Row-Level Security Considerations in Power BI
Which THREE of the following are considerations when implementing row-level security (RLS) in Power BI? (Select three.)
Quick Answer
The correct answer is that row-level security can be defined using DAX filter expressions, is applied when the user queries the dataset, and does not apply to the XMLA endpoint by default unless dynamic security is configured. RLS works by evaluating DAX filter rules at query time, restricting data based on the user’s identity before any visual renders, which means the filters are enforced on all visuals—not selectively. On the PL-300 exam, this concept tests your understanding of how RLS differs from role-based access; a common trap is assuming RLS applies to the XMLA endpoint automatically or that it can be toggled per visual. Remember the key distinction: RLS is user-based, not role-based, and dynamic security requires a DAX expression like `USERNAME()` to map users to data. A helpful memory tip is “RLS = Row-Level, not Role-Level”—the filter is always on the row, never on the visual.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RLS does not apply to data accessed via the XMLA endpoint unless using dynamic security.
Options A, B, and C are correct. Row-level security (RLS) in Power BI ensures that users only see data they are authorized to view. Option A is correct because RLS does not apply to data accessed via the XMLA endpoint unless dynamic security is configured; static RLS filters are not applied through the endpoint. Option B is correct because RLS filters are applied at query time, restricting data in all visuals. Option C is correct because RLS can be defined using DAX filter expressions in the Manage Roles feature. Option D is incorrect because RLS applies to all users regardless of their role (Viewer, Editor, etc.); it is not limited to the Viewer role. Option E is incorrect because the "Show all" option in visuals does not bypass RLS; users cannot see data they are not permitted to see.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
RLS does not apply to data accessed via the XMLA endpoint unless using dynamic security.
Why this is correct
Static RLS is not enforced via XMLA; dynamic security is needed.
- ✓
RLS filters are applied at query time.
Why this is correct
Filters are applied dynamically when the user accesses the report.
- ✓
RLS can be defined using DAX filter expressions.
Why this is correct
DAX is used to define the security filters.
- ✗
RLS is enforced only for users with the Viewer role.
Why it's wrong here
RLS is enforced for all users regardless of workspace role.
- ✗
RLS can be bypassed by using the 'Show all' option in visuals.
Why it's wrong here
RLS cannot be bypassed by users.
Go deeper
Related to this question
About these practice questions
This PL-300 question is part of Courseiva's 217-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PL-300
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE considerations are important when implementing row-level security (RLS) in Power BI? (Select exactly 3.)
hard- ✓ A.Roles can use DAX expressions to define filters
- ✓ B.RLS can filter data based on the user's identity
- C.RLS is automatically applied when using Analyze in Excel
- ✓ D.RLS in DirectQuery mode pushes filters to the source database
- E.RLS can restrict access to specific measures
Why A: Options A, B, and D are correct. Option A: Roles in Power BI RLS use DAX expressions to define row-level filters. Option B: RLS dynamically filters data based on the user's identity (e.g., username). Option D: In DirectQuery mode, RLS filters are pushed to the source database for performance. Option C is incorrect because RLS is not automatically applied in Analyze in Excel; users see all data unless they have the appropriate role. Option E is incorrect because RLS controls row-level data access, not access to specific measures; measures can be hidden via other methods.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PL-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-300 exam.