Q01 - Question
You share a lakehouse with a data scientist and grant only the Read permission. The data scientist has no workspace role. The data scientist must read lakehouse data from Spark notebooks and through OneLake APIs. Which additional permission should you grant when you share the lakehouse?
Domain: Implement and manage an analytics solution (30–35%) Type: Single choice
- A. Build reports on the default semantic model
- B. Read all SQL endpoint data
- C. The Viewer workspace role
- D. Read all Apache Spark and subscribe to events
D is correct.
Explanation: The Read permission lets the recipient see item metadata and view associated reports. It does not grant access to underlying data in SQL or OneLake. Read all Apache Spark and subscribe to events lets the recipient read lakehouse data through Apache Spark and OneLake APIs. This permission grants access to all data in the lakehouse by default and adds the recipient to the DefaultReader OneLake security role.
A is incorrect: This permission lets the user create Power BI reports on the default semantic model. It does not give access to data through Spark or OneLake APIs.
B is incorrect: This permission lets the user read data from the SQL analytics endpoint by using T-SQL. It does not cover Spark or OneLake API access.
C is incorrect: Viewers have no access to the underlying data stored in OneLake by default. The role also applies to the whole workspace, not one lakehouse.
Q02 - Question
A shared development workspace is connected to the main branch in a Git repository. You develop in the Fabric web interface. You must build a new feature without affecting other workspace users or the main branch. What should you do?
Domain: Implement and manage an analytics solution (30–35%) Type: Single choice
- A. Edit the items directly in the shared workspace, and commit the changes to the main branch.
- B. Disconnect the shared workspace from Git, and edit the items without a branch.
- C. In the development workspace, select Source control and Branch out to new workspace. Make and commit your changes in the new workspace, and then create a pull request to the main branch.
- D. Use a deployment pipeline to copy the shared workspace content to another stage, and edit the items there.
C is correct.
Explanation: Branching out to a new workspace creates an isolated branch that syncs with the new workspace. You commit your changes to that branch and create a pull request in Git to merge them into the main branch. After the merge, the shared development workspace prompts you to synchronize the new content.
A is incorrect: Changes made directly in a shared workspace override and affect all other workspace users. Feature work should be in a dedicated branch instead of the main branch.
B is incorrect: Disconnecting from Git removes version control for the changes. An isolated workspace connected to its own branch keeps the work separate and tracked.
D is incorrect: Deployment pipelines promote content between stages such as development, test, and production. They do not create an isolated branch for feature development.
Q03 - Question
You shared a lakehouse with a user and granted the Read all Apache Spark and subscribe to events permission. You then created a custom OneLake security role that grants Read access to two patient tables and added the user to it. The user can still read every table in the lakehouse through Spark. What should you do to restrict the user to the two tables?
Domain: Implement and manage an analytics solution (30–35%) Type: Single choice
- A. Remove the user from the DefaultReader role.
- B. Change the custom role permission from Read to ReadWrite.
- C. Add a row filter constraint to the custom role.
- D. Assign the user the Viewer workspace role.
A is correct.
Explanation: Sharing a lakehouse with the Read all Apache Spark and subscribe to events permission adds the recipient to the DefaultReader role, which grants read access to all data. When you restrict a user to a custom role, also remove the user from DefaultReader. Otherwise the user keeps full read access through the default role.
B is incorrect: ReadWrite lets users view and edit data in specific tables or folders. It does not remove the read access that DefaultReader grants.
C is incorrect: A row filter is an optional constraint on the data in the custom role. It does not change the access that the user has through DefaultReader.
D is incorrect: Viewers have no OneLake data access by default, but the user already has access through DefaultReader. Assigning the Viewer role does not remove that membership.
Q04 - Question
You build an automated process for a workspace that is connected to a Git branch. Before the process runs, it must determine which items have incoming changes and which items have changes that were not committed to Git. Which Fabric CI/CD REST API capability should the process use?
Domain: Implement and manage an analytics solution (30–35%) Type: Single choice
- A. The Git status API
- B. List Deployment Pipeline Stage Items
- C. Deploy Stage Content
- D. The API that updates the workspace with commits pushed to the connected branch
A is correct.
Explanation: The Git status API shows which items have incoming changes and which items have changes that were not yet committed to Git. Use it to check the state before you start other automated steps.
B is incorrect: List Deployment Pipeline Stage Items returns the supported items from the workspace assigned to a stage of a deployment pipeline. It is a deployment pipeline API, not a Git status check.
C is incorrect: Deploy Stage Content deploys items from a stage of a deployment pipeline. It performs a deployment and does not report Git state.
D is incorrect: This API updates the workspace with commits from the connected branch. It applies changes and does not report which items differ.
Q05 - Question
A user has the Viewer workspace role. The user must view and edit data in two specific lakehouse tables without receiving a workspace write role. Which two actions should you take? Select two.
Domain: Implement and manage an analytics solution (30–35%) Type: Multiple choice
- A. Assign the user the Contributor workspace role.
- B. Have a workspace Admin or Member create a OneLake security role with ReadWrite permission on the two tables.
- C. Have a user with the Contributor workspace role create the OneLake security role.
- D. Add the user as a member of the OneLake security role.
B and D are correct.
Explanation: The ReadWrite permission in a OneLake security role lets users view and edit data in specific tables or folders without a workspace write role. Only workspace Admin and Member roles can create or modify OneLake security roles. The user must also be assigned to the role as a member to receive the access.
A is incorrect: Contributor gives full read and write access to all OneLake data. It is not limited to two tables and uses a workspace write role.
C is incorrect: Only workspace Admin and Member roles can create or modify OneLake security roles. A Contributor cannot create the role.
Q06 - Question
A data engineer has the Contributor workspace role. The engineer no longer creates Fabric items and now only reads data from one lakehouse by using T-SQL through the SQL analytics endpoint. You must follow the principle of least privilege. What should you do?
Domain: Implement and manage an analytics solution (30–35%) Type: Single choice
- A. Keep the Contributor role and ask the engineer not to create items.
- B. Change the engineer to the Viewer workspace role.
- C. Remove the engineer from the Contributor role, and share the lakehouse with the Read all SQL endpoint data permission.
- D. Change the engineer to the Member workspace role.
C is correct.
Explanation: Item permissions let you share one lakehouse instead of granting workspace-wide access. The Read all SQL endpoint data permission lets the engineer read data from the SQL analytics endpoint by using T-SQL. The engineer can then view and query that lakehouse and nothing else in the workspace.
A is incorrect: The Contributor role applies to every item in the workspace. Asking the engineer not to create items does not remove that access.
B is incorrect: Viewers can see Fabric items listed in the workspace, but they have no access to the underlying data in OneLake by default. The Viewer role also applies at the workspace level.
D is incorrect: The Member role can create, view, modify, and share all content and data in the workspace. It gives more access than the Contributor role.
Q07 - Question
You develop Fabric notebooks in VS Code. A development workspace is already connected to the main branch of a Git repository. You must keep your work isolated from the shared workspace and test it in Fabric before merging. Which two actions should you perform? Select two.
Domain: Implement and manage an analytics solution (30–35%) Type: Multi-select
- A. Clone the repository on your local machine.
- B. Edit the notebooks in the shared workspace that is associated with the main branch.
- C. Disable Git integration for the development workspace.
- D. Push your changes to the remote repository, and test them by connecting your isolated branch to a separate workspace.
A and D are correct.
Explanation: When you use client tools, you clone the repository on your local machine and work in your own branch. When you are ready to test in Fabric, you push the changes to the remote repository and connect your isolated branch to a separate workspace. You then issue a pull request in Git to merge the changes into the main branch.
B is incorrect: Editing in the shared workspace affects all other workspace users. Development work should stay outside shared workspaces.
C is incorrect: Disabling Git integration removes the sync between the workspace and the repository. The development workspace stays connected to the main branch so that merged changes can be synchronized.
Q08 - Question
A team uses Development, Test, and Production workspaces. They need version control while they develop, and they need to promote content to Test and Production. They want to avoid potential Git synchronization conflicts when content is deployed across stages. Which configuration should you implement?
Domain: Implement and manage an analytics solution (30–35%) Type: Single choice
- A. Connect all three workspaces to the same Git branch, and synchronize each workspace after every change.
- B. Connect only the Test and Production workspaces to Git, and develop directly in Test.
- C. Do not use Git, and rely on the deployment pipeline to track code history.
- D. Connect only the Development workspace to Git, and use a deployment pipeline with a workspace assigned to each stage to promote content to Test and Production.
D is correct.
Explanation: You can connect only the Development workspace to a Git repository and branch. Git integration provides version control during development. The deployment pipeline then copies content from Development to Test and Production, which avoids potential Git synchronization conflicts across multiple stages.
A is incorrect: Connecting every stage to Git is the situation that can cause Git synchronization conflicts when content is deployed across stages.
B is incorrect: This configuration places version control on the pre-production and production stages instead of the development stage. Content changes should be made in the Development workspace and committed to Git.
C is incorrect: Deployment pipelines move content between stages. Git provides version control and code history, so a pipeline does not replace it.
Q09 - Question
A healthcare company stores patient data in a Fabric lakehouse. An analyst needs access to the lakehouse but must see only specific folders. The restriction must apply the same way when the analyst uses Spark, SQL, or OneLake APIs. Which approach should you use?
Domain: Implement and manage an analytics solution (30–35%) Type: Single choice
- A. Assign the analyst the Contributor workspace role.
- B. Create a OneLake security role that grants access to the specific folders.
- C. Share the lakehouse with the analyst and grant only the Read item permission.
- D. Configure T-SQL permissions on the SQL analytics endpoint.
B is correct.
Explanation: The evidence states that OneLake security adds control within an item by using security roles that grant access to specific tables or folders. These restrictions apply consistently across Spark, SQL, and OneLake APIs.
A is incorrect: A workspace role applies to all items in the workspace. The Contributor role gives broad access, not access limited to specific folders.
C is incorrect: Sharing an item gives access at the item level. Read permission alone does not grant access to specific folders, and it does not create a folder-level restriction.
D is incorrect: T-SQL permissions are compute permissions for the SQL analytics endpoint only. They do not restrict access that uses Spark or OneLake APIs.
Q10 - Question
Several developers each maintain a separate branch on their local machines for Fabric items. They merge to the main codebase only after their work is finished. Conflicts and bugs are found late and slow down releases. You need to reduce late-found conflicts. What should you do?
Domain: Implement and manage an analytics solution (30–35%) Type: Single choice
- A. Extend the time that developers work on separate branches so that each branch contains more finished work before the merge.
- B. Commit code frequently to a shared branch, and validate each merge with a build process and automated testing.
- C. Deploy each developer's changes directly to production so that conflicts appear in the live environment.
- D. Stop using version control, and make changes directly in one shared workspace.
B is correct.
Explanation: In continuous integration (CI), you commit code frequently to a shared branch or trunk. After the merge, a build process and automated testing validate the changes. Conflicts between new and existing code are identified earlier and are easier and faster to fix.
A is incorrect: Working on separate branches for longer periods increases the likelihood of conflicts and bugs that are found only in later stages.
C is incorrect: Deploying unvalidated changes to production does not detect conflicts early. Continuous delivery follows CI and deploys to a staging environment for more automated testing before production.
D is incorrect: Without version control, you cannot track revisions or revert to a prior version. Changes made directly in a shared workspace also affect all other workspace users.