Microsoft Power BI Data Analyst PL-300 Practice Test 36
Question 350
An analyst created an RLS role in Desktop but a Viewer cannot access the intended filtered report because the user has not been assigned to the published role in the service. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- A role name or label appears in settings, but its effective permissions and downstream model access were not inspected
- A workspace Member can view the report, but the intended Viewer or RLS test identity was not used
- An assigned Viewer test user is filtered while an unassigned test user does not silently receive that role
- An allowed user can see their data, but an excluded user was not tested for unauthorized access
Explanation
Correct Answer
C:An assigned Viewer test user is filtered while an unassigned test user does not silently receive that role This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
A:A policy label alone is not evidence of actual semantic-model security enforcement.
B:Elevated workspace roles can have different security behavior from restricted consumers.
D:Positive access alone does not prove the required exclusion or row-level boundary.
Question 351
A semantic model has country-specific RLS, but the service test account can read global totals in a derived dashboard tile; the analyst must verify whether the tile uses the intended secure model. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- A workspace Member can view the report, but the intended Viewer or RLS test identity was not used
- A role name or label appears in settings, but its effective permissions and downstream model access were not inspected
- The tile resolves to the governed model and displays only the totals the consumer role permits
- An allowed user can see their data, but an excluded user was not tested for unauthorized access
Explanation
Correct Answer
C:The tile resolves to the governed model and displays only the totals the consumer role permits This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
A:Elevated workspace roles can have different security behavior from restricted consumers.
B:A policy label alone is not evidence of actual semantic-model security enforcement.
D:Positive access alone does not prove the required exclusion or row-level boundary.
Question 352
A Power BI department has an approved collection of reports and wants to distribute a curated read-only experience to hundreds of users with controlled audiences. Which Power BI or Power Query action BEST meets the stated requirement?
- Publish a Power BI app from the workspace with appropriate audiences and access
- Use a report tooltip page as the distribution channel
- Email PBIX files individually after each update
- Assign all 300 consumers as workspace Members
Explanation
Correct Answer
A:Apps package curated workspace content for broad consumer distribution and updates This addresses the specific requirement: a Power BI department has an approved collection of reports and wants to distribute a curated read-only experience to hundreds of users with controlled audiences.
Incorrect Answers
B:A tooltip is report content, not a distribution method or permission boundary This alternative therefore fails an explicit scenario constraint.
C:Static files create uncontrolled copies and complicate release management This alternative therefore fails an explicit scenario constraint.
D:Member rights are broader than necessary for report consumption This alternative therefore fails an explicit scenario constraint.
Question 353
A published semantic model has sensitive salary columns that ordinary consumers must not query through shared model access. Which Power BI or Power Query action BEST meets the stated requirement?
- Create a slicer that defaults to non-salary fields
- Apply a report bookmark that collapses the salary table
- Hide salary fields in report view and consider them secured
- Design object-level security or an appropriately restricted semantic model for the sensitive fields
Explanation
Correct Answer
D:Column or table-level protection is distinct from RLS row filtering and report-level hiding This addresses the specific requirement: a published semantic model has sensitive salary columns that ordinary consumers must not query through shared model access.
Incorrect Answers
A:Slicer defaults do not prevent direct querying of protected columns This alternative therefore fails an explicit scenario constraint.
B:Bookmark display state is not a semantic model security restriction This alternative therefore fails an explicit scenario constraint.
C:Hidden model fields may remain accessible to users with sufficient Build permission This alternative therefore fails an explicit scenario constraint.
Question 354
A report editor changed a visual in a workspace but app consumers still see the previously published version. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- The app consumer sees the revised visual after the app update is published
- The service settings show a saved schedule or app update, but the operation has not executed
- The workspace lists the item, but cross-workspace lineage and intended permission scope were not verified
- A workspace Admin can view the report, but the intended app audience or Viewer account was not tested
Explanation
Correct Answer
A:The app consumer sees the revised visual after the app update is published This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
B:A saved setting is not a successful refresh, distribution or alert result.
C:An item inventory entry does not establish that intended consumers see the right governed content.
D:Admin access does not prove consumer permissions or app distribution are configured correctly.
Question 355
A regulated dataset must display its Confidential sensitivity classification in Power BI items and in supported downstream use. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- An allowed user can see their data, but an excluded user was not tested for unauthorized access
- A workspace Member can view the report, but the intended Viewer or RLS test identity was not used
- The published item displays the intended sensitivity label and supported exports follow the configured label behavior
- A role name or label appears in settings, but its effective permissions and downstream model access were not inspected
Explanation
Correct Answer
C:The published item displays the intended sensitivity label and supported exports follow the configured label behavior This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
A:Positive access alone does not prove the required exclusion or row-level boundary.
B:Elevated workspace roles can have different security behavior from restricted consumers.
D:A policy label alone is not evidence of actual semantic-model security enforcement.
Question 356
A data analyst must publish a report for a department while allowing business users to view but not edit the workspace's semantic models. A pilot instead implemented the following proposed change: Give every consumer the workspace Admin role. The business requirement was not met. Which technical limitation MOST DIRECTLY explains the result?
- Credential sharing defeats individual access control and auditability
- Viewer access allows consumption without granting workspace editing privileges
- Contributors can create and edit workspace content, violating the view-only requirement
- Admins can change workspace settings and content beyond the consumer requirement
Explanation
Correct Answer
D:Admins can change workspace settings and content beyond the consumer requirement This specifically addresses the deployed or proposed alternative: Give every consumer the workspace Admin role.
Incorrect Answers
A:Credential sharing defeats individual access control and auditability That limitation describes Share the workspace's owner credentials with all employees, not the specified approach.
B:Viewer access allows consumption without granting workspace editing privileges This supports the recommended design but does not diagnose why the specified alternative fails.
C:Contributors can create and edit workspace content, violating the view-only requirement That limitation applies to a different alternative (Assign every user the Contributor role), not the one here.
Question 357
A report author needs permission to build a new report from a shared semantic model but should not be allowed to edit its tables or update model metadata. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- The author can create a connected report but cannot change the protected shared semantic model
- A role name or label appears in settings, but its effective permissions and downstream model access were not inspected
- An allowed user can see their data, but an excluded user was not tested for unauthorized access
- A workspace Member can view the report, but the intended Viewer or RLS test identity was not used
Explanation
Correct Answer
A:The author can create a connected report but cannot change the protected shared semantic model This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
B:A policy label alone is not evidence of actual semantic-model security enforcement.
C:Positive access alone does not prove the required exclusion or row-level boundary.
D:Elevated workspace roles can have different security behavior from restricted consumers.
Question 358
A revenue scorecard must notify its owner when a supported dashboard numeric tile exceeds a specified threshold. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- A workspace Admin can view the report, but the intended app audience or Viewer account was not tested
- The service settings show a saved schedule or app update, but the operation has not executed
- The workspace lists the item, but cross-workspace lineage and intended permission scope were not verified
- An eligible dashboard tile crossing the threshold produces the configured notification to the owner
Explanation
Correct Answer
D:An eligible dashboard tile crossing the threshold produces the configured notification to the owner This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
A:Admin access does not prove consumer permissions or app distribution are configured correctly.
B:A saved setting is not a successful refresh, distribution or alert result.
C:An item inventory entry does not establish that intended consumers see the right governed content.
Question 359
A team shares a model using direct report access and users cannot create another report from it; the organization wants governed self-service reuse. A design reviewer proposes this alternative: Turn off sharing and copy all source data into personal Excel files. Which objection BEST explains why it would not satisfy the stated requirement?
- RLS controls row access and does not alone grant authorization to build new content
- Administration grants excessive rights for self-service report authoring
- Uncontrolled copies undermine governed model reuse
- Report viewing and creating new content from a semantic model are distinct permission needs
Explanation
Correct Answer
C:Uncontrolled copies undermine governed model reuse This specifically addresses the deployed or proposed alternative: Turn off sharing and copy all source data into personal Excel files.
Incorrect Answers
A:RLS controls row access and does not alone grant authorization to build new content That limitation describes Assign users to an unrelated RLS role only, not the specified approach.
B:Administration grants excessive rights for self-service report authoring That limitation applies to a different alternative (Grant all users workspace Admin), not the one here.
D:Report viewing and creating new content from a semantic model are distinct permission needs This supports the recommended design but does not diagnose why the specified alternative fails.
Question 360
Two teams have nearly identical semantic models and IT wants users to identify the trusted reviewed model through the service content list. A pilot instead implemented the following proposed change: Rename the model Official without an endorsement. The business requirement was not met. Which technical limitation MOST DIRECTLY explains the result?
- A name is not the controlled certification designation
- Indiscriminate certification removes the trust meaning of governed endorsement
- Bookmarks are personal report state and do not endorse the model
- Certification denotes vetted trusted content and helps discovery under governance rules
Explanation
Correct Answer
A:A name is not the controlled certification designation This specifically addresses the deployed or proposed alternative: Rename the model Official without an endorsement.
Incorrect Answers
B:Indiscriminate certification removes the trust meaning of governed endorsement That limitation applies to a different alternative (Mark every semantic model in the tenant Certified automatically), not the one here.
C:Bookmarks are personal report state and do not endorse the model That limitation describes Create a personal bookmark labeled Approved, not the specified approach.
D:Certification denotes vetted trusted content and helps discovery under governance rules This supports the recommended design but does not diagnose why the specified alternative fails.