Microsoft Power BI Data Analyst PL-300 Practice Test 39
Question 380
A regulated dataset must display its Confidential sensitivity classification in Power BI items and in supported downstream use. A design reviewer proposes this alternative: Hide a column and call the full dataset encrypted. Which objection BEST explains why it would not satisfy the stated requirement?
- Sensitivity labels classify governed content and can carry protection behaviors under supported settings
- Field hiding does not apply the requested classification to the item
- Visual colors cannot replace sensitivity and governance metadata
- A title is not a policy-governed sensitivity label
Explanation
Correct Answer
B:Field hiding does not apply the requested classification to the item This specifically addresses the deployed or proposed alternative: Hide a column and call the full dataset encrypted.
Incorrect Answers
A:Sensitivity labels classify governed content and can carry protection behaviors under supported settings This supports the recommended design but does not diagnose why the specified alternative fails.
C:Visual colors cannot replace sensitivity and governance metadata That limitation describes Create a red-colored report theme, not the specified approach.
D:A title is not a policy-governed sensitivity label That limitation applies to a different alternative (Rename the report Confidential without applying a label), not the one here.
Question 381
A Power BI department has an approved collection of reports and wants to distribute a curated read-only experience to hundreds of users with controlled audiences. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- The service settings show a saved schedule or app update, but the operation has not executed
- Approved audiences can access the latest published app content without gaining authoring rights
- A workspace Admin can view the report, but the intended app audience or Viewer account was not tested
- The workspace lists the item, but cross-workspace lineage and intended permission scope were not verified
Explanation
Correct Answer
B:Approved audiences can access the latest published app content without gaining authoring rights This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
A:A saved setting is not a successful refresh, distribution or alert result.
C:Admin access does not prove consumer permissions or app distribution are configured correctly.
D:An item inventory entry does not establish that intended consumers see the right governed content.
Question 382
A regional sales report must show each employee only their own territory rows using a mapping table keyed by their signed-in account. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- A workspace Member can view the report, but the intended Viewer or RLS test identity was not used
- Different signed-in users see only their assigned territory rows when evaluated through consumer access
- An allowed user can see their data, but an excluded user was not tested for unauthorized access
- A role name or label appears in settings, but its effective permissions and downstream model access were not inspected
Explanation
Correct Answer
B:Different signed-in users see only their assigned territory rows when evaluated through consumer access This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
A:Elevated workspace roles can have different security behavior from restricted consumers.
C:Positive access alone does not prove the required exclusion or row-level boundary.
D:A policy label alone is not evidence of actual semantic-model security enforcement.
Question 383
An executive needs a single at-a-glance surface showing pinned metrics from several separate Power BI reports. A design reviewer proposes this alternative: Use one Tooltip page as the enterprise summary. Which objection BEST explains why it would not satisfy the stated requirement?
- Query names do not create service dashboards or pinned tiles
- Tooltips are contextual page overlays rather than a multi-report dashboard
- A static export is not the requested navigable cross-report dashboard
- A dashboard can combine pinned tiles from multiple reports in one service canvas
Explanation
Correct Answer
B:Tooltips are contextual page overlays rather than a multi-report dashboard This specifically addresses the deployed or proposed alternative: Use one Tooltip page as the enterprise summary.
Incorrect Answers
A:Query names do not create service dashboards or pinned tiles That limitation applies to a different alternative (Create a Power Query query called Dashboard), not the one here.
C:A static export is not the requested navigable cross-report dashboard That limitation describes Export all source reports to one static Excel file, not the specified approach.
D:A dashboard can combine pinned tiles from multiple reports in one service canvas This supports the recommended design but does not diagnose why the specified alternative fails.
Question 384
A published Import semantic model connects to a SQL Server available only on the corporate network, while the Power BI service cannot access the server directly. A pilot instead implemented the following proposed change: Embed the SQL password into a DAX measure. The business requirement was not met. Which technical limitation MOST DIRECTLY explains the result?
- Workspace location does not supply a network bridge to the on-premises server
- Page refresh does not create connectivity from the cloud service to private SQL
- A gateway bridges authorized service refresh queries to reachable internal data sources
- Measures cannot establish a secure network route or supply refresh credentials
Explanation
Correct Answer
D:Measures cannot establish a secure network route or supply refresh credentials This specifically addresses the deployed or proposed alternative: Embed the SQL password into a DAX measure.
Incorrect Answers
A:Workspace location does not supply a network bridge to the on-premises server That limitation describes Publish the PBIX to a different workspace and keep the same network isolation, not the specified approach.
B:Page refresh does not create connectivity from the cloud service to private SQL That limitation applies to a different alternative (Increase the report page refresh rate without a gateway), not the one here.
C:A gateway bridges authorized service refresh queries to reachable internal data sources This supports the recommended design but does not diagnose why the specified alternative fails.
Question 385
A regional sales report must show each employee only their own territory rows using a mapping table keyed by their signed-in account. A design reviewer proposes this alternative: Hide the Territory column from report view. Which objection BEST explains why it would not satisfy the stated requirement?
- Dynamic RLS applies an identity-derived filter to relevant rows for each signed-in user
- Hiding fields does not prevent access to underlying rows through permitted queries
- Authoring rights can bypass normal consumption restrictions and defeat per-user RLS testing
- Page filters are user-editable presentation controls, not a security boundary
Explanation
Correct Answer
B:Hiding fields does not prevent access to underlying rows through permitted queries This specifically addresses the deployed or proposed alternative: Hide the Territory column from report view.
Incorrect Answers
A:Dynamic RLS applies an identity-derived filter to relevant rows for each signed-in user This supports the recommended design but does not diagnose why the specified alternative fails.
C:Authoring rights can bypass normal consumption restrictions and defeat per-user RLS testing That limitation describes Create one common workspace Editor account for all sales employees, not the specified approach.
D:Page filters are user-editable presentation controls, not a security boundary That limitation applies to a different alternative (Create one static report-page filter and assume it enforces territory security), not the one here.
Question 386
A data analyst must publish a report for a department while allowing business users to view but not edit the workspace's semantic models. Which Power BI or Power Query action BEST meets the stated requirement?
- Give every consumer the workspace Admin role
- Assign consumers the Viewer role and grant access through an approved app where appropriate
- Share the workspace's owner credentials with all employees
- Assign every user the Contributor role
Explanation
Correct Answer
B:Viewer access allows consumption without granting workspace editing privileges This addresses the specific requirement: a data analyst must publish a report for a department while allowing business users to view but not edit the workspace's semantic models.
Incorrect Answers
A:Admins can change workspace settings and content beyond the consumer requirement This alternative therefore fails an explicit scenario constraint.
C:Credential sharing defeats individual access control and auditability This alternative therefore fails an explicit scenario constraint.
D:Contributors can create and edit workspace content, violating the view-only requirement This alternative therefore fails an explicit scenario constraint.
Question 387
An analyst created an RLS role in Desktop but a Viewer cannot access the intended filtered report because the user has not been assigned to the published role in the service. A pilot instead implemented the following proposed change: Rename the RLS role to Restricted. The business requirement was not met. Which technical limitation MOST DIRECTLY explains the result?
- A separate model does not apply the existing role membership
- A visual filter does not replace membership of a security model role
- Renaming does not assign identities to the role
- RLS definitions require role membership for consumers to receive the specified row filter
Explanation
Correct Answer
C:Renaming does not assign identities to the role This specifically addresses the deployed or proposed alternative: Rename the RLS role to Restricted.
Incorrect Answers
A:A separate model does not apply the existing role membership That limitation describes Create another unrelated semantic model copy, not the specified approach.
B:A visual filter does not replace membership of a security model role That limitation applies to a different alternative (Add a report visual filter on the territory), not the one here.
D:RLS definitions require role membership for consumers to receive the specified row filter This supports the recommended design but does not diagnose why the specified alternative fails.
Question 388
A user is a workspace Member and sees all rows although the model has RLS rules; the team is testing whether the rules work for consumers. A pilot instead implemented the following proposed change: Assume an Admin view proves RLS is broken for all consumers. The business requirement was not met. Which technical limitation MOST DIRECTLY explains the result?
- Administrative privilege can bypass RLS behavior for that workspace
- RLS applies to Viewer consumers; workspace Admin Member and Contributor permissions are not constrained the same way
- Removing RLS would weaken protection based on an invalid author-context test
- A presentation filter is not equivalent to tested semantic model RLS
Explanation
Correct Answer
A:Administrative privilege can bypass RLS behavior for that workspace This specifically addresses the deployed or proposed alternative: Assume an Admin view proves RLS is broken for all consumers.
Incorrect Answers
B:RLS applies to Viewer consumers; workspace Admin Member and Contributor permissions are not constrained the same way This supports the recommended design but does not diagnose why the specified alternative fails.
C:Removing RLS would weaken protection based on an invalid author-context test That limitation describes Delete the RLS role because the author can see the full table, not the specified approach.
D:A presentation filter is not equivalent to tested semantic model RLS That limitation applies to a different alternative (Add a visual-level page filter to hide unwanted rows), not the one here.
Question 389
A user is a workspace Member and sees all rows although the model has RLS rules; the team is testing whether the rules work for consumers. After the correct solution is implemented, which result provides the MOST DIRECT evidence that the requirement actually works?
- An allowed user can see their data, but an excluded user was not tested for unauthorized access
- A role name or label appears in settings, but its effective permissions and downstream model access were not inspected
- A workspace Member can view the report, but the intended Viewer or RLS test identity was not used
- The same model filters rows correctly when viewed through an actual consumer identity and role membership
Explanation
Correct Answer
D:The same model filters rows correctly when viewed through an actual consumer identity and role membership This exercises the requested business outcome and the necessary positive or negative boundary.
Incorrect Answers
A:Positive access alone does not prove the required exclusion or row-level boundary.
B:A policy label alone is not evidence of actual semantic-model security enforcement.
C:Elevated workspace roles can have different security behavior from restricted consumers.
Question 390
An analyst created an RLS role in Desktop but a Viewer cannot access the intended filtered report because the user has not been assigned to the published role in the service. Which Power BI or Power Query action BEST meets the stated requirement?
- Assign the intended Entra users or security groups to the published semantic model's RLS role
- Create another unrelated semantic model copy
- Add a report visual filter on the territory
- Rename the RLS role to Restricted
Explanation
Correct Answer
A:RLS definitions require role membership for consumers to receive the specified row filter This addresses the specific requirement: an analyst created an RLS role in Desktop but a Viewer cannot access the intended filtered report because the user has not been assigned to the published role in the service.
Incorrect Answers
B:A separate model does not apply the existing role membership This alternative therefore fails an explicit scenario constraint.
C:A visual filter does not replace membership of a security model role This alternative therefore fails an explicit scenario constraint.
D:Renaming does not assign identities to the role This alternative therefore fails an explicit scenario constraint.