Microsoft Fabric Analytics Engineer Associate (DP-600)

D is correct.

Explanation: Workspace roles apply to all items in a workspace and should be reserved for collaboration. For more granular access control, use item-level permissions based on business needs. Item-level permissions on the report limit access to that item.

A is incorrect: The viewer role is a workspace role. Workspace roles apply to all items in the workspace, so it does not limit access to one report.

B is incorrect: The contributor role is a workspace role that applies to all items. It is meant for collaboration, not for single-item access.

C is incorrect: The member role is a workspace role that applies to all items. It is meant for collaboration, not for single-item access.

D is correct.

Explanation: A view defines a saved query that you reference like a table. You can use views to combine fact and dimension tables into a reporting-friendly format and to filter rows to a business context. Copilot and Fabric IQ data agents can query views like tables, and well-named views improve the accuracy of natural language queries.

A is incorrect: Separate saved queries per analyst keep the join and filter logic duplicated. They do not standardize access.

B is incorrect: The Visual query editor provides a no-code way to build queries. Separate visual queries per analyst do not create a shared object that analysts reference like a table.

C is incorrect: Stored procedures contain T-SQL logic that you execute on demand, such as loading staging data into final tables. They are not objects that you reference like a table.

C is correct.

Explanation: A Real-Time Dashboard pins visualizations to a single visual interface. Each tile is based on a KQL query that extracts data from tables in an eventhouse. You can create a dashboard directly from a KQL queryset. After you publish it, users can drill into the data, filter and aggregate it, and change the visualization type.

A is incorrect: Activator rules trigger actions when conditions are met. They do not provide a tiled interface for exploring query results.

B is incorrect: A derived stream is an eventstream destination that routes stream data. It does not display query results in tiles.

D is incorrect: Subscribing to Fabric events in the Real-Time hub makes system events available. It does not visualize the results of KQL queries.

C is correct.

Explanation: Shortcuts reference data in external locations such as Azure Data Lake Storage without copying it. The data stays in the source and appears in OneLake.

A is incorrect: Mirroring continuously replicates changes from external databases such as Azure SQL, Cosmos DB, or Snowflake. It does not reference files in Azure Data Lake Storage in place.

B is incorrect: Pipelines orchestrate batch data movement and transformation. This approach moves data instead of referencing it.

D is incorrect: Direct upload adds files through the Fabric interface. This approach creates a separate copy of the files.

A is correct.

Explanation: For a discovered KQL table, you can query data directly with a KQL queryset, create real-time dashboards, or set alerts on query results. A real-time dashboard meets the need for a visual display of the readings.

B is incorrect: Shortcuts are an option for eventstreams that send data to a lakehouse. A shortcut does not create a visual display.

C is incorrect: Alerts with Fabric Activator notify you about conditions. They do not display the readings, and the scenario starts from a KQL table, not an eventstream.

D is incorrect: The OneLake catalog helps you find data that is already stored, such as lakehouses, warehouses, and semantic models. Use Real-Time hub to discover streaming data.

B and D are correct.

Explanation: Admins can enable Fabric in the Admin portal > Tenant settings in the Power BI service. They can enable it for the entire organization or for specific Microsoft 365 or Microsoft Entra security groups. Admins can also delegate this ability to other users at the capacity level.

A is incorrect: License type is a workspace setting that lets you use Fabric features in that workspace. It does not enable Fabric for the tenant.

C is incorrect: The Copilot tenant setting controls Copilot in Fabric. It does not enable Fabric for a group.

C is correct.

Explanation: Cross-database querying lets you query data across warehouses and lakehouses without copying data. You use three-part naming to join warehouse tables with lakehouse tables in one query.

A is incorrect: COPY INTO bulk loads data from external files, such as CSV or Parquet files in Azure storage, into warehouse tables. It copies data, which does not meet the requirement.

B is incorrect: A SQL analytics endpoint provides read-only SQL access to lakehouse data. It does not support INSERT, UPDATE, DELETE, or MERGE, so you cannot write results back through it.

D is incorrect: Dataflow Gen2 supports orchestrated data movement and transformation, but a nightly copy duplicates the data. Cross-database querying avoids that copy.

A and C are correct.

Explanation: Read allows the user to connect by using the SQL analytics endpoint. A connection fails without at least Read permission. ReadData allows the user to read data from any table or view in the warehouse. Item permissions share an individual warehouse without granting access to the entire workspace.

B is incorrect: ReadAll allows the user to read raw parquet files in OneLake. The requirements exclude that access.

D is incorrect: The Admin role gives full control at the workspace level. It grants more access than the analyst needs, and item permissions are the way to share a single warehouse.

C is correct.

Explanation: The OneLake catalog helps you analyze, monitor, and maintain data governance. It provides guidance on sensitivity labels, item metadata, and data refresh status, offering insights into the governance status and actions for improvement.

A is incorrect: The Admin portal manages groups and permissions, configures data sources and gateways, and monitors usage and performance. It is not the capability described for sensitivity label and refresh status guidance.

B is incorrect: Git integration provides version control. It tracks changes and keeps a history of your work, but it does not report governance status.

D is incorrect: Shortcuts provide access to existing data without copying it. They do not report on governance status.

A and C are correct.

Explanation: Promoted means an item is ready for others to use, and any user with write permissions can apply it. Certified means an item meets organizational quality standards, and only authorized reviewers can apply it.

B is incorrect: Certified is restricted to authorized reviewers. Write permission alone does not allow a user to apply it.

D is incorrect: Master data identifies an authoritative source for core business data. Only authorized reviewers can apply it, and it applies to data items only.

D is correct.

Explanation: An eventhouse is designed for real-time analytics on streaming and time-series data. Its data is indexed and partitioned by ingestion time. KQL provides built-in time-series functions such as make-series and series_decompose_anomalies. Power BI integration supports low-latency dashboards.

A is incorrect: A warehouse handles batch and micro-batch loading. It is not purpose-built for streaming ingestion where data must be queryable within seconds.

B is incorrect: A lakehouse processes data in batch or micro-batch patterns. It is not the store built for streaming data with subsecond latency.

C is incorrect: SQL database in Fabric is for operational transactional workloads. It is not an analytical data store for streaming time-series analysis.

D is correct.

Explanation: Window functions such as ROW_NUMBER() and SUM() OVER calculate values across related rows without collapsing the data. PARTITION BY customer_id defines the rows for each customer, and ORDER BY order_date sets the sequence within each partition. The original row count stays the same.

A is incorrect: GROUP BY collapses the detail rows into one row for each customer. The individual order rows would no longer be in the result.

B is incorrect: A pivot reshapes rows into columns for cross-tabulation, such as one column for each quarter. It does not calculate a sequence number or a running total for each order.

C is incorrect: An inner join adds columns from the customers table to matching rows and excludes rows without a match. It does not calculate a sequence number or a running total.

B is correct.

Explanation: Partition a table when it exceeds 1 TB and queries frequently filter on the partition column. For most tables under 1 TB, skip partitioning. Spark and Delta handle these table sizes efficiently without it, and partitioning can reduce performance for smaller tables.

A is incorrect: customer_id is a high-cardinality column. Partitioning on it creates too many small files, which slows queries.

C is incorrect: Year and month are common partition columns, but the table is about 300 GB. Filtering on those columns does not meet the 1 TB threshold. Each partition should also be at least 1 GB.

D is incorrect: Adding customer_id makes the partitioning high-cardinality and creates many small files. Partitioning does not target file size in the way this option assumes.

C is correct.

Explanation: The grain specifies what one row in the fact table represents. One row per sales order line item keeps the detail needed to analyze sales by individual product and customer. This grain also determines which dimension keys belong in the table, such as customer, product, date, and salesperson.

A is incorrect: A daily total is too high-level. If you store daily totals instead of order lines, you cannot later break down sales by individual products or customers.

B is incorrect: Category-by-month rows lose product-level and customer-level detail. You cannot recover that detail later from the summarized rows.

D is incorrect: A yearly row per customer removes product detail and order-level detail. It does not support the required product breakdown.

B and D are correct.

Explanation: All three analytical data stores write data to OneLake, so data does not need to be copied between them. A shortcut lets a warehouse reference Delta tables that a lakehouse manages without duplicating them. A cross-database query in the warehouse can join data from lakehouse SQL analytics endpoints by using three-part naming.

A is incorrect: A nightly pipeline copy creates a second copy of the data. The requirement is that the data is not duplicated.

C is incorrect: An eventstream routes events to destinations such as an eventhouse or a lakehouse. It does not give a warehouse access to existing lakehouse tables.

B and D are correct.

Explanation: Deselecting Enable load on a staging or reference query prevents it from loading to the destination, which reduces processing time. Filtering rows and selecting columns early means every later transformation processes less data.

A is incorrect: Row filters should be applied as the first steps in a query. Filtering last means the earlier steps process all rows.

C is incorrect: Steps marked Enable only in previews run during preview and authoring validation. They are excluded from refresh, so the filter would not reduce the data processed in production.

B and D are correct.

Explanation: A Type 2 change expires the existing current row by setting its end date and changing the current flag to FALSE. The process then inserts a new row with the new attribute values, a new surrogate key, the start date set to the change date, and the current flag set to TRUE. Each version keeps its own surrogate key, so you can report sales by the region the salesperson was assigned to at the time of each sale.

A is incorrect: Overwriting the value is a Type 1 change. It keeps no history, and all past sales then appear under the new region.

C is incorrect: Adding a column for the previous value is a Type 3 change. It tracks only the most recent change and loses intermediate changes, so it does not provide full history.

A is correct.

Explanation: A ratio is a non-additive measure and cannot be summed meaningfully across any dimension. Store the underlying values, discount amount and sales revenue, so the ratio can be computed correctly at any level of aggregation.

B is incorrect: A discount percentage is non-additive. Summing it across rows or dimensions gives results that are not meaningful.

C is incorrect: Removing the other measures does not solve the aggregation problem. A percentage alone still cannot be aggregated correctly, and the underlying values are no longer available.

D is incorrect: Attributes in a fact table, sometimes called degenerate dimensions, describe an event, such as order numbers or tracking codes. They are not a way to make a ratio aggregate correctly.

C is correct.

Explanation: A notebook reads warehouse tables by using cross-database queries with three-part naming (warehouse.schema.table). This fits reading dimension tables that a SQL team manages, and it does not require you to copy the data first.

A is incorrect: You pin a lakehouse, not a warehouse, as the default. The default lakehouse sets the Hive metastore context for Spark SQL queries on lakehouse tables.

B is incorrect: The KQL connector or Spark connector for Kusto connects to KQL databases, for example to write processed events for real-time analytics. It does not read warehouse tables.

D is incorrect: JDBC and other Spark connectors are for sources outside Fabric. The warehouse is a Fabric data store that you reach with three-part naming.

B is correct.

Explanation: A warehouse provides full read-write T-SQL capabilities. You can run INSERT and UPDATE statements in a warehouse and persist the transformation results.

A is incorrect: The SQL analytics endpoint of a lakehouse exposes Delta tables for querying and analysis only. It is read-only, so it cannot persist the results.

C is incorrect: The Visual Query Editor generates T-SQL, but it still runs against a read-only SQL analytics endpoint. The editor does not make the endpoint writable.

D is incorrect: SSMS is an external tool that connects through the T-SQL connection string. The connection method does not change the read-only behavior of the lakehouse SQL analytics endpoint.

C is correct.

Explanation: A calculated column is evaluated in row context, which is the current row of the Sales table. Because a relationship exists, the RELATED function gets the List Price value from the one-side Product table for each sales row. RELATED usually works faster than LOOKUPVALUE.

A is incorrect: LOOKUPVALUE is intended for tables that have no relationship. A relationship exists here, and RELATED usually works faster.

B is incorrect: RELATEDTABLE returns a table of values from the many-side. The formula needs a single List Price value for each row, and a calculated column formula must return a single value.

D is incorrect: A measure can't reference a column directly. It also doesn't add a column to the Sales table, and a measure is evaluated in filter context at query time.

C is correct.

Explanation: Composite mode combines storage modes in one model. You need it here because the model uses data from both Fabric and a non-Fabric source. The large fact table can stay in Direct Lake and the small external reference table can use Import. Configure the storage mode for each table and verify that the cross-source relationship performs acceptably at your expected data volumes.

A is incorrect: Direct Lake reads Delta tables from OneLake. A reference table from a third-party API outside Fabric is not a Delta table in OneLake, so Direct Lake alone does not cover this requirement.

B is incorrect: DirectQuery sends a query to the source for every report interaction. That adds query load and does not keep the fact table in Direct Lake, which the team wants.

D is incorrect: Import copies all data into the model, and the data is only as current as the last refresh. This removes the Direct Lake behavior the team wants for the fact table and requires scheduled refresh.

D is correct.

Explanation: The evidence supports D because SemPy connects to the semantic model through the XMLA endpoint. The list_relationship_violations() function finds foreign key values that have no matching primary key value. The evaluate_measure() function returns measure results that you can compare to a known value. You can run the same notebook before every deployment for automated, repeatable validation.

A is incorrect: DAX Studio is useful for interactive DAX queries and real-time feedback. It does not provide the scripted, repeatable validation that this requirement needs, and it does not check relationship violations.

B is incorrect: ALM Toolkit compares schemas between two models. It does not check data for orphaned keys or evaluate a measure against an expected value.

C is incorrect: Version control tracks changes but does not verify that the model is correct. Commit history does not show whether keys match or whether a measure returns the expected result.

A is correct.

Explanation: Implicit measures summarize column values by using a single aggregation function. They can't handle more complex calculations. A ratio of monthly sales to yearly sales requires an explicit measure that is defined with a DAX formula.

B is incorrect: The Sum default is a single aggregation function. It can't produce a month-to-year ratio, and it leaves the calculation to each report author.

C is incorrect: Don't summarize removes the sigma symbol and the default summarization. It doesn't create the ratio calculation.

D is incorrect: Average is still a single aggregation function. It returns the average of the values, not the ratio of monthly sales to yearly sales.

B is correct.

Explanation: For most production workloads, start with fallback allowed. Queries that cannot run in Direct Lake mode fall back to DirectQuery and still return results, although performance might decrease. Monitor which queries trigger fallback, then optimize those queries or data structures to reduce how often it occurs.

A is incorrect: Disallow fallback only when all query patterns stay within Direct Lake limits. The team does not know its query patterns yet, so unsupported queries would return errors to users.

C is incorrect: DirectQuery sends every report interaction to the source system. It does not provide the Direct Lake behavior the team chose, and the evidence does not show a need to leave Direct Lake.

D is incorrect: Import mode makes data only as current as the last refresh. Disabling scheduled refresh would leave the data stale. Move away from Direct Lake only when a specific scenario requires it.

D is correct.

Explanation: The evidence supports D because the VertiPaq engine uses highly efficient value encoding for numeric data and less efficient hash encoding for text. Removing the text prefix in Power Query and storing the value as a number improves compression and query performance.

A is incorrect: Removing the column entirely is not an option because users need it to filter and drill through the data.

B is incorrect: DAX calculated columns are evaluated after load and typically compress less efficiently than Power Query computed columns.

C is incorrect: Changing the data type to datetime is inappropriate for an order number and would not reduce cardinality or improve compression.

A is correct.

Explanation: Preserve a snowflake structure when multiple fact tables share a subdimension table and denormalization would create inconsistent copies. Configure each relationship in the chain with single-direction filtering from the outermost table toward the fact table. A filter on Category then flows through Subcategory and Product into the fact table.

B is incorrect: Flattening is usually the better choice, but here it would create separate copies of the shared category data for each fact table. That is the inconsistency the team wants to avoid.

C is incorrect: Bi-directional filtering should be used sparingly. It can degrade query performance and create unexpected filter behavior in reports. The standard pattern for a preserved snowflake is single-direction filtering.

D is incorrect: Removing Category would remove the attribute that both fact tables need for slicing. It does not address the shared-dimension requirement.

D is correct.

Explanation: In Direct Lake mode, the Delta tables can serve as aggregation sources. Because Direct Lake reads columnar Parquet files, the engine can handle larger data volumes without aggregations in many scenarios. Add aggregations only when query patterns confirm the need. Consider them if summary-level visuals become slow.

A is incorrect: Adding aggregations to every fact table before any need is confirmed adds structure to maintain. Users have not reported slow queries.

B is incorrect: Import mode copies data into the model and makes freshness depend on refresh. Changing the storage mode only to use aggregations is not supported by the evidence when there is no performance problem.

C is incorrect: Separate measures for each variation increase measure proliferation and do not create summary tables at a higher grain. This approach is harder to maintain at scale.

D is correct.

Explanation: A compound measure can reference other measures. The Profit measure can return the required result from Revenue and Cost. Measures are calculated at query time and don't store values in the model. After you remove the calculated column, the model no longer stores a Profit Amount value for each row, which reduces model size and refresh time. Test the change, because updates can affect dependent measures.

A is incorrect: Hiding the column doesn't remove it. In an import model, a calculated column still stores a value for each row, so storage and refresh costs remain.

B is incorrect: An implicit measure still depends on the calculated column, so the stored column values remain in the model.

C is incorrect: A calculated table increases the model's storage size and can prolong data refresh times. It doesn't address the cause of the problem.

B is correct.

Explanation: USERNAME() returns DOMAIN\username in Power BI Desktop and user@domain.com in the Power BI service. USERPRINCIPALNAME() returns user@domain.com in both environments. Use it so that testing in Desktop matches the behavior after you deploy.

A is incorrect: USERNAME() returns different formats depending on the environment, so the filter can behave differently in Desktop and in the service.

C is incorrect: Static rules do not scale. Each change requires a new role or an updated rule, and you must republish the semantic model.

D is incorrect: Object-level security hides tables and columns. It does not change how the identity function is evaluated or filter rows.

C is correct.

Explanation: The evidence states that to investigate a dependency, you follow the maintenance order through affects to the equipment, traverse requiresEquipment in reverse to find the task, and then hasTask in reverse to find the project.

A is incorrect: A vessel carrying equipment is different from a task requiring it. This path would flag tasks that do not depend on the affected equipment.

B is incorrect: This path starts from the project and does not use the maintenance order or the equipment dependency to find affected tasks.

D is incorrect: Treating all vessel equipment as required ignores the requiresEquipment relationship and can flag tasks incorrectly.

B is correct.

Explanation: Generation configures static entity bindings from the lakehouse, and it configures keys where it can determine unique identifiers. You still verify that every entity type has a key. Some relationship bindings need manual configuration to be queryable. For streaming data, you add time series bindings that connect the eventhouse data sources.

A is incorrect: Some relationship bindings require manual configuration, and time series bindings for eventhouse data are not generated.

C is incorrect: The static bindings are configured automatically and remain valid. You add time series bindings in addition to them.

D is incorrect: Import mode does not generate data bindings. Direct Lake mode is the mode that generates them automatically.

C is correct.

Explanation: Create an ontology when an entity meets two conditions: its definition is stable, and other teams need it. Customer with a stable definition and a clear owner meets both. The ontology declares one agreed definition that all semantic models align to, and each semantic model keeps its own measures, filters, and calculated columns.

A is incorrect: A date filter only makes sense inside your reports, so it stays in the semantic model.

B is incorrect: A calculated column for one report layout is a reporting detail. Other teams do not need it, so it stays in the semantic model.

D is incorrect: Other teams need Customer, but the definition and owner are not settled. If your team is still changing what an entity means or who owns the definition, it is too early to publish it. Publish only entities with stable definitions and clear owners.

D is correct.

Explanation: A relationship binding needs a source table that identifies both entity types. You select a matched column for each entity type, which is the column that matches that entity type's key. The departments table has HospitalId for the origin and DepartmentId for the target. Each row with values in both columns creates one relationship instance.

A is incorrect: The hospitals table has no column that identifies a department, so it cannot connect specific hospitals to specific departments.

B is incorrect: A relationship type without a binding is only a definition and cannot be queried.

C is incorrect: You select a matched column for each entity type. Without HospitalId, rows do not link a department to a specific hospital.

B and D are correct.

Explanation: A technical field in an answer is fixed by removing it from the AI data schema. An unknown business phrase is fixed by adding a synonym. After each fix, close and reopen the Copilot pane and ask the same question again to confirm that the fix works without breaking other answers.

A is incorrect: A verified answer is for a stable question that needs a set answer. It does not remove a technical field from the fields that Copilot considers.

C is incorrect: Approve the semantic model only after priority questions consistently use the trusted definitions. Approval without fixing and retesting the failed prompts means every Copilot experience that uses the model inherits untested behavior.

B is correct.

Explanation: The evidence states that identifying task risk still requires an explicit rule that checks whether operation-blocking maintenance overlaps the planned use of required equipment.

A is incorrect: Adding more entity types provides vocabulary but does not calculate risk or replace the need for an explicit rule.

C is incorrect: A data agent answers questions using the provided business context, but it does not remove the need for an explicit risk rule.

D is incorrect: A relationship describes how concepts connect, but it does not check maintenance status, blocking, or schedule overlap.

A is correct.

Explanation: The evidence states that when you create an ontology item, a managed graph is automatically created from your ontology's entity types and relationships. You query it using GQL, and Graph in Microsoft Fabric operates directly on OneLake without requiring data duplication or ETL.

B is incorrect: An operations agent monitors real-time data and recommends or triggers actions based on rules, rather than providing a GQL query interface.

C is incorrect: Planning enables collaborative planning, forecasting, and reporting, rather than traversing relationships with GQL.

D is incorrect: A data agent answers natural language questions and generates SQL, DAX, or KQL, not GQL queries that you write.

D is correct.

Explanation: Names help Copilot find possible fields, and descriptions help Copilot choose the right field. A column description states what the value means and which scope applies. A description that says Customer City is the customer's location and Store City is the store's location tells Copilot to use Customer City for customer location questions.

A is incorrect: Synonyms are for different words that users use for a clear field. Mapping "customer location" to Store City would point Copilot to the wrong field and does not fix unclear design.

B is incorrect: Hiding Customer City removes the field that the question needs. Hide technical fields that do not help answer the question, and keep the business fields visible.

C is incorrect: dim_customer_v2 describes how the table is built. Table names should use business terms, such as Customer, so that Copilot can follow the business path for the question.

D is correct.

Explanation: The evidence states that an ontology complements a semantic model rather than replacing it. You can generate an initial ontology from an existing semantic model, which creates entity types, properties, and relationship types, and then refine it by verifying keys and bindings.

A is incorrect: An ontology complements a semantic model and does not replace it for trusted metrics and reporting.

B is incorrect: Fabric IQ references data in place and does not move or duplicate it.

C is incorrect: Building from OneLake data is for cases where no semantic model exists or where you want full control over the design. A semantic model is a supported starting point.

A and C are correct.

Explanation: The static binding creates the equipment entities, and the time series binding attaches readings to them. The system uses EquipmentId from the static binding to match each reading to the correct equipment entity. The time series binding requires a timestamp column. In it, EquipmentId is the static linking property, and HeartRate and OxygenSaturation are the Timeseries properties.

B is incorrect: Time series data needs existing entities to attach to. Without the static binding, the system has no entity to attach readings to.

D is incorrect: Each entity type supports exactly one static data binding. Eventhouse readings are added through a time series binding.

D is correct.

Explanation: Fabric admins see tenant-wide insights that refresh daily from admin monitoring storage. A short delay can occur between a change and when it appears in the Govern section.

A is incorrect: Fabric admins see tenant-wide insights. Data owners see insights scoped to the items they own.

B is incorrect: Items without descriptions are one of the governance gaps the Govern section highlights. Endorsement is not required before descriptions are reflected.

C is incorrect: You can filter both views by domain to focus on a business area. Filtering is optional and does not control when insights refresh.

B is correct.

Explanation: The Secure section shows which users and groups have access to each workspace and at what level. OneLake security roles control access to specific tables and folders within items. Role management lets you audit user access and create, edit, or delete security roles from one place.

A is incorrect: The Govern section reports on governance posture such as label coverage, endorsement status, and data freshness. It does not manage access.

C is incorrect: Endorsement signals trust. It does not control who can open or use the data.

D is incorrect: A description helps consumers evaluate an item in the catalog. It does not change workspace roles or access to tables and folders.

B and D are correct.

Explanation: Tags categorize individual items by grouping such as refresh frequency, and consumers can search and filter by tags in the catalog. Domains group workspaces by business area, and Fabric admins create domains and assign workspaces to them.

A is incorrect: Endorsement signals trust. It does not categorize items by refresh frequency.

C is incorrect: Master data endorsement applies only to items that contain data, so it cannot be applied to a dashboard. It also signals an authoritative source, not a business area grouping.

A is correct.

Explanation: Column-level security uses GRANT and DENY. You grant SELECT on the table, then deny SELECT on the sensitive column to roles that shouldn't see it. Users in those roles can read the rest of the table and receive an error if they select the restricted column.

B is incorrect: Dynamic data masking returns a masked value. It does not produce a permission error, and masked users can still query the column.

C is incorrect: A filter predicate and security policy implement row-level security. They filter rows, not columns.

D is incorrect: Denying SELECT on the whole table blocks the other columns that receptionists must read.

A is correct.

Explanation: Promoted means an item is tested and ready for team-level use. Any user with write permissions can apply it, so the analyst does not need to be an authorized reviewer.

B is incorrect: Certified means the item meets organizational quality standards. Only authorized reviewers can apply it.

C is incorrect: Master data marks the authoritative source for core data. Only authorized reviewers can apply it, and it applies only to data items.

D is incorrect: Power BI dashboards cannot be promoted or certified. The endorsement must be applied to an eligible item such as the semantic model.

D is correct.

Explanation: An application that reads data through stored procedures needs EXECUTE permission on those procedures, not SELECT on the underlying tables. Granting EXECUTE and denying direct table access enforces a controlled data access pattern.

A is incorrect: Granting SELECT on dbo.Sales gives the application direct table access that it does not need.

B is incorrect: CONTROL gives full ownership-level rights over the procedure. The application only needs to run it.

C is incorrect: SELECT on all tables is broad access. Least privilege limits the impact if a credential is compromised or a user runs a destructive query.

C is correct.

Explanation: Sensitivity labels require configuration by your organization's security team. Until that is done, you can make sensitivity visible by using clear item descriptions, workspace naming conventions, and tags. These methods do not enforce access controls, but they give consumers information about the data.

A is incorrect: You cannot apply a label that the security team has not configured. Labels can enforce access restrictions only after they are set up.

B is incorrect: Endorsement signals that an item is trusted. It does not describe sensitivity.

D is incorrect: Viewer access can still allow users to export data to Excel. It does not make sensitivity visible to consumers.

B and D are correct.

Explanation: Read all SQL endpoint data lets the recipient read data from the SQL analytics endpoint by using T-SQL. Build reports on the default semantic model lets the recipient create Power BI reports on that model. Together they cover both requirements.

A is incorrect: Read permission is always granted when you share a lakehouse. It lets the recipient see item metadata and view associated reports, but it does not grant access to underlying data in SQL or OneLake.

C is incorrect: This permission gives access to lakehouse data through Apache Spark and OneLake APIs, which the analyst does not use. It also adds the recipient to the DefaultReader OneLake security role, which gives read access to all data.

C is correct.

Explanation: Item permissions let you share a specific item and choose what the recipient can do. After you remove the Contributor role, the engineer can view and query only that lakehouse and nothing else in the workspace.

A is incorrect: The Contributor role would stay in place. It applies to every item in the workspace, not only the lakehouse.

B is incorrect: The Admin role grants more access than the Contributor role. It applies to all content in the workspace and includes permission management.

D is incorrect: A workspace role applies to all items in the workspace. The Viewer role also gives no access to the underlying OneLake data by default, so it does not meet the requirement to read lakehouse data.

B and D are correct.

Explanation: Row-level security is vulnerable to side-channel attacks, where a crafted query reveals filtered values through signals such as errors. To reduce the risk, combine row-level security with column-level security and dynamic data masking. Also restrict ALTER ANY SECURITY POLICY to trusted users and monitor security policy changes.

A is incorrect: The SQL engine enforces the predicate for every query, but side-channel queries can still reveal values. You need additional controls.

C is incorrect: Granting ALTER ANY SECURITY POLICY broadly lets more users change security policies. You should restrict this permission to trusted users.