Microsoft DP-700 Practice Test 10

Question 90

The privacy team labeled a Fabric lakehouse and expects supported consumers to see its classification. Which acceptance check is appropriate?

Inspect the workspace sensitivity-label dropdown without checking the target item.
Open the source lakehouse as its owner and assume every exported file inherits its label.
Inspect the sensitivity label on the intended source item and on each supported downstream destination, taking documented propagation rules into account.
Check whether the table’s Delta files have been optimized instead of viewing label metadata.

Explanation

Correct Answer

A successful label assignment must be confirmed on actual items and consumers; the label does not necessarily propagate through every conversion or export.

Incorrect Answers

A workspace setting is not proof that the specified lakehouse and downstream exported artifacts carry the intended label.

Propagation varies by supported operation and destination. Classification on the source does not guarantee the export retained it.

File-layout maintenance cannot establish the Purview sensitivity label attached to the item or a specific downstream artifact.

Question 91

Compliance needs a traceable record of which identity deleted or changed a Fabric item on a given date. Which evidence source is appropriate?

Use only a notebook activity run log to determine the actor who deleted the item.
Identify a possible actor by checking the current workspace Admin membership list.
Compare yesterday’s and today’s item catalog inventory without collecting activity events.
Search the supported Microsoft 365/Fabric audit activity records for the relevant operation and authorized user, within available audit retention.

Explanation

Correct Answer

Audit activity includes event identities and timestamps where supported; it is the appropriate evidence path for administrative actions rather than inferring from data reads.

Incorrect Answers

A notebook execution trace can identify its own run identity but cannot prove who performed a separate Fabric item-management operation.

Administrative membership describes capability, not the identity and time of the specific audited deletion or item change.

Catalog diffs can show that an item disappeared but cannot establish the principal, operation type, or traceable event timestamp.

Question 92

A team searches Spark application output logs for a deleted lakehouse item and finds no user identity. Which audit design gap explains this?

Spark execution logs do not substitute for the relevant tenant-level audit records of item-management operations.
A successful notebook execution automatically records the principal who deleted any other Fabric item.
An Eventhouse ingestion failure suppressed the item deletion from Spark output.
Missing V-Order statistics prevented the Spark log from recording the user.

Explanation

Correct Answer

Item deletion is an administrative event; the auditor must query the correct activity-log source with appropriate permissions and retention coverage.

Incorrect Answers

A notebook run log describes that execution, not the independent item-deletion event. An authorized tenant activity audit is needed for item management.

Eventhouse ingestion and notebook application output are not authoritative administrative operation logs for lakehouse item deletion.

Delta file layout is not involved in tenant audit event attribution. The team queried the wrong evidence source for the deleted item.

Question 93

A reviewer receives a report claiming that a Fabric workspace item was removed yesterday. What should they verify?

Treat the current absence of the lakehouse from the workspace as proof of the actor.
Find the exact item-operation event and correlate its time, actor and target identifier to the request and applicable retention window.
Look up the most recent Spark application owner in the same workspace.
Use the workspace domain administrator list as the deletion record.

Explanation

Correct Answer

The event tuple links an accountable action to a specific target; historical item names or a missing item alone cannot prove who performed the action.

Incorrect Answers

A missing item can result from many operations and does not identify a specific user or timestamp. The audit activity must match the operation and object.

A Spark job owner may not be the principal who deleted the Fabric item. Cross-operation inference is not a reliable audit trail.

Potential permission to manage workspaces is different from evidence of the executed item operation in the available audit retention window.

Question 94

An analyst receives a shared KQL queryset item in Fabric, but they are not a member of the source Eventhouse workspace and have not been granted database Viewer rights. The analyst can open the queryset definition but query execution fails with authorization. Which access boundary requires correction?

Share the KQL queryset with the user again but do not grant access to the referenced KQL database.
Grant workspace Contributor simply to overcome the single-database query denial.
Review the user’s Eventhouse/KQL database roles and item-specific query permissions in addition to workspace membership.
Grant only a data-ingestion capability and assume this also permits reading existing KQL records.

Explanation

Correct Answer

Workspace visibility alone does not prove that the querying principal has the required data-plane KQL database role and permissions.

Incorrect Answers

Queryset sharing grants visibility into the saved query item, but running it against the underlying database still requires database-scoped Viewer or other inherited query permissions.

Contributor grants broad admin-equivalent Kusto rights throughout the workspace and is excessive for a user who needs to query only one KQL database.

An ingest-specific permission does not automatically satisfy the Kusto Viewer scope needed for ordinary query reads of the database.

Question 95

A user can open a KQL queryset shared individually, but querying its referenced Eventhouse database fails. No role has been granted on the KQL database, and the user has no workspace membership. What explains the denial?

A shared KQL queryset grants automatic Viewer rights on every database it references.
The KQL database requires a matching lakehouse notebook default to permit a query.
Renaming the underlying Eventhouse automatically activates query execution for all users.
The effective KQL database query permission has not been granted to the querying identity even though the item is discoverable.

Explanation

Correct Answer

The Eventhouse access model has query-scoped authorization separate from simply listing workspace assets.

Incorrect Answers

Query item sharing does not itself grant Kusto database access. The database-scoped viewer or other relevant inherited role must be evaluated for the user.

Kusto database authorization is not controlled by Spark notebook lakehouse attachment. The missing query role is the direct boundary.

Renaming an item is not an RBAC grant. A principal may open a separately shared query but still lack database-level Viewer rights.

Question 96

An external analyst was granted Viewer access on exactly one Eventhouse KQL database but no workspace role. Which post-grant test best confirms that access is narrowly scoped?

Execute a representative KQL query against the intended database as the analyst and confirm unrelated KQL databases remain inaccessible.
Inspect the KQL query text as the Eventhouse administrator and confirm it parses.
Confirm the analyst can open the shared queryset but never execute it.
Increase Eventhouse ingestion throughput and infer that query permissions are correct.

Explanation

Correct Answer

An effective identity test proves both positive authorization and appropriate database-level scoping; merely seeing the Eventhouse name is insufficient.

Incorrect Answers

Syntax validity and admin execution do not prove the analyst possesses the requisite database query role or that other databases remain inaccessible.

Item visibility alone is the original insufficient permission. Query execution and a negative cross-database test are necessary.

Ingestion rate has no bearing on whether a user identity has the required Kusto Viewer or other database role.

Question 97

A contractor needs to read one shared lakehouse table but currently has Contributor rights in the entire Finance workspace. What change best reduces privilege?

Replace Contributor with workspace Member, which still manages other workspace items.
Remove workspace Contributor, grant only the necessary lakehouse item access and scoped OneLake data Read role, then validate the contractor’s effective rights.
Add a new OneLake read role while retaining the original workspace Contributor membership.
Grant ReadAll to every Finance lakehouse so the contractor no longer needs Contributor.

Explanation

Correct Answer

Contributor grants broader item/data modification powers. Item-level plus data-scoped Read is the relevant least-privilege model for a read-only contractor.

Incorrect Answers

Member remains a write-capable workspace role, so it does not remove the contractor’s unwanted ability to edit unrelated notebooks or data.

The effective access retains Contributor write powers; a narrow data role cannot negate a broader workspace grant.

ReadAll over all Finance items is still far wider than one selected table. Use item-level Read and a table-scoped OneLake role.

Question 98

A supposedly read-only contractor is able to delete a notebook in a Fabric workspace. Their membership includes Contributor. What is the primary reason?

The contractor’s item-level Read permission implicitly suppresses Contributor rights in a different object.
The notebook’s security is determined only by its default Spark environment.
Contributor includes workspace-wide write permissions; a narrower lakehouse Read role does not override the elevated workspace role.
A lakehouse table row filter also blocks editing unrelated notebook items.

Explanation

Correct Answer

The effective permissions include both roles, and the broad workspace grant permits item editing irrespective of read-only data-role intent.

Incorrect Answers

A narrow lakehouse Read role does not subtract the ability to edit notebooks granted by workspace Contributor. The effective grants are additive.

Spark environment selection controls runtime properties, not permission to delete a workspace notebook. Contributor is a write-capable workspace role.

OneLake table RLS governs eligible data reads and does not alter workspace-wide item editing authorization.

Question 99

After revoking Contributor and granting scoped read permissions, how should the administrator verify removal of excess privilege?

Open the finance lakehouse as a workspace Admin and consider the contractor’s permissions proven.
Check only that the contractor’s lakehouse Read role is listed, without checking remaining Contributor memberships.
Hide notebooks from the contractor’s navigation and assume deletion is blocked.
Run as the contractor to confirm permitted lakehouse reads and attempt an unauthorized notebook modification and an unrelated table read, expecting both to fail.

Explanation

Correct Answer

Testing actual operations establishes the difference between read permissions on intended data and prohibited writes or cross-item access.

Incorrect Answers

An Admin has broader capabilities than the contractor, so success cannot verify that unauthorized notebook edits and unrelated reads are denied.

The narrow role can coexist with the very broad workspace grant that allowed editing. Effective permissions require both positive and negative operation tests.

UI filtering does not revoke workspace Write permission. Attempting a prohibited notebook modification under the contractor identity is the relevant validation.

Question 100

A OneLake role accidentally grants the whole Analysts group read access to a restricted `HR` table. What is the least-disruptive security correction?

Remove the unintended group grant or scope the role away from the HR table, then retain only explicitly authorized group memberships.
Revoke Analysts access to every OneLake item in the enterprise.
Apply a warehouse SQL DENY but leave the direct OneLake table role untouched.
Mask one HR salary field while keeping the entire restricted table readable.

Explanation

Correct Answer

OneLake roles are positive grants. Revoking the unintended HR role membership/scope eliminates the access path while preserving unrelated analysts’ permissions.

Incorrect Answers

Mass revocation would interrupt unrelated legitimate data access. The defect is the mistakenly broad grant for the restricted HR table.

SQL rules on a separate query surface do not reliably remove Read that the Analysts group already has through the OneLake role on HR.

Masking one column does not address an unintended grant to the HR table as a whole. Its object scope or membership must be corrected.

Implementing Data Engineering Solutions Using Microsoft Fabric (DP-700) Practice Tests

Microsoft DP-700 Practice Test 8 - 10 Questions (Last Reviewed 27-Oct-2026)
Microsoft DP-700 Practice Test 9 - 10 Questions (Last Reviewed 26-Oct-2026)
Microsoft DP-700 Practice Test 10 - 10 Questions (Last Reviewed 25-Oct-2026)
Microsoft DP-700 Practice Test 11 - 10 Questions (Last Reviewed 24-Oct-2026)
Microsoft DP-700 Practice Test 12 - 10 Questions (Last Reviewed 23-Oct-2026)

Pass Your Microsoft DP-700 Exam Easy!

Question 90

Explanation

Correct Answer

Incorrect Answers

Question 91

Explanation

Correct Answer

Incorrect Answers

Question 92

Explanation

Correct Answer

Incorrect Answers

Question 93

Explanation

Correct Answer

Incorrect Answers

Question 94

Explanation

Correct Answer

Incorrect Answers

Question 95

Explanation

Correct Answer

Incorrect Answers

Question 96

Explanation

Correct Answer

Incorrect Answers

Question 97

Explanation

Correct Answer

Incorrect Answers

Question 98

Explanation

Correct Answer

Incorrect Answers

Question 99

Explanation

Correct Answer

Incorrect Answers

Question 100

Explanation

Correct Answer

Incorrect Answers

Implementing Data Engineering Solutions Using Microsoft Fabric (DP-700) Practice Tests