Pass Your Microsoft DP-600 Exam Easy!

This action is appropriate when a model creates hundreds of calculated columns for values that can be computed in source SQL. Model size and refresh work may fall when unnecessary calculated columns are removed. However, the question instead requires Remove unneeded high-cardinality columns from the model. because wide high-cardinality data can consume memory without adding analytical value.

This action is appropriate when a model uses bidirectional filters on every relationship and reports contain ambiguous results. Relationship design affects both query work and analytical correctness. However, the question instead requires Remove unneeded high-cardinality columns from the model. because wide high-cardinality data can consume memory without adding analytical value.

This action is appropriate when a fact table includes a verbose description repeated across millions of rows. Dimensional normalization can reduce repeated text and improve compression. However, the question instead requires Remove unneeded high-cardinality columns from the model. because wide high-cardinality data can consume memory without adding analytical value.

This action is appropriate when a guest loses an approved contract role, but previously authorized workspace access remains. Access reviews must cover all effective permissions rather than only identity deactivation elsewhere. However, the question instead requires Assign a suitable workspace Admin or Member role after reviewing its management privileges. because administrative operations require broader workspace capabilities than ordinary report consumption.

This action is appropriate when an engineer creates pipelines and notebooks but should not manage other users' workspace membership. Contributor permits eligible item authoring without the full access administration powers of higher roles. However, the question instead requires Assign a suitable workspace Admin or Member role after reviewing its management privileges. because administrative operations require broader workspace capabilities than ordinary report consumption.

This action is appropriate when an auditor wants to explain why an analyst can edit a model despite no direct item sharing invitation. Workspace-level permissions can confer capabilities across multiple items independent of direct shares. However, the question instead requires Assign a suitable workspace Admin or Member role after reviewing its management privileges. because administrative operations require broader workspace capabilities than ordinary report consumption.

This action is appropriate when an engineer gives a colleague read access to a lakehouse and assumes it also authorizes unrestricted table-file reads. Control-plane access and underlying data-plane authorization must both be evaluated. However, the question instead requires Review whether the user needs the semantic model Build permission. because viewing a report and authoring new content on the model are different permission paths.

This action is appropriate when a published model is shared to a broad organization-wide link despite containing restricted financial metrics. A scoped audience better enforces intended information exposure than an unrestricted sharing link. However, the question instead requires Review whether the user needs the semantic model Build permission. because viewing a report and authoring new content on the model are different permission paths.

This action is appropriate when an analyst has a workspace Viewer role but still cannot query a particular restricted dataset. Workspace membership does not automatically override fine-grained data security restrictions. However, the question instead requires Review whether the user needs the semantic model Build permission. because viewing a report and authoring new content on the model are different permission paths.

This action is appropriate when a reviewer needs to validate how a role filters rows without changing production user membership. Role simulation helps detect filter mistakes before granting real users access. However, the question instead requires Model an approved user-to-territory security mapping for dynamic RLS. because identity-driven mappings support more than one authorized region without rewriting static role expressions.

This action is appropriate when a report passes desktop testing but a non-admin user sees all rows after publication. Testing as a privileged author can mask the restrictions applied to ordinary viewers. However, the question instead requires Model an approved user-to-territory security mapping for dynamic RLS. because identity-driven mappings support more than one authorized region without rewriting static role expressions.

This action is appropriate when a team thinks an RLS predicate will prevent a dataset administrator from changing model permissions. Row filters restrict query results, not who can administer the data model. However, the question instead requires Model an approved user-to-territory security mapping for dynamic RLS. because identity-driven mappings support more than one authorized region without rewriting static role expressions.

This action is appropriate when two research groups may read separate folders in one shared lakehouse Files area. File and folder authorization must be set at the data plane, not inferred from folder naming. However, the question instead requires Configure object-level security on the restricted model table or supported data object. because oLS hides a table or column rather than merely filtering its rows.

This action is appropriate when a read-only data role accidentally includes both public and restricted Delta tables. Object selection in a role prevents a coarse data grant from exposing unrelated datasets. However, the question instead requires Configure object-level security on the restricted model table or supported data object. because oLS hides a table or column rather than merely filtering its rows.

This action is appropriate when a user belongs to several OneLake roles and gains more data visibility than the author expected. Multiple grants can combine, so a restrictive role does not cancel a separate broad permission. However, the question instead requires Configure object-level security on the restricted model table or supported data object. because oLS hides a table or column rather than merely filtering its rows.

This action is appropriate when an incident reveals that one workspace's classification label is outdated after its business data became regulated. Labels should track actual content sensitivity rather than remain a one-time setup step. However, the question instead requires Set item access permissions separately from the sensitivity classification. because labels and ACLs are different controls: classification does not create read access.

This action is appropriate when a report export must retain appropriate information protection when moved into a supported Office format. Sensitivity label effects vary by artifact and export path and should be tested. However, the question instead requires Set item access permissions separately from the sensitivity classification. because labels and ACLs are different controls: classification does not create read access.

This action is appropriate when a tenant has labels defined but workspace authors cannot select them on Fabric items. Published label definitions are not automatically available to every user and workload. However, the question instead requires Set item access permissions separately from the sensitivity classification. because labels and ACLs are different controls: classification does not create read access.

This action is appropriate when a recently promoted dataset has stale calculations and analysts assume the badge guarantees accuracy. Endorsement indicates recommended status, not automatic numerical correctness. However, the question instead requires Apply certified endorsement only through the organization's authorized certification process. because certification is a governed trust mark beyond informal promotion.

This action is appropriate when a report owner cannot certify a shared dataset because they lack the required organizational authority. The certification privilege can be governed separately from item creation. However, the question instead requires Apply certified endorsement only through the organization's authorized certification process. because certification is a governed trust mark beyond informal promotion.

This action is appropriate when a project shares an endorsed data product but consumers still receive an access denied message. Endorsement is discoverability metadata and cannot replace authorization. However, the question instead requires Apply certified endorsement only through the organization's authorized certification process. because certification is a governed trust mark beyond informal promotion.

This action is appropriate when a data owner grants ReadAll on a restricted lakehouse and assumes a later fine-grained role automatically reduces it. A separate full-data grant can defeat intended least-privilege isolation. However, the question instead requires Grant scoped OneLake security data access for the table when supported. because data-plane policies can apply consistently across eligible engines without broad workspace edit rights.

This action is appropriate when a workspace role gives an engineer item creation rights, but an owner wants to restrict customer rows in all queries. Workspace creation rights are not a substitute for row-level data filtering. However, the question instead requires Grant scoped OneLake security data access for the table when supported. because data-plane policies can apply consistently across eligible engines without broad workspace edit rights.

This action is appropriate when a lakehouse SQL endpoint shows different security behavior when switching from delegated to user identity. User identity and delegated identity evaluate permissions through different paths. However, the question instead requires Grant scoped OneLake security data access for the table when supported. because data-plane policies can apply consistently across eligible engines without broad workspace edit rights.

This action is appropriate when a user shares a dataset to the entire company to avoid handling access requests. Broad sharing expands the audience beyond the stated business requirement. However, the question instead requires Validate the report and semantic model permission chain for the external principal. because successful report access depends on all underlying content permissions.

This action is appropriate when an external analyst requests permission to update Power BI semantic measures despite only needing read access. The principle of least privilege separates querying a model from changing its definitions. However, the question instead requires Validate the report and semantic model permission chain for the external principal. because successful report access depends on all underlying content permissions.

This action is appropriate when a partner's guest account is disabled but an active service principal continues to consume shared data. Service identities are independent access paths that a guest account review might miss. However, the question instead requires Validate the report and semantic model permission chain for the external principal. because successful report access depends on all underlying content permissions.

This action is appropriate when a policy team needs to prevent new confidential datasets from being published without classification. Programmatic or procedural enforcement is more reliable than an optional description field. However, the question instead requires Query the supported inventory or governance catalog filtered by item label. because central inventory allows classification review across workspaces.

This action is appropriate when a storage owner wants evidence of which security roles currently grant access to a sensitive table. Security assessment needs actual grants, not assumptions about item ownership. However, the question instead requires Query the supported inventory or governance catalog filtered by item label. because central inventory allows classification review across workspaces.

This action is appropriate when a production report is shared using an unreviewed link and the team needs an access history. Governance review connects a sharing event to traceable ownership and approval. However, the question instead requires Query the supported inventory or governance catalog filtered by item label. because central inventory allows classification review across workspaces.

This action is appropriate when a semantic model uses a fixed cloud connection identity and an architect assumes every reader's SQL RLS is applied automatically. Fixed identity and single sign-on yield different security evaluation behavior. However, the question instead requires Verify the consuming identity's RLS and OneLake security roles. because effective row visibility can differ by principal even on a shared model.

This action is appropriate when a report consumer has Build permission but cannot connect to a protected source lakehouse. Build authorizes model reuse, not necessarily read rights on separate source items. However, the question instead requires Verify the consuming identity's RLS and OneLake security roles. because effective row visibility can differ by principal even on a shared model.

This action is appropriate when a team combines OneLake table access rules and semantic RLS and sees unexpected effective filters. Layered security can create compounded restrictions that require end-to-end verification. However, the question instead requires Verify the consuming identity's RLS and OneLake security roles. because effective row visibility can differ by principal even on a shared model.