Pass Your Microsoft DP-600 Exam Easy!

This action is appropriate when a model owner must manage workspace content and access settings on behalf of the analytics team. Administrative operations require broader workspace capabilities than ordinary report consumption. However, the question instead requires Assign the Viewer workspace role and verify item-level data permissions. because viewer is the least powerful standard workspace role, and viewing a report may still require data access.

This action is appropriate when an engineer creates pipelines and notebooks but should not manage other users' workspace membership. Contributor permits eligible item authoring without the full access administration powers of higher roles. However, the question instead requires Assign the Viewer workspace role and verify item-level data permissions. because viewer is the least powerful standard workspace role, and viewing a report may still require data access.

This action is appropriate when an auditor wants to explain why an analyst can edit a model despite no direct item sharing invitation. Workspace-level permissions can confer capabilities across multiple items independent of direct shares. However, the question instead requires Assign the Viewer workspace role and verify item-level data permissions. because viewer is the least powerful standard workspace role, and viewing a report may still require data access.

This action is appropriate when an engineer gives a colleague read access to a lakehouse and assumes it also authorizes unrestricted table-file reads. Control-plane access and underlying data-plane authorization must both be evaluated. However, the question instead requires Grant scoped item sharing and necessary read or build permissions rather than broad workspace authoring. because item sharing narrows exposure when a user only needs one published asset.

This action is appropriate when a published model is shared to a broad organization-wide link despite containing restricted financial metrics. A scoped audience better enforces intended information exposure than an unrestricted sharing link. However, the question instead requires Grant scoped item sharing and necessary read or build permissions rather than broad workspace authoring. because item sharing narrows exposure when a user only needs one published asset.

This action is appropriate when a report viewer can open the report but cannot create their own report from its underlying model. Viewing a report and authoring new content on the model are different permission paths. However, the question instead requires Grant scoped item sharing and necessary read or build permissions rather than broad workspace authoring. because item sharing narrows exposure when a user only needs one published asset.

This action is appropriate when a manager can access two territories and a hard-coded RLS role displays only one. Identity-driven mappings support more than one authorized region without rewriting static role expressions. However, the question instead requires Define a semantic-model row-level security role filtering sales by the authorized territory. because rLS limits the rows returned to a user without maintaining duplicated models per region.

This action is appropriate when a report passes desktop testing but a non-admin user sees all rows after publication. Testing as a privileged author can mask the restrictions applied to ordinary viewers. However, the question instead requires Define a semantic-model row-level security role filtering sales by the authorized territory. because rLS limits the rows returned to a user without maintaining duplicated models per region.

This action is appropriate when a team thinks an RLS predicate will prevent a dataset administrator from changing model permissions. Row filters restrict query results, not who can administer the data model. However, the question instead requires Define a semantic-model row-level security role filtering sales by the authorized territory. because rLS limits the rows returned to a user without maintaining duplicated models per region.

This action is appropriate when two research groups may read separate folders in one shared lakehouse Files area. File and folder authorization must be set at the data plane, not inferred from folder naming. However, the question instead requires Apply column-level data security or a restricted projection at the supported OneLake or model layer. because cLS prevents sensitive columns from being exposed through an otherwise authorized table.

This action is appropriate when a read-only data role accidentally includes both public and restricted Delta tables. Object selection in a role prevents a coarse data grant from exposing unrelated datasets. However, the question instead requires Apply column-level data security or a restricted projection at the supported OneLake or model layer. because cLS prevents sensitive columns from being exposed through an otherwise authorized table.

This action is appropriate when a partner should not discover a confidential compensation table through a semantic model at all. OLS hides a table or column rather than merely filtering its rows. However, the question instead requires Apply column-level data security or a restricted projection at the supported OneLake or model layer. because cLS prevents sensitive columns from being exposed through an otherwise authorized table.

This action is appropriate when an analyst assumes changing a sensitivity label automatically grants a colleague permission to open an item. Labels and ACLs are different controls: classification does not create read access. However, the question instead requires Apply the approved sensitivity label to the Fabric item. because labels communicate and can help enforce organizational information protection policies.

This action is appropriate when a report export must retain appropriate information protection when moved into a supported Office format. Sensitivity label effects vary by artifact and export path and should be tested. However, the question instead requires Apply the approved sensitivity label to the Fabric item. because labels communicate and can help enforce organizational information protection policies.

This action is appropriate when a tenant has labels defined but workspace authors cannot select them on Fabric items. Published label definitions are not automatically available to every user and workload. However, the question instead requires Apply the approved sensitivity label to the Fabric item. because labels communicate and can help enforce organizational information protection policies.

This action is appropriate when a recently promoted dataset has stale calculations and analysts assume the badge guarantees accuracy. Endorsement indicates recommended status, not automatic numerical correctness. However, the question instead requires Promote the trusted Fabric item through the supported endorsement action. because promotion signals an owner's recommendation but does not itself grant data access.

This action is appropriate when a report owner cannot certify a shared dataset because they lack the required organizational authority. The certification privilege can be governed separately from item creation. However, the question instead requires Promote the trusted Fabric item through the supported endorsement action. because promotion signals an owner's recommendation but does not itself grant data access.

This action is appropriate when a company requires formally validated shared semantic models to be distinguishable from merely popular drafts. Certification is a governed trust mark beyond informal promotion. However, the question instead requires Promote the trusted Fabric item through the supported endorsement action. because promotion signals an owner's recommendation but does not itself grant data access.

This action is appropriate when a data analyst requires read-only access to one governed OneLake table through several Fabric engines. Data-plane policies can apply consistently across eligible engines without broad workspace edit rights. However, the question instead requires Evaluate item administration and OneLake data role evaluation separately. because control-plane management and table-row data visibility are distinct permission scopes.

This action is appropriate when a workspace role gives an engineer item creation rights, but an owner wants to restrict customer rows in all queries. Workspace creation rights are not a substitute for row-level data filtering. However, the question instead requires Evaluate item administration and OneLake data role evaluation separately. because control-plane management and table-row data visibility are distinct permission scopes.

This action is appropriate when a lakehouse SQL endpoint shows different security behavior when switching from delegated to user identity. User identity and delegated identity evaluate permissions through different paths. However, the question instead requires Evaluate item administration and OneLake data role evaluation separately. because control-plane management and table-row data visibility are distinct permission scopes.

This action is appropriate when a user shares a dataset to the entire company to avoid handling access requests. Broad sharing expands the audience beyond the stated business requirement. However, the question instead requires Create an explicitly time-bound, narrowly scoped external access grant. because limited duration and scope reduce exposure beyond the approved engagement.

This action is appropriate when an external analyst requests permission to update Power BI semantic measures despite only needing read access. The principle of least privilege separates querying a model from changing its definitions. However, the question instead requires Create an explicitly time-bound, narrowly scoped external access grant. because limited duration and scope reduce exposure beyond the approved engagement.

This action is appropriate when an outside collaborator receives a report link but lacks permission to the shared semantic model behind it. Successful report access depends on all underlying content permissions. However, the question instead requires Create an explicitly time-bound, narrowly scoped external access grant. because limited duration and scope reduce exposure beyond the approved engagement.

This action is appropriate when a compliance analyst wants to discover all items with a restricted sensitivity classification. Central inventory allows classification review across workspaces. However, the question instead requires Inspect supported Fabric or Microsoft 365 audit events and version history. because traceable activity records help establish change accountability.

This action is appropriate when a storage owner wants evidence of which security roles currently grant access to a sensitive table. Security assessment needs actual grants, not assumptions about item ownership. However, the question instead requires Inspect supported Fabric or Microsoft 365 audit events and version history. because traceable activity records help establish change accountability.

This action is appropriate when a production report is shared using an unreviewed link and the team needs an access history. Governance review connects a sharing event to traceable ownership and approval. However, the question instead requires Inspect supported Fabric or Microsoft 365 audit events and version history. because traceable activity records help establish change accountability.

This action is appropriate when a semantic model uses a fixed cloud connection identity and an architect assumes every reader's SQL RLS is applied automatically. Fixed identity and single sign-on yield different security evaluation behavior. However, the question instead requires Check the semantic model's own access permissions and required credentials. because source SQL permissions do not automatically establish access to a separate semantic model item.

This action is appropriate when a report consumer has Build permission but cannot connect to a protected source lakehouse. Build authorizes model reuse, not necessarily read rights on separate source items. However, the question instead requires Check the semantic model's own access permissions and required credentials. because source SQL permissions do not automatically establish access to a separate semantic model item.

This action is appropriate when a model author sees full data while a Viewer only sees an authorized subset. Effective row visibility can differ by principal even on a shared model. However, the question instead requires Check the semantic model's own access permissions and required credentials. because source SQL permissions do not automatically establish access to a separate semantic model item.