Q01 - Question
A Fabric administrator must enable Microsoft Fabric for a pilot team only, not for the whole organization. The administrator also wants other users to be able to manage this setting for their own capacity. Which two actions should the administrator take? Select two.
Domain: Maintain a data analytics solution (25–30%) Type: Multi-select
- A. Change the license type in each workspace's settings to enable Fabric for the tenant.
- B. Enable Fabric in Admin portal > Tenant settings for a specific Microsoft Entra security group.
- C. Use the Copilot tenant setting to enable Fabric for the pilot team.
- D. Delegate the ability to enable Fabric to other users at the capacity level.
B and D are correct.
Explanation: Admins can enable Fabric in the Admin portal > Tenant settings in the Power BI service. They can enable it for the entire organization or for specific Microsoft 365 or Microsoft Entra security groups. Admins can also delegate this ability to other users at the capacity level.
A is incorrect: License type is a workspace setting that lets you use Fabric features in that workspace. It does not enable Fabric for the tenant.
C is incorrect: The Copilot tenant setting controls Copilot in Fabric. It does not enable Fabric for a group.
Q02 - Question
Before every deployment, your team must automatically check a published semantic model for orphaned foreign keys and confirm that the Total Revenue measure returns a known value for 2024. The check must run the same way each time. The XMLA endpoint is enabled for the workspace. Which approach should you use?
Domain: Maintain a data analytics solution (25–30%) Type: Single choice
- A. Use DAX Studio to write and run the queries interactively before each deployment.
- B. Use ALM Toolkit to compare the schemas of the development and production models.
- C. Review the Git commit history of the semantic model for relationship changes.
- D. Use SemPy in a Fabric notebook to call list_relationship_violations() and evaluate_measure(), and assert the expected value in Python.
D is correct.
Explanation: The evidence supports D because SemPy connects to the semantic model through the XMLA endpoint. The list_relationship_violations() function finds foreign key values that have no matching primary key value. The evaluate_measure() function returns measure results that you can compare to a known value. You can run the same notebook before every deployment for automated, repeatable validation.
A is incorrect: DAX Studio is useful for interactive DAX queries and real-time feedback. It does not provide the scripted, repeatable validation that this requirement needs, and it does not check relationship violations.
B is incorrect: ALM Toolkit compares schemas between two models. It does not check data for orphaned keys or evaluate a measure against an expected value.
C is incorrect: Version control tracks changes but does not verify that the model is correct. Commit history does not show whether keys match or whether a measure returns the expected result.
Q03 - Question
A production semantic model depends on lakehouse data that is transformed before the model refreshes. You need the model refresh to be skipped, with an alert sent, if the lakehouse refresh fails. You also need to investigate why recent refreshes are gradually taking longer. Which two actions should you take?
Domain: Maintain a data analytics solution (25–30%) Type: Multiple choice
- A. Schedule the semantic model refresh for a fixed later time and rely on the lakehouse refresh finishing first.
- B. Use a Data Factory pipeline that runs a semantic model refresh activity after the upstream steps succeed, with conditional logic to skip the refresh and send an alert on failure.
- C. Use lineage view to review the duration history of each refresh.
- D. Use the Monitoring Hub or the refresh history in the model settings to compare recent refresh durations to historical averages.
B and D are correct.
Explanation: The evidence supports B and D because a Data Factory pipeline enforces a sequential order, so the semantic model refresh starts only after upstream steps succeed. Conditional logic can skip the refresh and send an alert when the lakehouse refresh fails. The Monitoring Hub and the refresh history show status, duration, and type for each refresh. Comparing recent durations to historical averages helps you find a gradual slowdown, which can indicate growing data volumes or an inefficient query.
A is incorrect: A fixed schedule relies on timing alone. It does not stop the model from refreshing against incomplete data if the upstream load takes longer than expected, and it cannot skip the refresh or send an alert on failure.
C is incorrect: Lineage view is a visual map of data flow from sources through semantic models to reports. You use the Monitoring Hub or the model refresh history to review refresh durations.
Q04 - Question
You share a Fabric lakehouse with a business analyst. The analyst must query lakehouse data from the SQL analytics endpoint by using T-SQL and must create Power BI reports on the default semantic model. The analyst does not use Spark or OneLake APIs. Which two permissions should you grant? Select two.
Domain: Maintain a data analytics solution (25–30%) Type: Multi-select
- A. Read permission only
- B. Read all SQL endpoint data
- C. Read all Apache Spark and subscribe to events
- D. Build reports on the default semantic model
B and D are correct.
Explanation: Read all SQL endpoint data lets the recipient read data from the SQL analytics endpoint by using T-SQL. Build reports on the default semantic model lets the recipient create Power BI reports on that model. Together they cover both requirements.
A is incorrect: Read permission is always granted when you share a lakehouse. It lets the recipient see item metadata and view associated reports, but it does not grant access to underlying data in SQL or OneLake.
C is incorrect: This permission gives access to lakehouse data through Apache Spark and OneLake APIs, which the analyst does not use. It also adds the recipient to the DefaultReader OneLake security role, which gives read access to all data.
Q05 - Question
A lakehouse in your workspace contains employee salary data. Your organization's security team has not yet configured sensitivity labels. You need to make the sensitivity of the lakehouse visible to consumers now. What should you do?
Domain: Maintain a data analytics solution (25–30%) Type: Single choice
- A. Apply a Highly Confidential sensitivity label to the lakehouse to enforce access restrictions.
- B. Apply Certified endorsement to the lakehouse to show that it contains sensitive data.
- C. Add a clear item description, follow a workspace naming convention, and apply tags that indicate sensitivity.
- D. Rely on the Viewer role to prevent users from exporting the data.
C is correct.
Explanation: Sensitivity labels require configuration by your organization's security team. Until that is done, you can make sensitivity visible by using clear item descriptions, workspace naming conventions, and tags. These methods do not enforce access controls, but they give consumers information about the data.
A is incorrect: You cannot apply a label that the security team has not configured. Labels can enforce access restrictions only after they are set up.
B is incorrect: Endorsement signals that an item is trusted. It does not describe sensitivity.
D is incorrect: Viewer access can still allow users to export data to Excel. It does not make sensitivity visible to consumers.
Q06 - Question
A semantic model uses a star schema. A Region dimension table relates to a State dimension table, and State relates to a large Sales fact table. You need to create a role that limits the Midwest sales team to Midwest data. You want the filter to propagate through the model and to keep query performance high. Which approach should you use?
Domain: Maintain a data analytics solution (25–30%) Type: Single choice
- A. Create a filter on the Sales fact table that uses LOOKUPVALUE to find the region for each sales row.
- B. Create a static filter expression directly on the Sales fact table.
- C. Create a filter expression on the Region dimension table and rely on the model relationships to filter State and Sales.
- D. Create a role that applies the expression FALSE() to the Region table.
C is correct.
Explanation: When you filter the Region table, Power BI uses the model relationships to filter State and then Sales. You write the filter once on a dimension table. Dimension tables typically contain far fewer rows than fact tables, so this approach is more efficient than filtering the fact table directly.
A is incorrect: LOOKUPVALUE adds complexity to the filter expression. Use model relationships to propagate filters instead.
B is incorrect: Filtering the fact table directly is less efficient than filtering a dimension table. A static expression also requires a rule update for each new partition.
D is incorrect: FALSE() blocks access to all rows in the table. Users in the role would not see any Region rows, so Midwest data would not be visible either.
Q07 - Question
A governance lead is documenting how endorsement works for items in the OneLake catalog. Which two statements are correct? (Select two.)
Domain: Maintain a data analytics solution (25–30%) Type: Multi-select
- A. Any user with write permissions can apply the Promoted endorsement to an item.
- B. Any user with write permissions can apply the Certified endorsement to an item.
- C. The Certified endorsement indicates that an item meets organizational quality standards and is applied only by authorized reviewers.
- D. Any user with write permissions can apply the Master data endorsement to a data item.
A and C are correct.
Explanation: Promoted means an item is ready for others to use, and any user with write permissions can apply it. Certified means an item meets organizational quality standards, and only authorized reviewers can apply it.
B is incorrect: Certified is restricted to authorized reviewers. Write permission alone does not allow a user to apply it.
D is incorrect: Master data identifies an authoritative source for core business data. Only authorized reviewers can apply it, and it applies to data items only.
Q08 - Question
You must share one Fabric warehouse with a downstream analyst. The analyst must connect by using the SQL analytics endpoint and read data from any table or view in the warehouse. The analyst must not receive access to the entire workspace or to raw parquet files in OneLake. Which two item permissions should you grant? Select two.
Domain: Maintain a data analytics solution (25–30%) Type: Multi-select
- A. Read
- B. ReadAll
- C. ReadData
- D. Workspace Admin role
A and C are correct.
Explanation: Read allows the user to connect by using the SQL analytics endpoint. A connection fails without at least Read permission. ReadData allows the user to read data from any table or view in the warehouse. Item permissions share an individual warehouse without granting access to the entire workspace.
B is incorrect: ReadAll allows the user to read raw parquet files in OneLake. The requirements exclude that access.
D is incorrect: The Admin role gives full control at the workspace level. It grants more access than the analyst needs, and item permissions are the way to share a single warehouse.
Q09 - Question
A shared Sales table in a Fabric warehouse uses row-level security so that each salesperson sees only their own rows. A security review finds that a user could write a crafted query that forces a divide-by-zero error to reveal values in filtered rows. Which two actions reduce this risk? Select two.
Domain: Maintain a data analytics solution (25–30%) Type: Multi-select
- A. Rely on the filter predicate alone, because the SQL engine enforces it for every query.
- B. Combine row-level security with column-level security and dynamic data masking.
- C. Grant ALTER ANY SECURITY POLICY to all users who query the table.
- D. Restrict ALTER ANY SECURITY POLICY to trusted users and monitor security policy changes.
B and D are correct.
Explanation: Row-level security is vulnerable to side-channel attacks, where a crafted query reveals filtered values through signals such as errors. To reduce the risk, combine row-level security with column-level security and dynamic data masking. Also restrict ALTER ANY SECURITY POLICY to trusted users and monitor security policy changes.
A is incorrect: The SQL engine enforces the predicate for every query, but side-channel queries can still reveal values. You need additional controls.
C is incorrect: Granting ALTER ANY SECURITY POLICY broadly lets more users change security policies. You should restrict this permission to trusted users.
Q10 - Question
An organization uses the same regional RLS roles in several semantic models. Network administrators must be able to change who belongs to each regional team without having access to Power BI. A change in team membership must update data access in every semantic model that uses the team. Which approach should you use to assign role membership?
Domain: Maintain a data analytics solution (25–30%) Type: Single choice
- A. Add a Microsoft Entra security group for each regional team to the role.
- B. Add each user individually to the role in each semantic model.
- C. Add a Microsoft 365 group for each regional team to the role.
- D. Give the network administrators the Admin role in the workspace so they can edit role membership.
A is correct.
Explanation: Microsoft Entra security groups let administrators manage group membership without access to Power BI. Adding or removing a user from the group updates that user's data access across all semantic models that reference the group. One group assignment also replaces many individual mappings.
B is incorrect: Individual assignments create many more mappings to maintain, and you must update each semantic model when team membership changes.
C is incorrect: Microsoft 365 groups aren't supported for role membership. Use Microsoft Entra security groups instead.
D is incorrect: Users with the Admin, Member, or Contributor role have edit permissions and bypass RLS. Don't grant these roles to users who should be subject to data-level security.