Courseiva

CCNA Manage and secure Power BI Questions

22 questions · Manage and secure Power BI · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

You are a Power BI administrator. A user reports that their scheduled data refresh fails with error 'The data source credentials are no longer valid.' The dataset uses a SQL Server database with Windows authentication. What should you do first to resolve the issue?

A.Reinstall the on-premises data gateway on the server.
B.Reassign the dataset to a different Premium capacity.
C.Modify the dataset to use 'Impersonate the authenticated user' for data sources.
D.Ask the user to update the data source credentials in the Power BI service dataset settings.
AnswerD

Windows credentials may expire; updating them in the service resolves the error.

Why this answer

The error 'The data source credentials are no longer valid' typically occurs when the password has changed or expired. The user can update the credentials in the dataset settings in the Power BI service. Option A is incorrect because the on-premises data gateway is not the issue; a reinstall is unnecessary.

Option B is incorrect because reassigning the dataset to a different Premium capacity does not address credential validity. Option C is incorrect because using 'Impersonate the authenticated user' still requires valid credentials and does not fix the problem.

Practice this question →
2
MCQeasy

You have a Power BI workspace that contains a report connected to an Azure Analysis Services (AAS) model. The data source uses Single Sign-On (SSO) with Microsoft Entra ID. When users access the report, they see an error that the data cannot be refreshed. What is the most likely cause?

A.Row-level security (RLS) is not configured on the AAS model.
B.The data source credentials are stored in the dataset.
C.The service principal used for authentication has expired.
D.The dataset is configured in Import mode.
AnswerD

SSO only works with DirectQuery or Live Connection.

Why this answer

The most likely cause is that the dataset is configured in Import mode. Single Sign-On (SSO) with Microsoft Entra ID is only supported when the dataset uses DirectQuery or Live Connection mode. Import mode requires stored credentials and does not pass the user's identity to the data source.

Option A is incorrect because RLS does not affect data refresh connectivity. Option B is incorrect because stored credentials are not used when SSO is enabled. Option C is incorrect because SSO uses the user's identity, not a service principal.

Exam trap

Candidates may confuse the requirement for SSO: it requires DirectQuery or Live Connection, not Import mode.

Practice this question →
3
MCQhard

Refer to the exhibit. You are reviewing the configuration of a Power BI dataset with row-level security (RLS). A user named 'user@contoso.com' reports that they can see all data when they should see only data for their region. What is the most likely cause?

A.The 'effectiveIdentity' is set to the user's email, bypassing RLS.
B.The RLS roles are missing the 'SalesRole' mapping to the dataset.
C.The dataset does not have any RLS roles defined.
D.The user is not assigned to any RLS role.
AnswerA

The effective identity setting forces the dataset to use that identity, ignoring RLS for that user.

Why this answer

The 'effectiveIdentity' property in the exhibit is set to 'user@contoso.com', which overrides RLS and allows that user to see all data. In Power BI, the effective identity is used for testing purposes; in production, it should not be set for a specific user if RLS is intended. Option B is incorrect because the exhibit shows RLS roles are defined, so missing mapping is not the issue.

Option C is incorrect because roles exist. Option D is incorrect because the user is likely assigned to a role, but the effective identity overrides it.

Practice this question →
4
MCQeasy

You need to ensure that only members of the 'Sales' security group can edit reports in the 'Sales Reports' workspace. The workspace currently has four members: three from Sales and one from Marketing. What should you do?

A.Add the Sales security group as a workspace Admin and remove the Marketing user.
B.Configure the workspace to allow only specific users to edit by using the 'Restrict editing' option.
C.Publish the reports to a Power BI app and grant the Sales group 'Build' permissions.
D.Assign the Sales security group the 'Contributor' role and keep the Marketing user as 'Member'.
AnswerA

Adding the Sales group with Admin role grants edit access, and removing the Marketing user prevents their access.

Why this answer

Adding the Sales security group as a workspace Admin grants full editing capabilities to all members of that group. Removing the Marketing user from the workspace ensures that only Sales members have edit access. Workspace roles like Admin allow editing of reports and other content.

Option B is incorrect because Power BI does not have a 'Restrict editing' option at the workspace level; access is controlled through roles. Option C is incorrect because publishing reports as a Power BI app with 'Build' permissions does not control editing within the workspace; it controls how consumers interact with the app content. Option D is incorrect because keeping the Marketing user as a 'Member' still allows them to edit content in the workspace, which contradicts the requirement that only Sales members can edit.

Practice this question →
5
Multi-Selectmedium

You need to audit Power BI activities such as viewing reports, sharing dashboards, and exporting data. Which TWO actions should you take to enable and access audit logs? (Choose two.)

Select 2 answers
A.Configure Microsoft Defender for Cloud Apps to forward logs to Microsoft Sentinel.
B.Access the audit log from the Microsoft 365 compliance portal.
C.Enable the 'Create audit logs for Power BI activities' tenant setting in the admin portal.
D.Use the 'Export' feature in Power BI to export audit logs to a CSV file.
E.Set up a diagnostic setting in Azure Monitor to collect Power BI logs.
AnswersB, C

Audit logs are stored and accessible in the Microsoft 365 compliance portal.

Why this answer

To audit Power BI activities, you must first enable audit logging by turning on the 'Create audit logs for Power BI activities' tenant setting in the Power BI admin portal (option C). Once enabled, you can access the audit logs from the Microsoft 365 compliance portal (option B). Option A is incorrect because Microsoft Defender for Cloud Apps is not the primary location for audit logs; it can integrate but is not required.

Option D is incorrect because Power BI does not have an export feature for audit logs to CSV; you can export from the compliance portal. Option E is incorrect because Azure Monitor diagnostic settings are for Azure resources, not for Power BI audit logs.

Practice this question →
6
MCQhard

You are managing a Power BI environment that uses Microsoft Purview for data governance. You need to ensure that all new datasets automatically inherit sensitivity labels from their source data. What should you configure?

A.Enable 'Sensitivity labels' in Power BI tenant settings and require labels on datasets.
B.In Microsoft Purview, set up 'Automatic labeling' policies that propagate labels from source to Power BI datasets.
C.Use Microsoft Purview Data Map to scan source data and manually apply labels.
D.Configure a Power Automate flow to apply labels based on dataset metadata.
AnswerB

Automatic labeling policies can propagate labels.

Why this answer

Microsoft Purview's automatic labeling policies can propagate sensitivity labels from source data to Power BI datasets automatically, ensuring new datasets inherit labels. Option A is incorrect because enabling sensitivity labels in Power BI tenant settings only allows manual labeling and does not enforce automatic inheritance from source data. Option C is incorrect because using Purview Data Map to scan and manually apply labels does not provide automatic propagation.

Option D is incorrect because a Power Automate flow would require custom setup and is not the native mechanism for automatic label inheritance from source to Power BI.

Practice this question →
7
MCQhard

Your organization uses Power BI Premium and wants to enforce that users can only see data relevant to their department (Sales, Marketing, Finance) using row-level security (RLS). The dataset contains a 'Department' column. You have created three RLS roles, each with a filter like [Department] = "Sales". You publish the dataset and add users to the roles. However, users in the Sales role can see all data. What is the most likely cause?

A.The RLS roles were created in the Power BI service, not in Power BI Desktop.
B.The users are members of multiple RLS roles, so they see all data.
C.The RLS filter uses a string comparison that is case-sensitive and the data contains mixed case.
D.The users are also assigned to workspace roles (e.g., Member) that grant them access to the dataset without RLS restrictions.
AnswerD

Users with edit permissions on the dataset bypass RLS.

Why this answer

In Power BI, users assigned to workspace roles (Admin, Member, Contributor) have dataset-level permissions that bypass Row-Level Security (RLS). Since these users can access the dataset directly, RLS filters are not applied. Option A is incorrect because RLS roles are typically created in Power BI Desktop before publishing.

Option B is incorrect; multiple roles combine filters using OR logic, so users in multiple roles see union of all allowed data, not all data. Option C is incorrect because RLS filters are case-insensitive by default. Option D correctly identifies that workspace roles override RLS.

Exam trap

A common trap is assuming that RLS always applies to all users, but workspace-level permissions (Admin, Member, Contributor) supersede RLS. Only users with no workspace role or the 'Viewer' role are subject to RLS.

Practice this question →
8
MCQhard

You are a Power BI administrator. You need to audit all activities related to sharing reports and dashboards in the Power BI service. Which tool should you use?

A.Microsoft Purview compliance portal audit log
B.Azure diagnostic settings for Power BI
C.Power BI activity log (via admin API or portal)
D.Microsoft Sentinel
AnswerC

Directly logs all user actions.

Why this answer

The Power BI activity log provides a comprehensive record of all user activities within the Power BI service, including sharing reports and dashboards. Option A (Microsoft Purview compliance portal audit log) can capture some Power BI activities but is less specific and may not include all sharing events. Option B (Azure diagnostic settings) exports telemetry data to other destinations and is not designed for direct auditing of user actions.

Option D (Microsoft Sentinel) is a SIEM tool that can ingest logs but is not the primary tool for auditing Power BI activities. The Power BI activity log is the correct choice as it is purpose-built for auditing Power BI user activities.

Practice this question →
9
Multi-Selectmedium

Which TWO of the following are valid methods to share a Power BI report with external users (outside your organization)? (Choose two.)

Select 2 answers
A.Export the report to PDF and email it to the external user.
B.Send the external user a direct link to the report via email; they can view it without any additional setup.
C.Invite the external user as a guest in your Microsoft Entra ID (Azure AD) and share the report directly with them.
D.Embed the report in a SharePoint Online page using the Power BI web part.
E.Use the 'Publish to web' option to create an embed code that can be placed on a public website.
AnswersC, E

Azure AD B2B collaboration allows sharing with external guests.

Why this answer

The correct answers are C and E. Option C: By inviting external users as guests in your Microsoft Entra ID (Azure AD) using Azure AD B2B, you can share Power BI reports directly with them without requiring them to have a Power BI license. Option E: 'Publish to web' creates a public embed code that anyone on the internet can view, making it suitable for sharing with external users.

Option A is incorrect because exporting to PDF creates a static file, not an interactive report, and is not a sharing method. Option B is incorrect because external users need to be set up as guests or use publish to web; a direct link alone will not work without proper authentication. Option D is incorrect because embedding in SharePoint Online requires the external user to have access to the SharePoint site, which typically involves additional setup such as guest access.

Practice this question →
10
Multi-Selecthard

Which THREE settings should you verify in the Power BI tenant admin portal to ensure that external users (guests) can access a published app?

Select 3 answers
A.Invite external users to your organization via Microsoft Entra ID.
B.Allow sharing with external users.
C.Allow Azure Active Directory (Microsoft Entra ID) external identities to access the Power BI service.
D.Show external users in lists of suggested people.
E.Allow external users to edit and manage content in the organization.
AnswersA, B, C

'Invite external users' allows inviting guest users via Microsoft Entra ID, a prerequisite for external access.

Why this answer

To allow external users (guests) to access a published app in Power BI, three tenant settings must be enabled: 'Invite external users' (A) allows inviting guest users, 'Allow Azure AD external identities to access the Power BI service' (C) enables guest sign-in, and 'Allow sharing with external users' (B) permits sharing content with guests. Option E ('Allow external users to edit and manage content') is not required for viewing an app; it grants additional editing permissions. Option D controls whether guests appear in people pickers, which is unrelated.

Exam trap

Candidates often forget that 'Allow sharing with external users' (B) is required even for app access, not just sharing dashboards.

Practice this question →
11
MCQmedium

You have a Power BI workspace named Sales. You need to ensure that only users in the Finance security group can view reports in this workspace, while members of the Sales team can edit and share content. What should you do?

A.Add Finance as Viewer, Sales as Member.
B.Add Finance as Contributor, Sales as Member.
C.Add Finance as Viewer, Sales as Admin.
D.Use row-level security to restrict Finance data, add both as Member.
AnswerA

Correct. Viewer provides read-only access for Finance, Member allows Sales to edit and share.

Why this answer

Workspace roles in Power BI are designed to grant specific permissions: Viewer allows read-only access, ideal for Finance who only need to view reports; Member allows editing and sharing, which matches the Sales team's requirements. Option B is wrong because Contributor role cannot share content, which Sales needs. Option C is wrong because Admin grants full control, including managing permissions, which is unnecessary and excessive.

Option D is wrong because row-level security (RLS) controls data access within reports, not workspace-level permissions.

Exam trap

A common trap is confusing Contributor with Member. Contributor can edit but not share, while Member can both edit and share. Also, a candidate might think Viewer is insufficient for Finance, but it correctly restricts access.

Practice this question →
12
MCQhard

Your organization uses Microsoft Purview Information Protection to label sensitive data in Power BI datasets. You need to ensure that when a report is exported to Excel, the sensitivity label is automatically applied. What should you configure?

A.Ensure the dataset has a sensitivity label and that the export inherits the label.
B.Use data loss prevention (DLP) policies in Microsoft Purview.
C.Set a default sensitivity label on the report.
D.Enable 'Apply sensitivity labels to exported data' in the Power BI admin portal.
AnswerA

Correct. When a dataset has a sensitivity label, exports inherit it automatically, ensuring consistent protection without manual intervention.

Why this answer

When a Power BI dataset has a sensitivity label applied via Microsoft Purview Information Protection, any downstream exports (such as reports exported to Excel) automatically inherit that label. This inheritance ensures consistent protection across all outputs. Option D is incorrect because the Power BI admin portal setting 'Apply sensitivity labels to exported data' is used to apply labels when the data source does not have a label, but it does not override automatic inheritance from a labeled dataset.

Option B is incorrect because DLP policies in Microsoft Purview monitor and protect data, but they do not automatically apply sensitivity labels to exports. Option C is incorrect because setting a default sensitivity label on a report is not a feature; sensitivity labels are inherited from the dataset, not configured per report.

Practice this question →
13
MCQhard

You have a Power BI dataset that uses a DirectQuery connection to Azure Synapse Analytics. Users report that the report is slow. You need to improve query performance without changing the data source. What should you do?

A.Reduce the cardinality of calculated measures.
B.Disable row-level security (RLS) on the dataset.
C.Increase the scheduled refresh frequency.
D.Reduce the number of visuals on each report page.
AnswerD

Fewer visuals mean fewer queries to the source.

Why this answer

Reducing the number of visuals on each report page reduces the number of queries sent to the data source, improving performance for DirectQuery datasets. Option A is incorrect because reducing cardinality of measures may reduce data size but does not directly reduce the number of queries. Option B is incorrect because disabling RLS could change data access but does not significantly improve query performance.

Option C is incorrect because increasing scheduled refresh frequency applies to import mode, not DirectQuery.

Practice this question →
14
MCQhard

A Power BI report uses a DirectQuery dataset connected to an Azure SQL Database. Users report that the report takes over 30 seconds to load. You need to improve performance without changing the data model. What should you recommend?

A.Increase the 'Maximum connections per user' setting in the Premium capacity.
B.Enable 'Reduce cardinality by using aggregation' in the dataset settings.
C.Convert the dataset to Import mode.
D.Disable 'Cross-report data binding' in the report settings.
AnswerB

Enabling 'Reduce cardinality by using aggregation' pre-aggregates data at the source, reducing the amount of data transferred and improving DirectQuery performance.

Why this answer

Enabling 'Reduce cardinality by using aggregation' can improve DirectQuery performance by pre-aggregating data. Option A is wrong because increasing the maximum connections per user might help concurrency but not single query latency. Option C is wrong because converting to Import mode changes the data model approach and is not allowed if the requirement is to not change the data model.

Option D is wrong because disabling 'Cross-report data binding' affects report interactivity but not query performance.

Practice this question →
15
MCQmedium

You have a Power BI report that uses a DirectQuery dataset. You need to ensure that users see only the data relevant to their department. What should you implement?

A.Q&A features to restrict natural language queries.
B.Row-level security (RLS) with DAX filter expressions.
C.Object-level security (OLS) to hide tables.
D.Data lineage view to control access.
AnswerB

RLS filters rows based on user identity.

Why this answer

Row-level security (RLS) is the correct approach because it filters data at the query level based on the user's identity. In a DirectQuery model, RLS translates DAX filter expressions into source queries, ensuring that each user only sees rows relevant to their department without duplicating reports or datasets.

Exam trap

The trap here is that candidates confuse row-level security (RLS) with object-level security (OLS), thinking OLS can filter rows when it only hides entire objects like tables or columns.

How to eliminate wrong answers

Option A is wrong because Q&A features allow natural language queries but do not restrict data visibility; they only control how users can phrase questions. Option C is wrong because object-level security (OLS) hides entire tables or columns, not rows, so it cannot filter data by department. Option D is wrong because data lineage view is a metadata visualization tool for impact analysis, not a security mechanism to control user access to data.

Practice this question →
16
Multi-Selecthard

A Power BI administrator needs to enforce that all datasets published to the service use certified data sources only. Which two settings should be configured? (Choose two.)

Select 2 answers
A.Use Microsoft Sentinel to audit Power BI activity logs and flag non-certified data sources.
B.Enable 'Certification' for dataflows in the Power BI tenant settings.
C.Enable 'Certification' for data sources in the Power BI tenant settings.
D.Configure row-level security (RLS) on all datasets.
E.Set up B2B guest user permissions to restrict external data sources.
AnswersB, C

Enabling the 'Certification' tenant setting for dataflows activates the endorsement feature that lets authorized reviewers officially certify reusable dataflows. Once certified, those dataflows are the trusted building blocks that dataset authors can be required to use, and the tenant switch is a prerequisite for applying governance policies that mandate certified dataflows. Without this setting, dataflow certification is impossible, making it the correct control for enforcing that datasets use only certified dataflows.

Why this answer

To enforce that all datasets use certified data sources only, an administrator should enable certification for data sources (Option C) and enable certification for dataflows (Option B). Option C allows data source owners to certify data sources, and Option B allows dataflow owners to certify dataflows. Combined, these settings promote the use of certified components.

Option A (monitoring with Sentinel) only detects non-certified sources, it does not enforce. Option D (RLS) and Option E (B2B permissions) are unrelated to data source certification.

Practice this question →
17
MCQeasy

You need to grant a user the ability to manage permissions on a Power BI workspace but not to view or edit the content. What minimum role should you assign?

A.Contributor
B.Viewer
C.Member
D.Admin
AnswerD

Admin can manage permissions, but it also allows viewing and editing content; there is no role that manages permissions without content access.

Why this answer

The Admin role is the only workspace role that can manage permissions and membership, even though it also allows viewing and editing content. The minimum role required to manage permissions is Admin. Option A is incorrect because Contributor can view and edit content but cannot manage permissions.

Option B is incorrect because Viewer can only view content and cannot manage permissions. Option C is incorrect because Member can view and edit content but cannot manage permissions.

Exam trap

Note that the Admin role still allows viewing and editing content; it is not a permissions-only role. The minimum role to manage permissions is Admin, but it comes with full content access.

Practice this question →
18
Multi-Selecteasy

Which TWO methods can you use to share a Power BI report with external users who do not have a Power BI Pro license? (Choose two.)

Select 2 answers
A.Embed the report in a secure portal using 'Embed for your customers'.
B.Publish to a public website (Publish to web).
C.Export the report to PDF and share the file.
D.Share directly via Power BI using the user's email address.
E.Export the report to Excel and attach it to an email.
AnswersA, B

Allows users to view without a Pro license.

Why this answer

Options A and B are correct. Option A, 'Embed for your customers,' allows you to embed reports in a secure portal and share with external users without requiring them to have a Power BI Pro license (requires Premium capacity). Option B, 'Publish to a public website (Publish to web),' creates a public URL that anyone can access, including external users without a Pro license.

Option D (share directly via email) requires recipients to have a Pro license. Options C and E (export to PDF or Excel) are not interactive sharing methods and do not allow the report to be consumed as a live report.

Practice this question →
19
Multi-Selecthard

Which THREE components must be in place to enable Power BI data sensitivity labels from Microsoft Purview? (Select exactly three.)

Select 3 answers
A.Power BI admin setting to enable sensitivity labels enabled
B.Sensitivity labels published to users or groups in Microsoft Purview compliance portal
C.Power BI Premium capacity assigned to the workspace
D.Microsoft Purview Information Protection subscription (including Azure Information Protection P1/P2)
E.Power BI Pro license for all users
AnswersA, B, D

The admin must turn on the feature.

Why this answer

Options A, B, and D are correct. To enable Power BI data sensitivity labels from Microsoft Purview, three components are needed: the Power BI admin setting to enable sensitivity labels must be turned on (A), sensitivity labels must be published to users or groups in the Microsoft Purview compliance portal (B), and a Microsoft Purview Information Protection subscription (including Azure Information Protection P1/P2) is required (D). Option C is incorrect because Power BI Premium capacity is not a prerequisite; sensitivity labels work with both Power BI Pro and Premium capacities.

Option E is incorrect because a Power BI Pro license is not required for all users; the feature can be used with any license type if the admin enables it and the necessary subscriptions are in place.

Practice this question →
20
MCQmedium

A company is deploying Power BI for the entire organization. They need to prevent users from sharing reports with external email addresses. Which configuration should the Power BI admin use?

A.Disable 'Share content with external users' in the Power BI admin portal.
B.Configure a Conditional Access policy in Microsoft Entra ID.
C.Apply a Microsoft Purview sensitivity label.
D.Set the workspace sharing settings to 'Only existing users'.
AnswerA

Disabling 'Share content with external users' in the Power BI admin portal is the correct tenant-level control because it directly blocks the ability for any user's shared dashboards, reports, or apps to be accessible to email addresses outside your organization. This setting overrides per-user and per-workspace sharing permissions, acting as the only definitive switch that prevents external email invitations from being accepted or even invited. Without this disabled, users can still share to external identities even if other access policies are in place.

Why this answer

The Power BI admin portal provides a tenant-level setting 'Share content with external users' that can be disabled to prevent sharing with external email addresses. Option B is incorrect because Conditional Access policies in Microsoft Entra ID control access based on conditions but do not specifically block external sharing within Power BI. Option C is incorrect because Microsoft Purview sensitivity labels classify and protect data but do not block sharing.

Option D is incorrect because workspace sharing settings only control sharing within the workspace and do not prevent external sharing at the tenant level.

Practice this question →
21
Multi-Selecthard

You manage a Power BI tenant. You need to prevent users from sharing reports with external users. Which THREE actions should you take?

Select 3 answers
A.Create a Microsoft Entra ID conditional access policy to block external users.
B.Disable 'Publish to web' in the admin portal.
C.In the Power BI admin portal, disable 'Share content with external users'.
D.Disable 'Create app workspaces' for non-admins.
E.Disable 'Export to Excel' for all reports.
AnswersA, B, C

Blocks access from external accounts.

Why this answer

Options A, B, and C are correct. Creating a Microsoft Entra ID conditional access policy blocks external users from accessing resources. Disabling 'Publish to web' prevents public embedding of reports.

Disabling 'Share content with external users' in the admin portal prevents sharing with external users. Option D is wrong because disabling 'Create app workspaces' does not prevent sharing with external users; it prevents creation of workspaces. Option E is wrong because disabling 'Export to Excel' does not affect sharing.

Practice this question →
22
MCQmedium

You need to ensure that a Power BI report published to the service can be embedded in a secure internal SharePoint Online page. Only authenticated users from your Microsoft Entra ID tenant should be able to view the report. What should you do?

A.Use the 'Embed in SharePoint Online' option in Power BI service.
B.Share the report directly with all users and provide a direct link.
C.Use the 'Publish to web (public)' option and embed the iframe in SharePoint.
D.Use the 'Embed' option in Power BI service to generate a secure embed code, then add the Power BI web part in SharePoint.
AnswerA

This option also works but is essentially the same as C; however C is more generic.

Why this answer

To embed a Power BI report securely in a SharePoint Online page, use the 'Embed in SharePoint Online' option in the Power BI service. This generates a secure embed link that respects Microsoft Entra ID authentication and permissions, ensuring only authorized users can view the report. After generating the link, add the Power BI web part to a SharePoint page and paste the link.

Option B is incorrect because sharing a direct link does not embed the report; it only provides a hyperlink. Option C is incorrect because 'Publish to web' makes the report publicly accessible without authentication. Option D is also a method that generates a secure embed code, but the 'Embed in SharePoint Online' option is the most straightforward and recommended approach for SharePoint embedding, making Option A the correct choice.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Manage and secure Power BI questions.

Start 20-question session