoft Intune. Which feature should the administrator configure?

Accepted Answer

Create a Conditional Access policy that requires device compliance and a specific group membership for training completion. The correct option is C: a Conditional Access policy that requires device compliance and a specific group membership for training completion. Conditional Access in Microsoft Entra ID can enforce both device compliance (via Intune) and group membership as access controls, so only users in the trained group on compliant devices can reach the Power BI reports. Option A is wrong because Microsoft Purview scans and classifies data but does not enforce training-based access at sign-in. Option B is wrong because row-level security filters rows within a dataset, not user training status or device compliance. Option D is wrong because sensitivity labels and MFA do not verify training completion or device compliance.

Answer

Deploy Microsoft Purview to scan the reports and enforce access policies

Answer

Use row-level security (RLS) to filter data based on user training status

Answer

Apply sensitivity labels to the reports and require MFA

Question 5

A user reports that they cannot publish a Power BI Desktop file to the Power BI service. The error message indicates insufficient permissions. The user is a member of a workspace and has the Viewer role. What is the most likely cause?

Accepted Answer

The user has the Viewer role in the workspace. The correct answer is A: the user has the Viewer role in the workspace. In Power BI, the Viewer role only allows viewing and interacting with existing content; it does not grant permission to publish or import .pbix files into the workspace, which requires at least the Contributor role. That directly matches the reported 'insufficient permissions' error when attempting to publish from Power BI Desktop. Option B is incorrect because RLS filters data rows for viewers and would not block publishing. Option C is not the most likely cause, since a Pro license is needed to publish to shared workspaces but the error specifically points to workspace role permissions. Option D is unrelated, as the .pbix file's storage location does not determine Power BI service publishing rights.

Answer

Row-level security (RLS) is preventing the user from seeing the data

Answer

The user does not have a Power BI Pro license

Answer

The .pbix file is stored on a network share that restricts write access

Question 6

Which TWO actions are required to enable Bring Your Own Key (BYOK) encryption for Power BI datasets? (Select exactly two.)

Accepted Answer

Upload the customer-managed key to Azure Key Vault. BYOK for Power BI requires the customer-managed key to be created and stored in Azure Key Vault, so option C is correct because the RSA 2048-bit (or 3072/4096-bit) key must reside in an Azure Key Vault subscription you control. Option D is also correct because, after the key exists in Key Vault, a Power BI admin must enable BYOK in the Power BI admin portal (Tenant settings) and point the tenant to that Key Vault key, granting the Power BI service the necessary wrap/unwrap permissions. Option A is not required because BYOK is a tenant-level feature available with Power BI Premium (or Fabric capacity) but assigning a specific workspace to a capacity is not the action that enables BYOK. Option B is incorrect because the key itself is never stored in Power BI admin settings; only a reference to the Key Vault key is configured there. Option E is incorrect because Microsoft Purview is not used to register the encryption key for Power BI BYOK.

Answer

Assign the workspace to a Power BI Premium capacity

Answer

Store the encryption key in the Power BI service admin settings

Answer

Register the encryption key in Microsoft Purview compliance portal

Question 7

A Power BI administrator needs to allow an external partner organization to access a specific report without requiring them to have Power BI Pro licenses. The report is stored in a workspace assigned to a Premium capacity. What is the correct configuration?

Accepted Answer

Invite the external users as guest users in Microsoft Entra ID, add them to the workspace with Viewer role, and share the report or app. It uses Microsoft Entra B2B guest invitations so external partners authenticate with their own credentials, and then grants them Viewer access to the workspace/app; with the workspace on Premium capacity, guests can consume the content without needing Power BI Pro licenses. Adding them as workspace members with Viewer role alone (A) does not establish the required external identity in the tenant. Publishing to the web (B) creates an anonymous public link, which is insecure and not appropriate for a specific partner. 'Embed for your organization' (D) is for internal users with Power BI accounts and does not provide the licensing-free external sharing scenario.

Answer

Add the external users as members of the workspace and assign them a Viewer role

Answer

Publish the report to the web and share the public link

Answer

Embed the report in a secure portal using the 'embed for your organization' option

Question 8

You have a Power BI capacity that is frequently hitting its memory limits, causing refreshes to fail. You need to reduce memory usage without increasing capacity size. What should you do?

Accepted Answer

Reduce the number of parallel data refresh operations.. The correct answer is B: reducing the number of parallel data refresh operations lowers peak memory usage because each concurrent refresh consumes memory for its own data processing, and running fewer at once means fewer simultaneous memory spikes on the capacity. This directly addresses the memory-limit failures without requiring a larger capacity SKU. Option A is wrong because increasing eviction time keeps unused data in memory longer, which would increase rather than reduce memory pressure. Option C is wrong because RLS is not the primary driver of refresh memory usage, and removing it would not reliably solve capacity memory limits. Option D is wrong because more frequent refreshes increase overall memory and CPU load, making the problem worse.

Answer

Increase the eviction time for unused data.

Answer

Remove row-level security (RLS) from the dataset.

Answer

Increase the frequency of scheduled refreshes.

Question 9

You need to grant a user the ability to manage permissions on a Power BI workspace but not to view or edit the content. What minimum role should you assign?

Accepted Answer

Admin. The Admin role is the only workspace role that can manage permissions and membership, even though it also allows viewing and editing content. The minimum role required to manage permissions is Admin. Option A is incorrect because Contributor can view and edit content but cannot manage permissions. Option B is incorrect because Viewer can only view content and cannot manage permissions. Option C is incorrect because Member can view and edit content but cannot manage permissions.

Answer

Contributor

Answer

Viewer

Answer

Member

Question 10

Which TWO methods can you use to share a Power BI report with external users who do not have a Power BI Pro license? (Choose two.)

Accepted Answer

Embed the report in a secure portal using 'Embed for your customers'.. Option A is correct because the 'Embed for your customers' (app-owns-data) scenario uses an embed token and a service principal or master account to render the report inside your own application or secure portal, so the external viewers authenticate to your app and never need a Power BI Pro license. Option B is correct because 'Publish to web' generates an anonymous public embed code/URL that anyone can view in a browser without any Power BI license, Pro or otherwise. Option C is not correct because exporting to PDF produces a static file, not a shared interactive Power BI report, and it is not a Power BI sharing method. Option D is not correct because direct sharing via email in the Power BI service requires the recipient to have a Power BI Pro (or PPU) license to open the report. Option E is not correct because exporting to Excel yields a static data extract, not a live report, and likewise is not a Power BI sharing mechanism.

Answer

Export the report to PDF and share the file.

Answer

Share directly via Power BI using the user's email address.

Answer

Export the report to Excel and attach it to an email.

Question 11

Your organization uses Microsoft Defender for Cloud Apps to monitor Power BI activity. You need to receive an alert when a user exports a report with a sensitivity label of 'Highly Confidential' from Power BI service. What should you configure?

Accepted Answer

Create an activity policy in Microsoft Defender for Cloud Apps.. The correct option is D: create an activity policy in Microsoft Defender for Cloud Apps. Defender for Cloud Apps connects to Power BI via the app connector and its activity policies can trigger alerts on specific user activities, such as downloading or exporting a report, filtered by the sensitivity label 'Highly Confidential'. Option A is wrong because Microsoft 365 compliance alerts do not natively target Power BI report export events with sensitivity-label conditions. Option B is wrong because Power BI audit logging plus Microsoft Sentinel requires custom analytics rules and does not directly provide the built-in activity-policy alerting for this scenario. Option C is wrong because a Microsoft Purview protection policy blocks export rather than generating the requested alert.

Answer

Set up a Microsoft 365 compliance alert for data export events.

Answer

Enable audit logging in Power BI and configure alerts in Microsoft Sentinel.

Answer

Apply a protection policy in Microsoft Purview that blocks export for 'Highly Confidential' labels.

Question 12

Your organization uses Power BI Premium capacity. You notice that reports are slow during peak hours. You need to identify which workspaces are consuming the most CPU resources on the capacity. What should you use?

Accepted Answer

Install and review the Power BI Premium Capacity Metrics app.. The Power BI Premium Capacity Metrics app is the correct tool because it is purpose-built to monitor Premium capacity health and provides per-workspace breakdowns of resource consumption, including CPU usage over time, so you can pinpoint which workspaces are driving load during peak hours. It surfaces metrics like CPU utilization, memory usage, query durations, and dataset refreshes at both the capacity and workspace level. In contrast, Power BI Desktop's Performance Analyzer (option A) only profiles a single report's visuals and queries on your local machine, not capacity-wide CPU consumption. Azure Monitor diagnostic logging (option C) can capture activity logs and metrics, but it requires manual setup and analysis and does not directly present workspace-level CPU rankings. The Capacity settings page in the admin portal (option D) only lets you configure capacity size, admins, and workload settings; it does not report which workspaces consume the most CPU.

Answer

Open the dataset in Power BI Desktop and view the performance analyzer.

Answer

Enable diagnostic logging in Azure Monitor for the capacity.

Answer

Check the 'Capacity settings' in the Power BI admin portal.

Question 13

You have a Power BI dataset that uses DirectQuery to a SQL Server data warehouse. You need to ensure that when users view reports, they see only data relevant to their department. The data warehouse contains a 'Department' column. What should you implement?

Accepted Answer

Define row-level security (RLS) roles in Power BI Desktop and assign users.. The correct option is D: defining row-level security (RLS) roles in Power BI Desktop and assigning users, because RLS filters rows at query time based on the user's identity, so each user sees only the rows matching their department in the 'Department' column, and it works with DirectQuery by translating the filter into the source query. This is the standard, scalable way to enforce per-user data visibility in a single dataset. Option A only controls how credentials are passed to the source and does not by itself filter rows by department. Option B is inefficient and does not use a single governed dataset, and Option C, object-level security, restricts access to tables or columns rather than filtering rows by department value.

Answer

Configure the data source credentials to pass the user's identity.

Answer

Create separate datasets for each department and grant access accordingly.

Answer

Implement object-level security (OLS) on the 'Department' column.

Question 14

You need to audit Power BI activities such as viewing reports, sharing dashboards, and exporting data. Which TWO actions should you take to enable and access audit logs? (Choose two.)

Accepted Answer

Access the audit log from the Microsoft 365 compliance portal.. To audit Power BI activities, you must first enable audit logging by turning on the 'Create audit logs for Power BI activities' tenant setting in the Power BI admin portal (option C). Once enabled, you can access the audit logs from the Microsoft 365 compliance portal (option B). Option A is incorrect because Microsoft Defender for Cloud Apps is not the primary location for audit logs; it can integrate but is not required. Option D is incorrect because Power BI does not have an export feature for audit logs to CSV; you can export from the compliance portal. Option E is incorrect because Azure Monitor diagnostic settings are for Azure resources, not for Power BI audit logs.

Answer

Configure Microsoft Defender for Cloud Apps to forward logs to Microsoft Sentinel.

Answer

Use the 'Export' feature in Power BI to export audit logs to a CSV file.

Answer

Set up a diagnostic setting in Azure Monitor to collect Power BI logs.

Question 15

Refer to the exhibit. The Power BI admin settings are shown. A user reports that they cannot share a dashboard with an external partner. What is the most likely reason?

Accepted Answer

The 'externalSharingEnabled' setting is disabled.. The correct option is D, the 'externalSharingEnabled' setting is disabled. Sharing a dashboard with an external partner requires the tenant-level external sharing setting to be enabled, so if it is disabled, the user cannot share with recipients outside the organization. The other options do not fit: exportDataEnabled controls exporting data, publishToWebEnabled controls public web publishing, and workspaceCreationEnabled controls creating workspaces, none of which directly govern sharing a dashboard with an external partner.

Answer

The 'exportDataEnabled' setting is disabled.

Answer

The 'publishToWebEnabled' setting is disabled.

Answer

The 'workspaceCreationEnabled' setting is disabled.