Exam Bundle

A West role member sees West records and an unassigned viewer does not inherit the role. That check would be meaningful for the separate case: A Power BI model has a static RLS role called West but no users have been assigned to it after publication. It would not directly verify this scenario's selected implementation: Assign appropriate Contributor rather than Admin or Member privileges.

The supported group is accepted and each member receives the intended RLS filter. That check would be meaningful for the separate case: A support team attempts to add an unsupported Microsoft 365 group type directly to an RLS role. It would not directly verify this scenario's selected implementation: Assign appropriate Contributor rather than Admin or Member privileges.

A role review shows the former department's confidential content is inaccessible. That check would be meaningful for the separate case: An employee changes departments but retains access through an old security group. It would not directly verify this scenario's selected implementation: Assign appropriate Contributor rather than Admin or Member privileges.

Using 'Implement RLS separately from sensitivity classification and verify both controls' supports the result 'The labeled report still returns only permitted rows for a filtered viewer'. It does not implement 'Apply appropriate export controls and least-privilege item access' or prove 'A viewer sees approved aggregates without exporting protected transaction details' for this question.

'Use View as role or Test as role tools with an appropriate test identity' is validated when 'The test result matches the row counts expected for that role, independent of the developer's privileges'. It does not demonstrate 'A viewer sees approved aggregates without exporting protected transaction details', which requires 'Apply appropriate export controls and least-privilege item access'.

A successful 'Use Viewer access for users whose data must be restricted by model RLS rather than Contributor' would show 'A test Viewer obeys RLS and privileged editing roles are not incorrectly treated as RLS-restricted'. This case needs 'Apply appropriate export controls and least-privilege item access' and evidence that 'A viewer sees approved aggregates without exporting protected transaction details', not the other outcome.

The labeled report still returns only permitted rows for a filtered viewer. That check would be meaningful for the separate case: An executive mistakenly believes that a sensitivity label automatically replaces RLS for restricting rows. It would not directly verify this scenario's selected implementation: Apply appropriate export controls and least-privilege item access.

A test Viewer obeys RLS and privileged editing roles are not incorrectly treated as RLS-restricted. That check would be meaningful for the separate case: A workspace Contributor has access to a model with RLS and expects their own rows to be filtered by the role. It would not directly verify this scenario's selected implementation: Apply appropriate export controls and least-privilege item access.

The test result matches the row counts expected for that role, independent of the developer's privileges. That check would be meaningful for the separate case: A developer wants to test RLS but only inspects their own unrestricted workspace editing view. It would not directly verify this scenario's selected implementation: Apply appropriate export controls and least-privilege item access.

The check for 'Use item permissions and supported object-level protections or remove sensitive columns from exposed models' is 'An unauthorized user cannot query the protected salary field through the model'. That does not establish 'The employee has access only after an authorized permission grant, with an audit trail'; the stated requirement calls for 'Use approved sharing permissions and security group membership management'.

'Remove higher-privilege workspace membership for users requiring RLS enforcement' addresses the mechanism measured by 'The user's effective role is Viewer and the intended RLS rule applies'. The current outcome is 'The employee has access only after an authorized permission grant, with an audit trail' after 'Use approved sharing permissions and security group membership management', which the distractor leaves unverified.

'Email casing variations do not cause accidental overexposure or missing authorized rows' would demonstrate 'Normalize account mapping and use stable identity comparison in a validated dynamic role', but not 'The employee has access only after an authorized permission grant, with an audit trail'. The latter requires 'Use approved sharing permissions and security group membership management' in this scenario.

Email casing variations do not cause accidental overexposure or missing authorized rows. That check would be meaningful for the separate case: A model's RLS filters on a free-text email field where capitalization differs across source records. It would not directly verify this scenario's selected implementation: Use approved sharing permissions and security group membership management.

The user's effective role is Viewer and the intended RLS rule applies. That check would be meaningful for the separate case: A business user is both a Viewer and a Contributor through two groups and expects RLS to restrict their rows. It would not directly verify this scenario's selected implementation: Use approved sharing permissions and security group membership management.

An unauthorized user cannot query the protected salary field through the model. That check would be meaningful for the separate case: A report contains salary columns that viewers should never access, not merely rows from other regions. It would not directly verify this scenario's selected implementation: Use approved sharing permissions and security group membership management.

Using 'Grant necessary read-only report access without unnecessary Build permission' supports the result 'The contractor views the report but cannot create a new report from the underlying model'. It does not implement 'Update the group or item access assignments to remove no-longer-required permissions' or prove 'A role review shows the former department's confidential content is inaccessible' for this question.

'Grant appropriate Build access while withholding editing permissions' is validated when 'The employee creates a connected report but cannot change the underlying model schema'. It does not demonstrate 'A role review shows the former department's confidential content is inaccessible', which requires 'Update the group or item access assignments to remove no-longer-required permissions'.

A successful 'Apply appropriate item-level access and classification per report instead of granting blanket access' would show 'Staff without finance clearance cannot access the restricted report, despite seeing public workspace material'. This case needs 'Update the group or item access assignments to remove no-longer-required permissions' and evidence that 'A role review shows the former department's confidential content is inaccessible', not the other outcome.

The contractor views the report but cannot create a new report from the underlying model. That check would be meaningful for the separate case: A contractor should read a shared report but must not reuse the semantic model to build other content. It would not directly verify this scenario's selected implementation: Update the group or item access assignments to remove no-longer-required permissions.

Staff without finance clearance cannot access the restricted report, despite seeing public workspace material. That check would be meaningful for the separate case: A workspace contains financial reports with different sensitivity classifications. It would not directly verify this scenario's selected implementation: Update the group or item access assignments to remove no-longer-required permissions.

The employee creates a connected report but cannot change the underlying model schema. That check would be meaningful for the separate case: A company wants employees to reuse a governed dataset in their own reports but not edit its data model. It would not directly verify this scenario's selected implementation: Update the group or item access assignments to remove no-longer-required permissions.

The check for 'Use a supported Entra security group or mail-enabled group type for RLS membership' is 'The supported group is accepted and each member receives the intended RLS filter'. That does not establish 'The test result matches the row counts expected for that role, independent of the developer's privileges'; the stated requirement calls for 'Use View as role or Test as role tools with an appropriate test identity'.

'Define dynamic RLS using the signed-in user mapping and appropriate model relationships' addresses the mechanism measured by 'Two managers viewing the same report see only their authorized territory rows'. The current outcome is 'The test result matches the row counts expected for that role, independent of the developer's privileges' after 'Use View as role or Test as role tools with an appropriate test identity', which the distractor leaves unverified.

'The authorized user opens the report without being given broader workspace editing rights' would demonstrate 'Review and grant the required report and semantic model permissions together', but not 'The test result matches the row counts expected for that role, independent of the developer's privileges'. The latter requires 'Use View as role or Test as role tools with an appropriate test identity' in this scenario.

Two managers viewing the same report see only their authorized territory rows. That check would be meaningful for the separate case: A region manager should only see sales transactions for the territories assigned to their username. It would not directly verify this scenario's selected implementation: Use View as role or Test as role tools with an appropriate test identity.

The authorized user opens the report without being given broader workspace editing rights. That check would be meaningful for the separate case: A user can open a report link but Power BI denies access to its underlying semantic model. It would not directly verify this scenario's selected implementation: Use View as role or Test as role tools with an appropriate test identity.

The supported group is accepted and each member receives the intended RLS filter. That check would be meaningful for the separate case: A support team attempts to add an unsupported Microsoft 365 group type directly to an RLS role. It would not directly verify this scenario's selected implementation: Use View as role or Test as role tools with an appropriate test identity.

Using 'Add approved users or security groups to the published RLS role in the Power BI service' supports the result 'A West role member sees West records and an unassigned viewer does not inherit the role'. It does not implement 'Normalize account mapping and use stable identity comparison in a validated dynamic role' or prove 'Email casing variations do not cause accidental overexposure or missing authorized rows' for this question.

'Implement RLS separately from sensitivity classification and verify both controls' is validated when 'The labeled report still returns only permitted rows for a filtered viewer'. It does not demonstrate 'Email casing variations do not cause accidental overexposure or missing authorized rows', which requires 'Normalize account mapping and use stable identity comparison in a validated dynamic role'.

A successful 'Apply the approved Microsoft Purview sensitivity label to the appropriate item' would show 'The Power BI item displays the mandated classification label under tenant policy'. This case needs 'Normalize account mapping and use stable identity comparison in a validated dynamic role' and evidence that 'Email casing variations do not cause accidental overexposure or missing authorized rows', not the other outcome.

The labeled report still returns only permitted rows for a filtered viewer. That check would be meaningful for the separate case: An executive mistakenly believes that a sensitivity label automatically replaces RLS for restricting rows. It would not directly verify this scenario's selected implementation: Normalize account mapping and use stable identity comparison in a validated dynamic role.

A West role member sees West records and an unassigned viewer does not inherit the role. That check would be meaningful for the separate case: A Power BI model has a static RLS role called West but no users have been assigned to it after publication. It would not directly verify this scenario's selected implementation: Normalize account mapping and use stable identity comparison in a validated dynamic role.

The Power BI item displays the mandated classification label under tenant policy. That check would be meaningful for the separate case: A report has confidential payroll figures and the compliance team requires classification markings. It would not directly verify this scenario's selected implementation: Normalize account mapping and use stable identity comparison in a validated dynamic role.