CCNA Manage and secure Power BI Questions

Option A (control 'Share content with external users') and Option D (disable 'Publish to web') are correct. Option A directly blocks sharing with external users. Option D prevents public sharing via embed codes.

Option B (create workspaces) is irrelevant to sharing. Option C (export data) is about exporting, not sharing. Option E (featured tables) is unrelated.

Option D is correct because Defender for Cloud Apps can create session policies that block downloads based on risk or sensitivity. Option A is wrong because the tenant setting allows export. Option B is wrong because the user is not a guest.

Option C is wrong because sensitivity labels alone do not block export; they need DLP policies.

Option B is correct because Conditional Access policies in Microsoft Entra ID can enforce access controls based on device compliance (Intune) and training completion (custom attribute or group membership). Option A is wrong because sensitivity labels classify and protect data, but do not enforce device compliance or training. Option C is wrong because RLS restricts data within a report, not access to the report itself.

Option D is wrong because Microsoft Purview is for data governance, not access policies.

Option C is correct because the filter expression uses the column name 'SalesAmount' but the actual column may be named differently (e.g., 'Amount'). RLS filters must match the exact column name in the dataset. Option A is wrong because RLS can filter on any numeric column.

Option B is wrong because if the role is assigned, users would see data based on the filter. Option D is wrong because the '>' operator is valid.

Option C is correct. Row-level security (RLS) filters the data a user can see, but it does not hide tables from the data model view. Option A is wrong because 'Build' permission allows users to build reports from the dataset.

Option B is wrong because data source credentials are managed at the dataset level, not per user. Option D is wrong because the dataset is in a Premium workspace; service principal access is not required for report creation.

The connection string uses 'ActiveDirectoryServicePrincipal' which requires a service principal to be registered in Microsoft Entra ID. If the service principal does not have the correct permissions or the secret expired, the refresh will fail. Option B is correct.

Option A is wrong because the gateway is not needed for Azure SQL. Option C is wrong because the refresh time is on the hour. Option D is wrong because the refresh schedule is set only on weekdays, but Monday is a weekday, so that's fine.

Option C is correct because the most common cause for Windows authentication failures is a password change; the user can update credentials in the dataset settings. Option A is wrong because the on-premises gateway is not necessarily the issue. Option B is wrong because impersonation does not apply to Windows credentials.

Option D is wrong because capacity reassignment does not fix credential issues.

Option A is correct because sharing the dashboard directly with the Finance team security group is the simplest and most efficient method. Option B is wrong because it would require moving the dashboard. Option C is wrong because apps are for distributing multiple items.

Option D is wrong because it would affect all content in the workspace.

Option C is correct because sharing with an external user as a guest restricts them based on their guest permissions; you can disable export and resharing in the sharing dialog. Option A is wrong because Publish to web makes it public. Option B is wrong because building a composite model is not a sharing method.

Option D is wrong because the partner would need to be a guest anyway.

Options A and D are correct because data residency can be controlled by choosing the region where the tenant is created and by using Multi-Geo capabilities for Premium capacities. Option B is wrong because data is stored in the region of the capacity. Option C is wrong because the admin portal does not allow users to choose residency.

Option E is wrong because Azure Data Lake is not a storage for Power BI data.

Option B is correct because a scheduled refresh in the dataset settings allows configuring refresh frequency and time. Option A is wrong because Gateway is needed only for on-premises sources. Option C is wrong because XMLA endpoints are for advanced management, not scheduling refresh.

Option D is wrong because the refresh is scheduled on the dataset, not the report.

Option B is correct because the 'amr' claim contains 'pwd', which indicates password-based authentication. Option A is wrong because MFA would show 'mfa' in amr. Option C is wrong because certificate-based authentication would show 'cert'.

Option D is wrong because device code flow would show 'device_authentication'.

Option D is correct because hiding the report from users in the workspace forces access via the app only. Option A is wrong because sharing still gives direct access. Option B is wrong because removing access entirely prevents app access too.

Option C is wrong because it doesn't restrict.

Row-level security (RLS) and object-level security (OLS) are the two primary methods. Option A is correct, Option B is correct. Option C is wrong because column-level security is not a separate feature; it's OLS.

Option D is wrong because app permissions control access to the app, not the dataset directly. Option E is wrong because data encryption is not a dataset-level access control.

Option C is correct because service principals need to be enabled in the capacity settings and assigned to the workspace. Option A is wrong because service principals need specific permissions, not just reader. Option B is wrong because the gateway is not required for cloud sources.

Option D is wrong because app registration is needed but enabling in capacity is the key step.

Option C is correct because the Power BI admin portal allows you to block the creation of personal workspaces, forcing users to use managed workspaces. Option A is wrong because sensitivity labels are applied to content but do not prevent saving to personal workspaces. Option B is wrong because tenant settings for sharing do not restrict workspace creation.

Option D is wrong because the external data sharing setting is unrelated.

Option C is correct because to apply sensitivity labels in Power BI, the user must have the 'Azure Information Protection' (AIP) rights (e.g., 'Rights Management' or 'Protection') enabled. Even with a Pro license, if the user does not have the AIP add-on or the rights assigned, they cannot apply labels. Option A is wrong because the workspace is backed by Premium, but labels work in shared capacity too.

Option B is wrong because the user is a Member, which allows editing. Option D is wrong because the labels are published.

Option B is correct because the user may be accessing the wrong workspace or the dashboard may be shared in a different workspace context. Option A is wrong because if the user is signed in with the wrong account, they would see a different set of items. Option C is wrong because the dashboard was shared, so sharing is not the issue.

Option D is wrong because the dashboard owner's license does not affect visibility for the user.

Option A is correct because accessibility settings in Power BI service can enforce requirements like alt text and tab order. Option B is wrong because Microsoft Intune manages devices, not Power BI accessibility. Option C is wrong because Microsoft Entra ID does not have accessibility settings for Power BI.

Option D is wrong because report-level settings are manual, not enforced tenant-wide.

Option B is correct because row-level security (RLS) in Power BI allows you to filter data based on the user's identity. By defining roles and using DAX filters like 'Department = USERPRINCIPALNAME()', you can restrict data. Option A is wrong because object-level security (OLS) controls access to tables/columns, not rows.

Option C is wrong because data source credentials are used for connection, not for filtering. Option D is wrong because Power BI does not support query passthrough for RLS; RLS is implemented in Power BI.

The gateway typically uses Windows authentication (Kerberos) for on-premises SQL Server to support single sign-on and pass-through. Option B is correct. Option A is wrong because OAuth is for cloud services.

Option C is wrong because Basic is less secure and not recommended. Option D is wrong because Service Principal is for Azure resources.

Option B is correct because SSO requires the dataset to use DirectQuery or Live Connection mode; Import mode does not support SSO. Option A is incorrect because the data source credentials are passed via SSO, not stored. Option C is incorrect because row-level security is applied at query time, not during connection.

Option D is incorrect because SSO uses the user's identity, not a service principal.

Option B is correct because only workspace Admins can add users. User2 is a Member, which does not include the permission to manage membership. Option A is wrong because Contributors cannot add users.

Option C is wrong because Member cannot add users. Option D is wrong because the capacity does not affect workspace membership permissions.

Option A is correct because conditional access policies in Microsoft Entra ID can require compliant devices. Option B is wrong because it doesn't enforce device compliance. Option C is wrong because it's for mobile app protection, not device compliance.

Option D is wrong because it's for capacity.

Option D is correct because the on-premises data gateway supports Windows authentication via Kerberos constrained delegation, allowing refresh without storing credentials. Option A is wrong because the personal gateway is only for a single user and requires credentials. Option B is wrong because the VNet gateway is for Azure VNets, not on-premises.

Option C is wrong because the on-premises data gateway does not need a connection string stored in the gateway; it uses the dataset's connection string.

Option A is correct because enabling tenant-level integration with Microsoft Entra ID allows restricting access to specific security groups. Option B is wrong because disabling public sharing doesn't restrict access. Option C is wrong because app security groups are for workspace access, not tenant access.

Option D is wrong because capacity settings control resources, not user access.

Option C is correct because the 'effectiveIdentity' property in the exhibit is set to 'user@contoso.com', which overrides RLS and allows that user to see all data. In Power BI, the effective identity is used for testing but in production, it should not be set for a specific user if RLS is intended. Option A is wrong because the roles include users, so RLS is configured.

Option B is wrong because the exhibit does not indicate a missing role mapping. Option D is wrong because the roles are defined; the issue is the effective identity.

Option C is correct because 'ABFSSmall' is a valid Premium capacity storage format (Azure Blob File System Small). Option A is wrong because encryption is 'ServiceManaged', not 'CustomerKey'. Option B is wrong because there is no 'SharePoint' in allowedDataSources.

Option D is wrong because the data classification is set to 'Confidential', not 'General'.

Option C is correct because the Viewer role does not allow publishing; the user needs at least a Contributor role. Adding them directly as a Contributor overrides the group assignment. Option A is wrong because Power BI does not allow granting permissions on individual reports in a workspace.

Option B is wrong because Viewer allows viewing only. Option D is wrong because the app workspace already exists.

Option C is correct because CPU over-utilization is a key indicator of capacity stress in Premium. The 'CPU high' metric directly reflects processing load. Option A is wrong because query execution time is a result, not a direct capacity metric.

Option B is wrong because memory usage is important but CPU is more directly tied to responsiveness. Option D is wrong because dataset size is a design factor, not a real-time capacity metric.

Object-level security (OLS) can hide entire columns from roles. Row-level security (RLS) filters rows but cannot hide columns. Building separate datasets is one way but not efficient.

Option A and B are correct. Option C is wrong because RLS does not hide columns. Option D is wrong because that controls access to the report, not column visibility.

Option E is wrong because masking is not available in Power BI.

Option C is correct because Performance Analyzer shows query durations for each visual, helping identify slow queries. Option A is wrong because DAX Studio analyzes DAX queries but not the full report performance. Option B is wrong because the activity log shows events but not query-level details.

Option D is wrong because the gateway log is for gateway activities.

Options A and C are correct. Sensitivity labels must be enabled for Power BI via Microsoft Purview, and then you can restrict access using label-based policies. Option B is wrong because row-level security controls data, not access to the report.

Option D is wrong because workspace roles do not consider sensitivity labels. Option E is wrong because that setting controls default label, not access restriction.

Option C is correct because LOOKUPVALUE returns an error if multiple values are found (e.g., duplicate user entries in the mapping table), causing the filter to fail and return no data. Option A is wrong because RLS does not require Premium. Option B is wrong because the USERPRINCIPALNAME function is correct for Power BI Service.

Option D is wrong because the DAX itself is syntactically correct; the issue is with data.

Option D is correct because if the 'North America' region name in the data does not exactly match the filter (e.g., 'North America' vs 'NA'), the filter will not match any rows. Option A is wrong because the user can see the report, just no data. Option B is wrong because RLS roles are usually defined in Desktop.

Option C is wrong because the user is in the Sales role, so they should see data.

Option A is correct because auto-labeling policies in Microsoft Purview can scan and label Power BI datasets. Option B is wrong because Microsoft Defender for Cloud Apps applies labels based on app-level behavior, not column data. Option C is wrong because sensitivity labels in Power BI are manual or inherited from data sources.

Option D is wrong because Microsoft Sentinel is for security information and event management.

Option B is correct because in Power BI, when a user belongs to multiple RLS roles, the filters are combined using OR logic, so the user sees rows satisfying either role. Option A is wrong because it would require intersection (AND). Option C is wrong because all rows are not returned.

Option D is wrong because both roles are applied.

Option B is correct. Registering a Power BI tenant as a data source in Purview enables automatic scanning of all Power BI assets. Option A is wrong because sensitivity labels help with classification but do not automatically add assets to the catalog.

Option C is wrong because enabling 'Allow Azure Active Directory (now Microsoft Entra ID) authentication' is not required for scanning. Option D is wrong because creating a new workspace does not trigger scanning.

Option C is correct because 'Build' permission allows a user to create reports based on a dataset without being able to modify or share the dataset. Option A is wrong because 'Read' permission only allows viewing reports, not building new ones. Option B is wrong because 'Reshare' is not a standalone permission; sharing is part of the 'Share' permission.

Option D is wrong because 'Write' would allow modifications.

Option A is correct because the Power BI activity log captures user activities such as viewing, exporting, and sharing. Option B is wrong because the usage metrics report shows aggregate usage, not detailed activities. Option C is wrong because Microsoft 365 audit log is broader but less specific to Power BI; the activity log is the dedicated tool.

Option D is wrong because the admin portal's capacity metrics focus on performance.

Option A is correct because 'Export data' controls the ability to export underlying data. Option B is wrong because 'Export reports as PowerPoint' is for exporting the report itself. Option C is wrong because 'Export reports as PDF' is for static exports.

Option D is wrong because 'Export reports as MHTML' is also for report export.

The Contributor role does not include the ability to view datasets created by others unless those datasets are shared or the user has Build permission. Option B is correct because Build permission is required to view datasets that are not owned by the user. Option A is wrong because Viewer role is not needed for viewing datasets; Contributor already has higher access.

Option C is wrong because the dataset was created in the same workspace, not in a separate app. Option D is wrong because the user is already a workspace member; no additional licensing is needed for viewing.

Option C is correct because the policy denies creation or update of workspaces with SKU 'Premium'. Option A is wrong because it denies Premium, not non-Premium. Option B is wrong because it denies creation of Premium workspaces, not all.

Option D is wrong because it applies to Premium, not premium per user.

Option C is correct because the DAX expression is a measure that calculates the sum for the 'West' region, but it does not restrict data for other users. To enforce security, you need to implement row-level security (RLS) by adding a filter in the dataset roles. Option A is wrong because you cannot restrict the measure to specific users directly.

Option B is wrong because the measure itself calculates for West only, but RLS is needed for security. Option D is wrong because the measure is already specific to West.

Option D is correct because RLS in Import mode filters at the dataset level; if the user's role filters out all data (e.g., no rows match 'West'), visuals will appear blank. Option A is wrong because RLS does not affect the report page layout. Option B is wrong because RLS is applied regardless of dashboard tiles.

Option C is wrong because RLS is applied after data refresh, so the data load includes all rows but RLS filters query results.

Option A (disable 'Create workspaces' for all users) and Option D (enable 'Block users from creating workspaces' in the admin portal) are correct. Option A is a tenant setting to disable workspace creation. Option D is the actual admin portal setting.

Option B is wrong because disabling 'Use workspaces' would break existing workspaces. Option C is wrong because setting a group policy is not the correct approach. Option E is wrong because removing workspace creation from the admin portal is not a granular setting.

Option B is correct because Bring Your Own Tenant (BYOT) with Azure B2B allows external users to access content via their own organization's tenant. Option A is wrong because guest users in the same tenant require licenses. Option C is wrong because Publish to web makes data public.

Option D is wrong because sharing requires internal licenses.

Options A and C are correct. RLS can be defined in Power BI Desktop using static roles, and in DirectQuery with SSO, RLS can be enforced in the source database. Option B is wrong because RLS is not applied via the Power BI service interface for datasets; it's defined in Desktop.

Option D is wrong because RLS in Power BI is not based on Microsoft Entra ID groups; it's based on roles defined in the model. Option E is wrong because RLS is not configured in Excel.

Option B is correct because the Power BI REST API (via PowerShell) can retrieve shareable links and filter by creation date. Option A is wrong because the admin portal lacks automation. Option C is wrong because Microsoft Graph API does not directly manage Power BI shareable links.

Option D is wrong because Log Analytics does not provide shareable link metadata.

Option A is correct because reports published to a workspace are stored in that workspace, not in 'My workspace'. The Contributor role allows publishing to the workspace, but the report will appear in the workspace, not the user's personal workspace. Option B is wrong because the Contributor role can publish content.

Option C is wrong because there is no license issue. Option D is wrong because the report is not automatically added to 'My workspace'.

Options A and C are correct. Enabling the audit log in the Power BI admin portal is the first step. Option C is correct because audit logs are stored in the Microsoft 365 compliance portal.

Option B is wrong because Microsoft Defender for Cloud Apps is not the primary storage for audit logs. Option D is wrong because Azure Monitor is not used for Power BI audit logs. Option E is wrong because Power BI itself does not store audit logs; it sends them to the Microsoft 365 audit log.

Options A and C are correct. Creating a Premium capacity assigned to a European region ensures data residency. Moving the workspace to that capacity ensures the data is stored in Europe.

Option B is wrong because sensitivity labels do not control data residency. Option D is wrong because the default region is set at the tenant level, not per workspace. Option E is wrong because Power BI does not allow per-dataset regional settings.

Option C is correct because conditional access policies in Microsoft Entra ID can restrict access to the Power BI service based on security group membership. Option A is wrong because the Power BI admin portal does not have a setting to restrict access to specific security groups. Option B is wrong because guest user settings control external access, not internal group restrictions.

Option D is wrong because workspace access settings control access to workspaces, not the service itself.

Options A and D are correct because the admin can enable mandatory labeling in the admin portal and use Microsoft Purview Information Protection to apply labels. Option B is wrong because labels are not applied in Power BI Desktop. Option C is wrong because RLS does not enforce labels.

Option E is wrong because there is no such policy in Microsoft Intune.

Option D is correct because you need to set Purview to automatically apply labels based on source data labels. Option A is wrong because it only applies manual labels. Option B is wrong because it doesn't automatically inherit.

Option C is wrong because it's for classification, not automatic inheritance.

Scheduled refresh times are limited by the number of daily refreshes and the capacity's concurrency limits. Option D is correct because the refresh time must be within the available window and not conflict with other refreshes. Option A is wrong because Premium allows up to 48 refreshes per day.

Option B is wrong because incremental refresh is optional, not required. Option C is wrong because gateway is not needed for Azure SQL.

Option D is correct because the 'Share content with external users' tenant setting controls whether users can share reports and dashboards with external users. Disabling this setting prevents external sharing. Option A is wrong because 'Export to Excel' is a separate setting.

Option B is wrong because 'Publish to web' is for public embedding. Option C is wrong because 'Create email subscriptions' does not control external sharing.

Option A is correct because the Power BI activity log captures user access events. Option B is wrong because the audit log in Microsoft 365 Defender may not have detailed Power BI access events. Option C is wrong because usage metrics reports show view counts but not per-user details.

Option D is wrong because the Microsoft Purview audit log is for compliance, not detailed access logs.

Option B is correct because if the users have workspace-level permissions that allow them to see all data (e.g., Admin, Member, Contributor), RLS is bypassed. Option A is wrong because the filter syntax is correct. Option C is wrong because RLS works in Power BI Desktop preview.

Option D is wrong because multiple roles don't cause this issue; they are additive.

Options A, C, and E are correct. Static RLS uses roles defined in Power BI Desktop. Dynamic RLS uses USERNAME() or USERPRINCIPALNAME() to filter data based on the logged-in user.

Object-level security (OLS) is for table/column security, not row-level. Option D is wrong because Azure RBAC is for managing access to Azure resources, not for Power BI row-level security.

Option D is correct because the LOOKUPVALUE function is used without a relationship between the Sales and EmployeeRegion tables. LOOKUPVALUE does not create a relationship; it performs a lookup based on the current row context, which may not work correctly. In RLS, you typically use a filter that references a related table via a relationship.

Option A is wrong because the role name can be any string. Option B is wrong because the syntax is valid. Option C is wrong because the column definitions are fine.

The Power BI activity log provides auditing of all user activities, including sharing. Option A is correct. Option B is wrong because Microsoft Purview compliance portal has audit log but Power BI activity log is more specific and detailed.

Option C is wrong because diagnostic settings export logs to other destinations, not for direct querying. Option D is wrong because Microsoft Sentinel collects logs but is not the primary auditing tool.

Option B is correct because enabling Power BI activity logging and streaming to Azure Log Analytics allows querying and alerting on access events. Option A is wrong because the data gateway logs do not include access events. Option C is wrong because Microsoft Defender for Cloud Apps can provide conditional access but not logging of all access.

Option D is wrong because Azure SQL Auditing is for database-level, not Power BI.

Options A and D are correct. Option A: Using Azure AD B2B, you can invite external users as guest users and share reports directly. Option D: Publish to web (public) makes the report available to anyone.

Option B is wrong because sharing a link via email requires the recipient to have a Power BI license; if they are external, they need to be guest users. Option C is wrong because exporting to PDF is a manual process, not a sharing method. Option E is wrong because embedding in a public website is essentially Publish to web, but requires enabling the feature.

Option B is correct because row-level security (RLS) restricts data: only rows where Region is 'US' are visible. Option A is wrong because RLS does not hide the entire table. Option C is wrong because RLS does not affect columns.

Option D is wrong because RLS does not affect other tables unless defined.

Option C is correct because USERPRINCIPALNAME() returns the user's UPN, but the filter expression compares it to a specific email address. For RLS to work, the filter should use a column that contains the user's UPN, or use a different function. Option A is wrong because the permission is correct.

Option B is wrong because the filter expression should evaluate to a Boolean. Option D is wrong because RLS works with imported data.

Option B is correct because reducing the number of visuals and simplifying measures can significantly reduce query time. Option A is wrong because Import mode would change the source architecture. Option C is wrong because aggregations help but building them requires changes.

Option D is wrong because increasing capacity does not optimize query performance.

Option D is correct because DLP policies in Power BI can be applied to datasets and reports, and they can block export of data that matches sensitive info types like credit card numbers. Option A is wrong because sensitivity labels alone do not block export. Option B is wrong because RLS restricts data visibility, not export.

Option C is wrong because tenant settings control general export capabilities but not based on content.

Option B is correct. The 'notifyOption' is set to 'MailOnFailure', which sends a notification to the dataset owner when a refresh fails. Option A is wrong because the failure is on a scheduled day, but the notification is not sent to workspace admins.

Option C is wrong because the tenant admin is not automatically notified. Option D is wrong because the notification is sent to the owner, not to all users.

Option C is correct because 'Publish to web' creates a public embed code that anyone can view without authentication. Option A is wrong because sharing directly requires the external user to have a Power BI license or be a guest. Option B is wrong because the external user must authenticate as a guest.

Option D is wrong because the external user would need a license to access the Power BI service.

Option B is correct because OAuth2 tokens can expire, causing automatic refresh failures while manual refreshes work (since the user reauthenticates). Option A is wrong because gateway issues typically affect both manual and automatic refreshes. Option C is wrong because capacity restrictions would also affect manual refreshes.

Option D is wrong because RLS does not affect refresh functionality.

Option B is correct because the DAX filter expression must reference a column in the correct format; '[Region] = "North"' is incorrect DAX syntax. The correct DAX should be 'Sales[Region] = "North"'. Option A is wrong because the role name is not case-sensitive.

Option C is wrong because the filter expression is a DAX expression, not M. Option D is wrong because the 'Read' permission is correct for viewing data.

Option A is correct because Power BI has a default dashboard tile cache of 30 minutes for streaming datasets; reducing the cache duration solves the issue. Option B is wrong because the data source is streaming, not push. Option C is wrong because automatic page refresh is for report pages, not dashboard tiles.

Option D is wrong because the issue is cache, not the refresh interval.