Microsoft DP-700 Practice Test 12

Question 110

An external auditor was supposed to inspect only one shared Fabric lakehouse. The administrator assigned the auditor workspace Viewer instead of sharing the individual item. The auditor can now also discover unrelated notebooks and pipelines. What caused the excess visibility?

A lakehouse OneLake Read role automatically grants visibility into every notebook in the workspace.
The lakehouse and the notebooks must use different Spark runtimes to isolate their navigation.
Workspace Viewer grants access to visible content across that workspace, whereas sharing only the lakehouse item would avoid the broad workspace grant.
A sensitivity label on the lakehouse automatically shares every other workspace item with the auditor.

Explanation

Correct Answer

Viewer is a workspace-level role and therefore exposes unrelated workspace items. Restricting the principal to the one shared lakehouse item addresses the audited scope without a broad workspace membership.

Incorrect Answers

OneLake data roles govern specific tables and folders; they are not the source of broad notebook and pipeline item discoverability in the workspace.

Notebook runtime choices do not reduce the workspace-wide visibility conferred by a Fabric workspace role.

Classification labels describe protection requirements and do not independently add workspace Viewer membership or share unrelated notebooks.

Question 111

Following item-level sharing with an auditor, which outcome verifies the security boundary?

Open the lakehouse as its owner and assume the auditor will have identical scope.
Test only whether the auditor can follow the shared link to its item details page.
Create an extra unrestricted workspace membership for the auditor to make the test succeed.
Use the auditor’s identity to open the shared lakehouse, read only the approved data, and confirm they cannot open or modify unrelated workspace items.

Explanation

Correct Answer

Testing both shared-item success and cross-item denial confirms item sharing was not accidentally widened into workspace membership.

Incorrect Answers

The owner likely has elevated workspace and item permissions; the auditor must be tested separately for both granted and prohibited operations.

Item discovery is not proof that the intended data is readable, and it says nothing about access to unrelated notebooks or workspaces.

Granting a workspace role changes the access profile under test and defeats item-only least privilege, rather than validating the existing scoped share.

Question 112

An analyst should run a query against a single approved warehouse view, while seeing no metadata or SELECT access to other financial objects. Which protection mechanism applies?

Grant narrowly scoped access to the approved SQL view and review object/metadata visibility permissions on the same SQL query surface.
Grant SELECT on the entire Finance schema rather than on the approved view.
Grant a database-wide VIEW DEFINITION permission to help the analyst discover the selected view.
Define a OneLake folder role on an unrelated lakehouse as the only warehouse security setting.

Explanation

Correct Answer

Object-level SQL security can permit a specific view without granting broad table access; metadata visibility needs independent inspection.

Incorrect Answers

Schema-wide SELECT can expose unrelated sensitive base tables. The stated scope is one approved view plus controlled metadata visibility.

Database-wide metadata grants reveal definitions of unrelated objects, violating the demand to hide other financial object metadata.

OneLake folder authorization cannot replace object-granular SQL VIEW and SELECT controls within the Fabric Warehouse.

Question 113

An analyst has SELECT on a warehouse view but cannot list every underlying table definition. What is the likely reason?

A view SELECT grant automatically allows listing all other warehouse tables and schemas.
SELECT on a specific SQL object does not imply broad metadata visibility or SELECT on unrelated underlying objects.
A SQL view is executable only after its definition is copied to a Spark environment.
All base-table metadata becomes public because the user can query a view over it.

Explanation

Correct Answer

SQL object permissions and metadata exposure can be separately scoped for a principal with a least-privilege role.

Incorrect Answers

SQL object-level authorization and metadata visibility are separate; permission on one view does not confer unrestricted catalog and object access.

A warehouse view is resolved by the SQL endpoint. Spark libraries are not a prerequisite for selecting from the view or limiting unrelated metadata.

Metadata visibility can remain restricted even when a principal can SELECT the approved view; the user need not have broad underlying object grants.

Question 114

An auditor reviews a restricted warehouse access profile. What direct test best demonstrates that metadata and data are both properly scoped?

Execute SELECT only as the warehouse owner and inspect the result of the approved view.
Check the view name and schema in the catalog without testing data access.
As the analyst, query the allowed view, attempt SELECT on a protected base table and inspect catalog metadata visibility, recording the expected restrictions.
Confirm that an unrelated Dataflow Gen2 refresh finished successfully.

Explanation

Correct Answer

An actual SQL query and catalog check distinguish approved view access from unapproved base-table and definition discovery.

Incorrect Answers

Owner rights do not validate the analyst’s inability to read protected base objects or see disallowed metadata.

A visible SQL object name does not establish permission to execute it or restrictions on other table definitions.

Dataflow execution is unrelated to the analyst’s SQL SELECT rights and catalog metadata filtering.

Question 115

A user is a member of the correct OneLake table role but still receives a permission error through a lakehouse SQL analytics endpoint in user identity mode. Which diagnostic path is appropriate?

Create the OneLake role but omit explicit Fabric Read on the consumer lakehouse.
Switch the endpoint to delegated identity solely to make the error disappear.
Manually edit generated SQL roles prefixed OLS_ instead of repairing the source OneLake role.
Check the user’s explicit Fabric item Read permission, exact producer/consumer identity mapping, OneLake role membership and SQL endpoint security synchronization.

Explanation

Correct Answer

In user identity mode all layers must line up. A OneLake role alone does not replace a matching item Read grant or synchronized endpoint role.

Incorrect Answers

A correct OneLake data role cannot by itself satisfy the item Read prerequisite for user-identity SQL endpoint access, including strict producer-consumer identity matching.

Delegated mode changes the security semantics and can bypass caller-specific OneLake restrictions rather than repairing the missing role or synchronization.

OLS_-prefixed roles are platform-managed. Manual changes are overwritten by synchronization and cannot be relied upon to fix the data authorization chain.

Question 116

The OneLake role for a table exists, but a user identity SQL endpoint shows no corresponding `OLS_` database role yet. What explains the denial?

The OneLake security role has not successfully propagated to the SQL endpoint, so its effective enforcement metadata is incomplete.
The physical Delta data files were not compacted after the security role was created.
The SQL endpoint always ignores OneLake roles in user identity mode.
The user must receive workspace Admin privileges to trigger security synchronization.

Explanation

Correct Answer

User identity mode relies on synchronized OneLake role definitions; missing OLS-prefixed roles indicates a sync or broken-reference problem.

Incorrect Answers

Compaction cannot explain the absence of the corresponding OLS_ security role in SQL endpoint metadata.

User-identity mode supports OneLake policy enforcement, but the roles must successfully synchronize and match the relevant identities.

Granting broad administration is not a fix for failed OneLake-to-SQL security propagation. Check role references and metadata sync instead.

Question 117

After changing table-level OneLake roles, which verification most directly establishes the SQL endpoint now honors them?

Confirm the custom OneLake role exists only in the lakehouse settings page.
Confirm the expected OLS-prefixed roles appear in the SQL endpoint and retry an allowed and denied SELECT under matching user or group identity.
Query the same table as an elevated workspace Member and skip an unauthorized user test.
Change the SQL endpoint caching policy and infer that the policy has propagated.

Explanation

Correct Answer

Role synchronization plus effective SQL query results demonstrate both metadata propagation and the intended principal/table boundary.

Incorrect Answers

The source role definition alone does not prove its translation to SQL OLS_ roles or effective grants for a real querying identity.

An elevated user can access local data despite restrictions, masking a sync defect that affects Viewer or read-shared users.

Caching is not the role synchronization mechanism. Validate generated OLS_ roles and allowed/denied queries under the intended principal.

Question 118

An employee leaves the Analytics team. Their OneLake table permissions come solely from an assigned Entra security group, and access must be revoked. What should the administrator do?

Remove only a direct Fabric sharing entry and leave the employee in the Entra group providing OneLake Read.
Remove the employee from the workspace list but leave OneLake role memberships inherited through groups.
Remove the user from the authorized Entra group and verify there are no alternate direct grants or additional group memberships, allowing for documented propagation.
Delete the entire OneLake reader role for the Analytics team.

Explanation

Correct Answer

Membership removal terminates the intended group-based permission only when no other grant path remains and effective access refreshes.

Incorrect Answers

Group membership would continue to grant data access; offboarding must eliminate the stated effective group-based authorization path.

Item and workspace membership are not the only access mechanisms. A retained group-derived data role may continue to authorize the table.

Removing the shared role would revoke legitimate colleagues’ access. Change the departing identity’s membership and inspect other inherited grants.

Question 119

A departed analyst was removed from one security group but can still read a secured lakehouse table. A second authorized group contains the same identity. Why?

Removing one group membership automatically revokes every other group-derived Read grant.
Disabling Delta data skipping invalidates the user’s OneLake session permissions.
Renaming the table deletes all Entra membership records for former employees.
OneLake permissions are additive across applicable role/grant memberships, so a separate group can still confer table Read access.

Explanation

Correct Answer

Removing a principal from one role does not guarantee revocation when another effective group or direct share authorizes the same object.

Incorrect Answers

OneLake unions permissions from all applicable groups. A separate active group membership can preserve access even after one removal.

Data skipping concerns Parquet/Delta scan efficiency and does not govern the effective Entra-to-OneLake group grants.

Changing a data item name does not remove identities from security groups. The second group remains an authorization path.

Question 120

During offboarding, an analyst’s account is still enabled for a controlled revocation test before deactivation. Their group-derived lakehouse permissions have just been removed. Which evidence establishes that effective data access was revoked?

Enumerate the identity’s remaining effective grants and re-test the formerly accessible table and file paths using the removed account after propagation.
Check only the first group from which the employee was removed.
Query the lakehouse with the security administrator’s account rather than the removed employee.
Observe that a scheduled refresh ran after the offboarding date, without testing data reads.

Explanation

Correct Answer

Review the user’s remaining direct and group-derived grants, allow documented propagation, then test denied reads with the still-active account in the controlled offboarding window. Deactivate the account after completing the required access checks.

Incorrect Answers

The identity could remain authorized through a different Entra group or an explicit OneLake role assignment; all effective grants must be inspected.

The security administrator’s privileges do not demonstrate effective revocation of the departed user.

Pipeline success is not evidence that the former employee’s identity lost table and file access after permission propagation.

Implementing Data Engineering Solutions Using Microsoft Fabric (DP-700) Practice Tests

Microsoft DP-700 Practice Test 10 - 10 Questions (Last Reviewed 25-Oct-2026)
Microsoft DP-700 Practice Test 11 - 10 Questions (Last Reviewed 24-Oct-2026)
Microsoft DP-700 Practice Test 12 - 10 Questions (Last Reviewed 23-Oct-2026)
Microsoft DP-700 Practice Test 13 - 10 Questions (Last Reviewed 22-Oct-2026)
Microsoft DP-700 Practice Test 14 - 10 Questions (Last Reviewed 21-Oct-2026)

Pass Your Microsoft DP-700 Exam Easy!

Question 110

Explanation

Correct Answer

Incorrect Answers

Question 111

Explanation

Correct Answer

Incorrect Answers

Question 112

Explanation

Correct Answer

Incorrect Answers

Question 113

Explanation

Correct Answer

Incorrect Answers

Question 114

Explanation

Correct Answer

Incorrect Answers

Question 115

Explanation

Correct Answer

Incorrect Answers

Question 116

Explanation

Correct Answer

Incorrect Answers

Question 117

Explanation

Correct Answer

Incorrect Answers

Question 118

Explanation

Correct Answer

Incorrect Answers

Question 119

Explanation

Correct Answer

Incorrect Answers

Question 120

Explanation

Correct Answer

Incorrect Answers

Implementing Data Engineering Solutions Using Microsoft Fabric (DP-700) Practice Tests