Exam Bundle

Consumers can read approved reports but cannot update or delete workspace items. That check would be meaningful for the separate case: A shared workspace gives every user Member privileges even though most should only read published reports. It would not directly verify this scenario's selected implementation: Define dynamic RLS using the signed-in user mapping and appropriate model relationships.

An unauthorized user cannot query the protected salary field through the model. That check would be meaningful for the separate case: A report contains salary columns that viewers should never access, not merely rows from other regions. It would not directly verify this scenario's selected implementation: Define dynamic RLS using the signed-in user mapping and appropriate model relationships.

The employee has access only after an authorized permission grant, with an audit trail. That check would be meaningful for the separate case: An analyst shares a report with a new employee through a link that bypasses normal review workflow. It would not directly verify this scenario's selected implementation: Define dynamic RLS using the signed-in user mapping and appropriate model relationships.

Using 'Update the group or item access assignments to remove no-longer-required permissions' supports the result 'A role review shows the former department's confidential content is inaccessible'. It does not implement 'Add approved users or security groups to the published RLS role in the Power BI service' or prove 'A West role member sees West records and an unassigned viewer does not inherit the role' for this question.

'Grant appropriate Build access while withholding editing permissions' is validated when 'The employee creates a connected report but cannot change the underlying model schema'. It does not demonstrate 'A West role member sees West records and an unassigned viewer does not inherit the role', which requires 'Add approved users or security groups to the published RLS role in the Power BI service'.

A successful 'Ensure the RLS filter has an effective supported relationship path to the fact table' would show 'A role test shows fact rows restricted to the assigned countries'. This case needs 'Add approved users or security groups to the published RLS role in the Power BI service' and evidence that 'A West role member sees West records and an unassigned viewer does not inherit the role', not the other outcome.

A role test shows fact rows restricted to the assigned countries. That check would be meaningful for the separate case: A published RLS role filters the Country dimension but the relationship to Sales is inactive. It would not directly verify this scenario's selected implementation: Add approved users or security groups to the published RLS role in the Power BI service.

A role review shows the former department's confidential content is inaccessible. That check would be meaningful for the separate case: An employee changes departments but retains access through an old security group. It would not directly verify this scenario's selected implementation: Add approved users or security groups to the published RLS role in the Power BI service.

The employee creates a connected report but cannot change the underlying model schema. That check would be meaningful for the separate case: A company wants employees to reuse a governed dataset in their own reports but not edit its data model. It would not directly verify this scenario's selected implementation: Add approved users or security groups to the published RLS role in the Power BI service.

The check for 'Inspect relationship topology and supported security filter direction before relying on the rule' is 'RLS tests across roles produce only permitted rows with no unexpected alternate filter path'. That does not establish 'A test Viewer obeys RLS and privileged editing roles are not incorrectly treated as RLS-restricted'; the stated requirement calls for 'Use Viewer access for users whose data must be restricted by model RLS rather than Contributor'.

'Review and grant the required report and semantic model permissions together' addresses the mechanism measured by 'The authorized user opens the report without being given broader workspace editing rights'. The current outcome is 'A test Viewer obeys RLS and privileged editing roles are not incorrectly treated as RLS-restricted' after 'Use Viewer access for users whose data must be restricted by model RLS rather than Contributor', which the distractor leaves unverified.

'The test result matches the row counts expected for that role, independent of the developer's privileges' would demonstrate 'Use View as role or Test as role tools with an appropriate test identity', but not 'A test Viewer obeys RLS and privileged editing roles are not incorrectly treated as RLS-restricted'. The latter requires 'Use Viewer access for users whose data must be restricted by model RLS rather than Contributor' in this scenario.

RLS tests across roles produce only permitted rows with no unexpected alternate filter path. That check would be meaningful for the separate case: A sales model has an RLS rule for Region but a separate relationship uses Both and can cause unexpected security propagation. It would not directly verify this scenario's selected implementation: Use Viewer access for users whose data must be restricted by model RLS rather than Contributor.

The authorized user opens the report without being given broader workspace editing rights. That check would be meaningful for the separate case: A user can open a report link but Power BI denies access to its underlying semantic model. It would not directly verify this scenario's selected implementation: Use Viewer access for users whose data must be restricted by model RLS rather than Contributor.

The test result matches the row counts expected for that role, independent of the developer's privileges. That check would be meaningful for the separate case: A developer wants to test RLS but only inspects their own unrestricted workspace editing view. It would not directly verify this scenario's selected implementation: Use Viewer access for users whose data must be restricted by model RLS rather than Contributor.

Using 'Assign appropriate Contributor rather than Admin or Member privileges' supports the result 'The designer edits allowed artifacts but cannot alter workspace security membership'. It does not implement 'Use item permissions and supported object-level protections or remove sensitive columns from exposed models' or prove 'An unauthorized user cannot query the protected salary field through the model' for this question.

'Apply the approved Microsoft Purview sensitivity label to the appropriate item' is validated when 'The Power BI item displays the mandated classification label under tenant policy'. It does not demonstrate 'An unauthorized user cannot query the protected salary field through the model', which requires 'Use item permissions and supported object-level protections or remove sensitive columns from exposed models'.

A successful 'Normalize account mapping and use stable identity comparison in a validated dynamic role' would show 'Email casing variations do not cause accidental overexposure or missing authorized rows'. This case needs 'Use item permissions and supported object-level protections or remove sensitive columns from exposed models' and evidence that 'An unauthorized user cannot query the protected salary field through the model', not the other outcome.

The designer edits allowed artifacts but cannot alter workspace security membership. That check would be meaningful for the separate case: A workspace admin needs to allow a report designer to contribute visuals but not change membership settings. It would not directly verify this scenario's selected implementation: Use item permissions and supported object-level protections or remove sensitive columns from exposed models.

The Power BI item displays the mandated classification label under tenant policy. That check would be meaningful for the separate case: A report has confidential payroll figures and the compliance team requires classification markings. It would not directly verify this scenario's selected implementation: Use item permissions and supported object-level protections or remove sensitive columns from exposed models.

Email casing variations do not cause accidental overexposure or missing authorized rows. That check would be meaningful for the separate case: A model's RLS filters on a free-text email field where capitalization differs across source records. It would not directly verify this scenario's selected implementation: Use item permissions and supported object-level protections or remove sensitive columns from exposed models.

Read-only report access intentionally withholds Build permission, so a contractor cannot reuse the semantic model. This employee is explicitly expected to create a connected report while remaining unable to edit the model schema; grant the appropriate Build right without Edit.

'Apply appropriate export controls and least-privilege item access' addresses the mechanism measured by 'A viewer sees approved aggregates without exporting protected transaction details'. The current outcome is 'The employee creates a connected report but cannot change the underlying model schema' after 'Grant appropriate Build access while withholding editing permissions', which the distractor leaves unverified.

'Consumers can read approved reports but cannot update or delete workspace items' would demonstrate 'Reduce consumer access to Viewer or app audience roles while keeping editor roles for maintainers', but not 'The employee creates a connected report but cannot change the underlying model schema'. The latter requires 'Grant appropriate Build access while withholding editing permissions' in this scenario.

The contractor views the report but cannot create a new report from the underlying model. That check would be meaningful for the separate case: A contractor should read a shared report but must not reuse the semantic model to build other content. It would not directly verify this scenario's selected implementation: Grant appropriate Build access while withholding editing permissions.

A viewer sees approved aggregates without exporting protected transaction details. That check would be meaningful for the separate case: A finance model grants report viewers an unrestricted export of detailed transaction rows that are not needed. It would not directly verify this scenario's selected implementation: Grant appropriate Build access while withholding editing permissions.

Consumers can read approved reports but cannot update or delete workspace items. That check would be meaningful for the separate case: A shared workspace gives every user Member privileges even though most should only read published reports. It would not directly verify this scenario's selected implementation: Grant appropriate Build access while withholding editing permissions.

Using 'Use a supported Entra security group or mail-enabled group type for RLS membership' supports the result 'The supported group is accepted and each member receives the intended RLS filter'. It does not implement 'Review and grant the required report and semantic model permissions together' or prove 'The authorized user opens the report without being given broader workspace editing rights' for this question.

'Use approved sharing permissions and security group membership management' is validated when 'The employee has access only after an authorized permission grant, with an audit trail'. It does not demonstrate 'The authorized user opens the report without being given broader workspace editing rights', which requires 'Review and grant the required report and semantic model permissions together'.

A successful 'Ensure the RLS filter has an effective supported relationship path to the fact table' would show 'A role test shows fact rows restricted to the assigned countries'. This case needs 'Review and grant the required report and semantic model permissions together' and evidence that 'The authorized user opens the report without being given broader workspace editing rights', not the other outcome.

The employee has access only after an authorized permission grant, with an audit trail. That check would be meaningful for the separate case: An analyst shares a report with a new employee through a link that bypasses normal review workflow. It would not directly verify this scenario's selected implementation: Review and grant the required report and semantic model permissions together.

The supported group is accepted and each member receives the intended RLS filter. That check would be meaningful for the separate case: A support team attempts to add an unsupported Microsoft 365 group type directly to an RLS role. It would not directly verify this scenario's selected implementation: Review and grant the required report and semantic model permissions together.

A role test shows fact rows restricted to the assigned countries. That check would be meaningful for the separate case: A published RLS role filters the Country dimension but the relationship to Sales is inactive. It would not directly verify this scenario's selected implementation: Review and grant the required report and semantic model permissions together.