DP-700 Monitor and Optimize an Analytics Solution Practice Question
You are auditing data access in a Microsoft Fabric workspace and notice unexpected 'Access Denied' errors in the OneLake logs for a service principal that should have read-only access. The service principal has the 'Viewer' role in the workspace. What is the most likely cause?
⚠ Common exam trap
Candidates assume that a 'Viewer' role grants implicit access to all data within the Lakehouse. They forget that OneLake data access control acts as a separate, more granular security layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OneLake data access control (preview) is restricting specific folders.
OneLake security is governed by both workspace roles and item-level permissions. If 'OneLake data access control' is enabled for a Lakehouse, the 'Viewer' role alone may not be sufficient if specific folder-level permissions have not been granted. Understanding the intersection of these security layers is critical for troubleshooting access issues in complex environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The service principal needs the 'Contributor' role to read data.
Why it's wrong here
The 'Viewer' role is specifically designed for read-only access and should be sufficient for reading data from OneLake. Moving to 'Contributor' provides write permissions, which are unnecessary for simple data reading and would violate the principle of least privilege in a production analytics environment.
- ✓
OneLake data access control (preview) is restricting specific folders.
Why this is correct
When OneLake data access control is enabled, it allows for more granular security than workspace roles. Even with a 'Viewer' role, if the specific path or folder in the Lakehouse has been restricted via these granular permissions, the service principal will receive an 'Access Denied' error when attempting to read.
- ✗
The service principal has exceeded its OneLake throughput quota.
Why it's wrong here
Exceeding a throughput quota would typically result in a 'Throttling' or 'Too Many Requests' error (HTTP 429), not an 'Access Denied' error (HTTP 403). Access Denied is strictly related to authentication and authorization settings rather than the volume of data being read or the rate of requests.
- ✗
OneLake does not support service principal authentication.
Why it's wrong here
OneLake fully supports service principal authentication through standard Azure Active Directory (now Microsoft Entra ID) mechanisms. This is a common practice for automated pipelines and service-to-service communication within Fabric, making this explanation technically incorrect regarding the platform's capabilities and security architecture.
About these practice questions
Courseiva writes every DP-700 question from scratch — 152 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This DP-700 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-700 exam.