Microsoft DP-700 Practice Test 11

Question 100

A OneLake role accidentally grants the whole Analysts group read access to a restricted `HR` table. What is the least-disruptive security correction?

Remove the unintended group grant or scope the role away from the HR table, then retain only explicitly authorized group memberships.
Revoke Analysts access to every OneLake item in the enterprise.
Apply a warehouse SQL DENY but leave the direct OneLake table role untouched.
Mask one HR salary field while keeping the entire restricted table readable.

Explanation

Correct Answer

OneLake roles are positive grants. Revoking the unintended HR role membership/scope eliminates the access path while preserving unrelated analysts’ permissions.

Incorrect Answers

Mass revocation would interrupt unrelated legitimate data access. The defect is the mistakenly broad grant for the restricted HR table.

SQL rules on a separate query surface do not reliably remove Read that the Analysts group already has through the OneLake role on HR.

Masking one column does not address an unintended grant to the HR table as a whole. Its object scope or membership must be corrected.

Question 101

The HR table remains readable after a custom restricted OneLake role was narrowed to exclude it. The same group belongs to DefaultReader with all table access. Why?

The narrowed custom role must produce an explicit DENY that overrides DefaultReader.
The group still receives HR Read through the broader default role, so narrowing one custom role does not subtract that second grant.
HR table data is cached from the last query but would otherwise be unreadable.
The table remains readable because sensitivity labels are inherited from the workspace.

Explanation

Correct Answer

Permissions are aggregated across effective roles and OneLake has no general deny-type role that cancels broader access; audit all inherited grants.

Incorrect Answers

OneLake security offers Grant roles, not a general DENY override. A wider DefaultReader role can still authorize the HR table.

The scenario establishes a current separate role with all-table access; caching is not the reason the group remains authorized to query HR.

Purview labels classify content; they do not explain the existing group Read permission conferred through DefaultReader.

Question 102

A team changes the membership of a OneLake security role for a restricted table. Which audit test best detects unexpected remaining access?

Check only the edited custom role, without examining DefaultReader or other Entra groups.
Test the HR table only as the workspace Admin.
Enumerate all roles affecting the table and test the exact identities or Entra groups that should be allowed versus denied using real reads.
Verify that the role name contains the word Restricted, without running a SELECT.

Explanation

Correct Answer

Effective-permission checks expose overlapping roles or group assignments that a single role’s member list could miss.

Incorrect Answers

The effective union of grants may include a second role that still authorizes HR, so a single role screenshot cannot establish removal.

Privileged workspace roles normally retain broad local-table access and are the wrong identity for verifying analyst restrictions.

Role names are descriptive, not evidence of effective membership or object scope. Real allowed and denied reads reveal remaining grants.

Question 103

A lakehouse shortcut points to a secured table in a different Fabric workspace. A consumer has broad access in the shortcut workspace but no permission at the source. What must be addressed?

Give the consumer Contributor in the shortcut workspace without checking source role membership.
Recreate the shortcut with the same target path and assume a new item bypasses source security.
Assign the consumer ReadAll on the shortcut item only, with no producer grant.
Grant appropriate access at the producer/source OneLake data item and confirm the consumer-side item permission, rather than treating shortcut ownership as source access.

Explanation

Correct Answer

Shortcuts reference source data without transferring unrestricted ownership. Access depends on the identity and the producer’s security policies.

Incorrect Answers

Consumer-workspace Write does not imply a grant from the secured producer item. Shortcut access must satisfy the producer’s authorization boundary.

Deleting and recreating a logical reference cannot create permission on its target. The consumer remains unauthorized by the source OneLake roles.

A consumer-side permission cannot override a distinct producer OneLake role for a source-secured Delta table.

Question 104

A Contributor in the consumer workspace gets a permission error reading a shortcut-backed table from a secured producer lakehouse. Why can this happen?

Contributor at the consumer does not automatically become an elevated member of the producer; the source security boundary still applies.
The consumer workspace Contributor role automatically includes full producer permissions.
Shortcuts always copy the producer table data into a newly owned consumer table.
An Eventstream destination must be published before a lakehouse shortcut can be queried.

Explanation

Correct Answer

Shortcut access is evaluated using the producer’s effective authorization, even when the user can modify objects in the consumer workspace.

Incorrect Answers

Workspace roles are scoped to their own items. Elevated consumer access does not grant elevated privileges on a distinct secured producer lakehouse.

A shortcut normally references the source rather than transferring ownership of its security policy. The producer permission check is still required.

Eventstream routing is separate from OneLake shortcut data access; the failure is source-side authorization, not missing streaming configuration.

Question 105

How should an engineer validate that a shortcut to a sensitive source preserves authorization across workspaces?

Run the shortcut only as the producer workspace Admin and accept that result for everyone.
As an allowed and disallowed consumer identity, query the shortcut and inspect both the consumer item Read grant and the producer table’s OneLake role grants.
Inspect only the consumer shortcut name while leaving the source role assignments unexamined.
Check that the shortcut still appears in the catalog without issuing any data query.

Explanation

Correct Answer

Cross-workspace checks uncover improper reliance on the shortcut workspace role and verify that source restrictions govern accessible rows/tables.

Incorrect Answers

Producer administrators may have elevated source access. Success under that identity cannot test denial for an unauthorized consumer.

Path labels cannot prove both sides of the security boundary. Producer authorization and consumer item access must be tested using real identities.

Shortcut discoverability is not equivalent to data access through the producer. An allowed and a denied query are needed to prove enforcement.

Question 106

A data engineering team uses OneLake row filtering in Spark but the same table appears unfiltered through a lakehouse SQL endpoint configured for delegated identity. Select THREE steps that align enforcement without exposing extra rows.

Leave the endpoint in delegated identity mode and assume Spark’s OneLake row security automatically applies to its queries.
Determine whether the SQL analytics endpoint is in delegated or user identity access mode.
If consistent OneLake enforcement is required, configure a supported user identity mode so the SQL engine passes the end user to OneLake.
Re-run representative least-privileged queries from Spark and SQL and reconcile their permitted row sets.
Write a SQL RLS policy only and assume the Spark notebook will inherit it for direct Delta reads.
Grant the SQL endpoint owner workspace Contributor so every analyst sees all rows.

Explanation

Correct Answers

Delegated mode evaluates SQL permissions under a delegated identity rather than applying the user’s OneLake RLS roles.

The user-identity model evaluates the caller’s OneLake policy, aligning that security boundary with supported Spark reads.

Real queries by the same persona reveal filtering discrepancies that cannot be detected from role names or notebook definitions alone.

Incorrect Answers

Delegated identity uses the endpoint owner for underlying data access and does not honor the caller’s OneLake RLS in the same way as user-identity mode.

Endpoint-specific SQL policies do not automatically govern Spark data-plane reads. OneLake source policies and the engine access mode must be aligned.

Broadening owner privileges increases unfiltered data access and does not enforce the desired row restrictions for each end user.

Question 107

A team adds a SQL endpoint RLS rule on a lakehouse whose users also access the underlying Delta table through Spark. Spark users still see disallowed rows. Why?

The T-SQL endpoint RLS definition automatically restricts external Spark files in every mode.
Notebook code has too few Spark executors to propagate SQL security metadata.
A SQL connection string parameter implicitly gives the notebook a matching security policy.
Endpoint-specific SQL security applies only on that query surface; direct Spark reads require the appropriate OneLake security model too.

Explanation

Correct Answer

A SQL permission or predicate in delegated SQL access does not automatically rewrite the authorization applied to direct Delta/OneLake reads.

Incorrect Answers

SQL-endpoint rules are enforced on the SQL query surface. Spark reads must use the supported OneLake security path; SQL-only rules do not protect arbitrary path reads.

Compute allocation does not transmit SQL database RLS to OneLake. Different query engines can evaluate different security configurations.

Connection parameters select endpoints and credentials, not cross-engine row filters; source-level OneLake policies are needed for Spark enforcement.

Question 108

An architect migrates a lakehouse SQL endpoint from delegated identity to user identity mode. What comparison proves that the security migration behaves as intended?

Run identical row-filtered queries under a constrained user through Spark and SQL, confirm OneLake role sync and verify that both return the authorized row subset.
Compare SQL results using only the delegated owner credential and skip the end-user identity.
Inspect only whether the SQL endpoint displays the correct tables after switching modes.
Run a Spark query as a workspace Admin and a SQL query as a Viewer, then compare aggregate counts.

Explanation

Correct Answer

A cross-engine, same-principal result check demonstrates effective shared data-policy enforcement and detects policy sync or user-mapping gaps.

Incorrect Answers

Delegated access is evaluated using the owner, not necessarily the requesting restricted user. It cannot prove matching OneLake-enforced results.

Catalog synchronization does not show whether the constrained principal receives the same row set through both engines.

Different effective identities and privilege levels can cause misleading differences. The comparison must use the same restricted user and effective security model.

Question 109

An external auditor should inspect one Fabric lakehouse item but must not gain access to the unrelated workspaces and notebooks. What permission mechanism is appropriate?

Assign the auditor the Viewer role for the entire workspace instead of sharing the one lakehouse.
Share the exact lakehouse item with the auditor and separately grant the required scoped data Read rights, without assigning a general workspace role.
Share a semantic model with the auditor but provide no access to the requested lakehouse item.
Share only the lakehouse item Read permission and assume its Tables data is readable without a data role.

Explanation

Correct Answer

Item-specific sharing supports discovery of the intended artifact while OneLake security determines whether the auditor can read the underlying data.

Incorrect Answers

Workspace Viewer grants visibility across workspace items, contrary to the requirement to avoid unrelated notebooks and other assets.

A semantic model share is a separate consumer path and does not automatically grant lakehouse discovery and scoped OneLake data reads.

Fabric Read permits item discovery; effective OneLake Read or a ReadAll-backed default role is still needed for lakehouse table data.

Question 110

An external auditor was supposed to inspect only one shared Fabric lakehouse. The administrator assigned the auditor workspace Viewer instead of sharing the individual item. The auditor can now also discover unrelated notebooks and pipelines. What caused the excess visibility?

A lakehouse OneLake Read role automatically grants visibility into every notebook in the workspace.
The lakehouse and the notebooks must use different Spark runtimes to isolate their navigation.
Workspace Viewer grants access to visible content across that workspace, whereas sharing only the lakehouse item would avoid the broad workspace grant.
A sensitivity label on the lakehouse automatically shares every other workspace item with the auditor.

Explanation

Correct Answer

Viewer is a workspace-level role and therefore exposes unrelated workspace items. Restricting the principal to the one shared lakehouse item addresses the audited scope without a broad workspace membership.

Incorrect Answers

OneLake data roles govern specific tables and folders; they are not the source of broad notebook and pipeline item discoverability in the workspace.

Notebook runtime choices do not reduce the workspace-wide visibility conferred by a Fabric workspace role.

Classification labels describe protection requirements and do not independently add workspace Viewer membership or share unrelated notebooks.

Implementing Data Engineering Solutions Using Microsoft Fabric (DP-700) Practice Tests

Microsoft DP-700 Practice Test 9 - 10 Questions (Last Reviewed 26-Oct-2026)
Microsoft DP-700 Practice Test 10 - 10 Questions (Last Reviewed 25-Oct-2026)
Microsoft DP-700 Practice Test 11 - 10 Questions (Last Reviewed 24-Oct-2026)
Microsoft DP-700 Practice Test 12 - 10 Questions (Last Reviewed 23-Oct-2026)
Microsoft DP-700 Practice Test 13 - 10 Questions (Last Reviewed 22-Oct-2026)

Pass Your Microsoft DP-700 Exam Easy!

Question 100

Explanation

Correct Answer

Incorrect Answers

Question 101

Explanation

Correct Answer

Incorrect Answers

Question 102

Explanation

Correct Answer

Incorrect Answers

Question 103

Explanation

Correct Answer

Incorrect Answers

Question 104

Explanation

Correct Answer

Incorrect Answers

Question 105

Explanation

Correct Answer

Incorrect Answers

Question 106

Explanation

Correct Answers

Incorrect Answers

Question 107

Explanation

Correct Answer

Incorrect Answers

Question 108

Explanation

Correct Answer

Incorrect Answers

Question 109

Explanation

Correct Answer

Incorrect Answers

Question 110

Explanation

Correct Answer

Incorrect Answers

Implementing Data Engineering Solutions Using Microsoft Fabric (DP-700) Practice Tests