Microsoft Power BI Data Analyst PL-300 Practice Test 38
Question 370
A published semantic model has sensitive salary columns that ordinary consumers must not query through shared model access. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- A workspace Member can view the report, but the intended Viewer or RLS test identity was not used
- Unauthorized consumer queries cannot access the protected salary objects even outside the original report visual
- An allowed user can see their data, but an excluded user was not tested for unauthorized access
- A role name or label appears in settings, but its effective permissions and downstream model access were not inspected
Explanation
Correct Answer
B:Unauthorized consumer queries cannot access the protected salary objects even outside the original report visual This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
A:Elevated workspace roles can have different security behavior from restricted consumers.
C:Positive access alone does not prove the required exclusion or row-level boundary.
D:A policy label alone is not evidence of actual semantic-model security enforcement.
Question 371
A report author needs permission to build a new report from a shared semantic model but should not be allowed to edit its tables or update model metadata. Which Power BI or Power Query action BEST meets the stated requirement?
- Make the author a workspace Admin
- Share the PBIX file containing model credentials
- Give access to only the finished report without granting Build on the shared model
- Grant Build permission on the semantic model without assigning workspace editing rights
Explanation
Correct Answer
D:Build enables creating content from a model without authorizing maintenance of the model itself This addresses the specific requirement: a report author needs permission to build a new report from a shared semantic model but should not be allowed to edit its tables or update model metadata.
Incorrect Answers
A:An Admin can modify workspace content and permissions beyond the request This alternative therefore fails an explicit scenario constraint.
B:Duplicating the file creates security and lineage risk rather than scoped Build access This alternative therefore fails an explicit scenario constraint.
C:Report viewing permission by itself does not guarantee that a user can discover and build new reports from a shared semantic model This alternative therefore fails an explicit scenario constraint.
Question 372
Two teams have nearly identical semantic models and IT wants users to identify the trusted reviewed model through the service content list. A design reviewer proposes this alternative: Mark every semantic model in the tenant Certified automatically. Which objection BEST explains why it would not satisfy the stated requirement?
- A name is not the controlled certification designation
- Bookmarks are personal report state and do not endorse the model
- Certification denotes vetted trusted content and helps discovery under governance rules
- Indiscriminate certification removes the trust meaning of governed endorsement
Explanation
Correct Answer
D:Indiscriminate certification removes the trust meaning of governed endorsement This specifically addresses the deployed or proposed alternative: Mark every semantic model in the tenant Certified automatically.
Incorrect Answers
A:A name is not the controlled certification designation That limitation applies to a different alternative (Rename the model Official without an endorsement), not the one here.
B:Bookmarks are personal report state and do not endorse the model That limitation describes Create a personal bookmark labeled Approved, not the specified approach.
C:Certification denotes vetted trusted content and helps discovery under governance rules This supports the recommended design but does not diagnose why the specified alternative fails.
Question 373
A report editor changed a visual in a workspace but app consumers still see the previously published version. Which Power BI or Power Query action BEST meets the stated requirement?
- Rename the semantic model and wait for the app to discover it
- Disable report page interaction settings
- Update the published app after workspace changes
- Recreate every user's Power BI account
Explanation
Correct Answer
C:Workspace edits do not always propagate to app consumers until the app is updated This addresses the specific requirement: a report editor changed a visual in a workspace but app consumers still see the previously published version.
Incorrect Answers
A:Renaming model metadata does not update the published app package This alternative therefore fails an explicit scenario constraint.
B:Visual interaction settings do not republish app content This alternative therefore fails an explicit scenario constraint.
D:User accounts are unrelated to promoting the changed app version This alternative therefore fails an explicit scenario constraint.
Question 374
Two teams have nearly identical semantic models and IT wants users to identify the trusted reviewed model through the service content list. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- A workspace Admin can view the report, but the intended app audience or Viewer account was not tested
- The model shows the expected endorsement badge and only authorized certifiers can grant certification
- The workspace lists the item, but cross-workspace lineage and intended permission scope were not verified
- The service settings show a saved schedule or app update, but the operation has not executed
Explanation
Correct Answer
B:The model shows the expected endorsement badge and only authorized certifiers can grant certification This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
A:Admin access does not prove consumer permissions or app distribution are configured correctly.
C:An item inventory entry does not establish that intended consumers see the right governed content.
D:A saved setting is not a successful refresh, distribution or alert result.
Question 375
A regional sales report must show each employee only their own territory rows using a mapping table keyed by their signed-in account. A pilot instead implemented the following proposed change: Create one static report-page filter and assume it enforces territory security. The business requirement was not met. Which technical limitation MOST DIRECTLY explains the result?
- Dynamic RLS applies an identity-derived filter to relevant rows for each signed-in user
- Authoring rights can bypass normal consumption restrictions and defeat per-user RLS testing
- Hiding fields does not prevent access to underlying rows through permitted queries
- Page filters are user-editable presentation controls, not a security boundary
Explanation
Correct Answer
D:Page filters are user-editable presentation controls, not a security boundary This specifically addresses the deployed or proposed alternative: Create one static report-page filter and assume it enforces territory security.
Incorrect Answers
A:Dynamic RLS applies an identity-derived filter to relevant rows for each signed-in user This supports the recommended design but does not diagnose why the specified alternative fails.
B:Authoring rights can bypass normal consumption restrictions and defeat per-user RLS testing That limitation describes Create one common workspace Editor account for all sales employees, not the specified approach.
C:Hiding fields does not prevent access to underlying rows through permitted queries That limitation applies to a different alternative (Hide the Territory column from report view), not the one here.
Question 376
A published Import semantic model connects to a SQL Server available only on the corporate network, while the Power BI service cannot access the server directly. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- A workspace Admin can view the report, but the intended app audience or Viewer account was not tested
- The workspace lists the item, but cross-workspace lineage and intended permission scope were not verified
- The service settings show a saved schedule or app update, but the operation has not executed
- The service model refresh succeeds through the approved gateway connection without exposing the server publicly
Explanation
Correct Answer
D:The service model refresh succeeds through the approved gateway connection without exposing the server publicly This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
A:Admin access does not prove consumer permissions or app distribution are configured correctly.
B:An item inventory entry does not establish that intended consumers see the right governed content.
C:A saved setting is not a successful refresh, distribution or alert result.
Question 377
A large workspace has separate analysts who maintain reports and engineers who manage underlying models; the team needs to limit permissions to each role. Which Power BI or Power Query action BEST meets the stated requirement?
- Use one shared admin account for every contributor
- Grant Admin to every analyst to avoid permission requests
- Assign workspace and item permissions by actual authoring responsibilities with least privilege
- Make reports accessible to Anyone with the link
Explanation
Correct Answer
C:Role-based access separates editing, administration, and consumption capabilities This addresses the specific requirement: a large workspace has separate analysts who maintain reports and engineers who manage underlying models; the team needs to limit permissions to each role.
Incorrect Answers
A:Shared identities prevent reliable per-user authorization and audit tracing This alternative therefore fails an explicit scenario constraint.
B:Global admin rights exceed report authoring needs and widen accidental changes This alternative therefore fails an explicit scenario constraint.
D:Broad anonymous sharing undermines controlled organizational distribution This alternative therefore fails an explicit scenario constraint.
Question 378
A report editor changed a visual in a workspace but app consumers still see the previously published version. A pilot instead implemented the following proposed change: Recreate every user's Power BI account. The business requirement was not met. Which technical limitation MOST DIRECTLY explains the result?
- Visual interaction settings do not republish app content
- Workspace edits do not always propagate to app consumers until the app is updated
- User accounts are unrelated to promoting the changed app version
- Renaming model metadata does not update the published app package
Explanation
Correct Answer
C:User accounts are unrelated to promoting the changed app version This specifically addresses the deployed or proposed alternative: Recreate every user's Power BI account.
Incorrect Answers
A:Visual interaction settings do not republish app content That limitation describes Disable report page interaction settings, not the specified approach.
B:Workspace edits do not always propagate to app consumers until the app is updated This supports the recommended design but does not diagnose why the specified alternative fails.
D:Renaming model metadata does not update the published app package That limitation applies to a different alternative (Rename the semantic model and wait for the app to discover it), not the one here.
Question 379
A large workspace has separate analysts who maintain reports and engineers who manage underlying models; the team needs to limit permissions to each role. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- The service settings show a saved schedule or app update, but the operation has not executed
- A contributor performs permitted edits while a test viewer cannot alter protected workspace objects
- The workspace lists the item, but cross-workspace lineage and intended permission scope were not verified
- A workspace Admin can view the report, but the intended app audience or Viewer account was not tested
Explanation
Correct Answer
B:A contributor performs permitted edits while a test viewer cannot alter protected workspace objects This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
A:A saved setting is not a successful refresh, distribution or alert result.
C:An item inventory entry does not establish that intended consumers see the right governed content.
D:Admin access does not prove consumer permissions or app distribution are configured correctly.
Question 380
A regulated dataset must display its Confidential sensitivity classification in Power BI items and in supported downstream use. A design reviewer proposes this alternative: Hide a column and call the full dataset encrypted. Which objection BEST explains why it would not satisfy the stated requirement?
- Sensitivity labels classify governed content and can carry protection behaviors under supported settings
- Field hiding does not apply the requested classification to the item
- Visual colors cannot replace sensitivity and governance metadata
- A title is not a policy-governed sensitivity label
Explanation
Correct Answer
B:Field hiding does not apply the requested classification to the item This specifically addresses the deployed or proposed alternative: Hide a column and call the full dataset encrypted.
Incorrect Answers
A:Sensitivity labels classify governed content and can carry protection behaviors under supported settings This supports the recommended design but does not diagnose why the specified alternative fails.
C:Visual colors cannot replace sensitivity and governance metadata That limitation describes Create a red-colored report theme, not the specified approach.
D:A title is not a policy-governed sensitivity label That limitation applies to a different alternative (Rename the report Confidential without applying a label), not the one here.