Microsoft DP-700 Practice Test 8

Question 70

A contractor may read `Files/exports/public` in a lakehouse, but not `Files/exports/payroll`. Which TWO controls help enforce this boundary?

Keep lakehouse-wide ReadAll while adding a separate narrow public-folder security role.
Assign lakehouse item Read plus a OneLake security role granting Read on the intended public folder only.
Move payroll underneath a directory labeled Confidential but grant the parent exports folder.
Remove any broad DefaultReader or ReadAll path that would also grant payroll, and test the role with the contractor identity.
Define a SQL-endpoint DENY on payroll and assume all OneLake Files API reads are denied.

Explanation

Correct Answers

Both item-level discovery and folder-scoped data authorization are necessary for read-only external personnel.

OneLake grants are additive; an existing role with broader scope defeats the intended narrow folder permission.

Incorrect Answers

A custom public Read grant cannot subtract the existing broader DefaultReader grant. The contractor would retain payroll access despite the apparently restrictive role.

Folder names and sensitivity descriptions do not block inherited OneLake Read. Granting the exports parent includes both public and payroll descendants.

SQL data-plane permissions do not create a filesystem permission boundary on Files/exports/payroll. A separate OneLake security role must govern the direct file path.

Question 71

A contractor has a role limited to `Files/exports/public`, yet still reads `Files/exports/payroll`. The lakehouse DefaultReader grants all Files to this user through ReadAll. What explains the leakage?

The public folder role implicitly denies every sibling folder, including payroll.
The shortcut for the public folder mistakenly points to a payroll folder.
The payroll file name was discovered through OneLake catalog search, which automatically grants read.
A second broader grant is still effective; the narrow role does not deny the access already supplied by DefaultReader.

Explanation

Correct Answer

OneLake security uses GRANT-type roles rather than explicit DENY roles. To enforce folder isolation, broad role memberships must be removed or scoped down.

Incorrect Answers

OneLake roles are additive grants, not DENY rules. A narrow grant does not cancel a second all-Files grant from DefaultReader.

The question states the contractor can read a separate payroll path with an existing all-Files grant. That broader grant, not an assumed shortcut misdirection, explains access.

Discovery or a known file name does not confer data permission. Effective ReadAll-backed DefaultReader membership remains sufficient to authorize the folder despite the narrow custom role.

Question 72

After restricting a contractor to `Files/exports/public`, which verification most directly proves least-privilege enforcement?

Authenticate with the contractor’s identity and test listing and reading an approved public file while testing a payroll file for access denial.
Read the role-definition screenshot as the lakehouse owner and stop without an access test.
Open the public folder as a workspace Admin and compare its file count.
Verify that the payroll path is hidden from the Files navigation tree only.

Explanation

Correct Answer

The effective read checks on both granted and non-granted paths reveal unwanted inherited or overlapping authorization that role names cannot prove.

Incorrect Answers

The saved custom role may be narrow but a separate DefaultReader grant can remain. Owner-side inspection alone does not test the contractor’s effective union of roles.

A workspace Admin has elevated OneLake rights and cannot demonstrate that the contractor is denied the excluded payroll folder.

UI visibility is not evidence that OneLake API or compatible client reads are denied to the authenticated contractor. Authorization must be tested on the target path.

Question 73

Regional analysts should query a sales Delta table but see only rows matching their assigned territory. Which configuration controls the row filter when they read with an eligible OneLake-aware engine?

Create a T-SQL row policy on a delegated SQL endpoint only, while keeping direct Spark table reads.
Define a territory-based row-level security predicate in the relevant OneLake security role and assign the appropriate analyst identities.
Hide the territory column through column-level security but grant all rows.
Apply a report-level territory filter and leave the shared Delta table unrestricted.

Explanation

Correct Answer

Row-level security restricts rows within a granted Delta table; role membership must correspond to the intended user groups and supported query engine.

Incorrect Answers

A SQL-only security policy cannot enforce the same restriction on a OneLake-aware Spark read path. Define RLS at OneLake for the supported Delta source and use eligible engines.

Column-level security controls which attributes a user can select; it cannot restrict sales transactions to the user’s permitted territory rows.

A report visual filter affects only that report path and does not constrain authorized readers querying the Delta table through another supported OneLake engine.

Question 74

A regional analyst sees every territory despite a restricted OneLake role. The analyst is also a workspace Contributor and belongs to another role granting unrestricted access to this table. Select TWO relevant explanations or corrective checks.

The more permissive overlapping role can override the restricted view, so correct conflicting role memberships or grant scopes.
A territory label on the lakehouse is missing, so RLS cannot be used.
Test the read under a Viewer/read-only identity using a supported enforcement mode rather than relying on Contributor workspace access.
The Delta table is not partitioned on the territory column, making the filter unenforceable.
The SQL endpoint lacks a masking rule, so all row filtering is bypassed.

Explanation

Correct Answers

OneLake security roles combine permissive grants; a user who also has all-table access may not be filtered as expected.

Contributor has elevated data permissions for local tables; the access boundary and identity mode must be validated separately from the RLS expression.

Incorrect Answers

Fabric governance labels do not determine which territory rows an identity reads. RLS can exist while other effective permissions bypass or widen it.

Physical partitioning can improve scans but is not a prerequisite for a OneLake row filter. The analyst’s Contributor role and unrestricted overlapping grant are direct security causes.

Dynamic data masking changes selected column display values; it does not apply the territory row predicate across supported OneLake-aware engines.

Question 75

A role uses territory-based row-level security. What is the best acceptance test for both tenant separation and the approved exceptions?

Execute a query only as an unrestricted workspace Contributor and inspect a total row count.
Check that the RLS role contains a territory predicate without testing group memberships.
Verify that each territory name appears in the catalog, then declare row-level separation proven.
Query the same table as test identities from two different territories and an unassigned identity; reconcile each visible row set with the allowed territories.

Explanation

Correct Answer

Different effective users must produce independently constrained results. Testing one administrator or looking only at role definitions cannot establish the filtering is enforced.

Incorrect Answers

Contributors may bypass local OneLake RLS, so their result cannot demonstrate isolation among differently assigned regional readers.

A syntactically present predicate cannot rule out broad grants via DefaultReader or a different group. Real per-identity query results are required.

Catalog discoverability does not constrain table row sets. The result must be compared for two restricted identities and a user with no assigned territory.

Question 76

Finance needs analysts to query permitted general-ledger totals while preventing access to the `private_bank_account` column in supported OneLake-aware Delta table reads. Which control restricts that column rather than merely masking a displayed SQL value?

Configure a warehouse SQL dynamic mask for the bank-account column without a OneLake role.
Add a row-level policy that excludes records with populated bank-account values.
Apply an appropriate column-level security restriction for that column in the data access role assigned to the analyst group.
Apply a Purview Confidential sensitivity label and leave column grants unchanged.

Explanation

Correct Answer

Column-level security controls accessible Delta-table columns for participating identities and supported engines, unlike layout or catalog tagging.

Incorrect Answers

Dynamic data masking obscures values in eligible SQL query results; it does not prevent selection of the original Delta column through OneLake-aware reads.

Row-level filtering would remove whole ledger records and distort allowed totals instead of preventing exposure of only private_bank_account.

A sensitivity label provides information-protection classification, not the column allow-list enforcement required for direct data reads.

Question 77

An analyst can still query a sensitive column after a restricted-column role was created. The analyst is also in a broader all-column access role. What is the likely authorization cause?

Column-level security blocks a column only when it is physically the last field.
The user has an overlapping grant that still includes the sensitive column, so the effective group/role memberships must be corrected.
Masking on the SQL endpoint can be used to deny direct access to the Delta column.
The column has not been encrypted with a notebook library, so OneLake ignores CLS.

Explanation

Correct Answer

With grant-based OneLake roles, creating a second narrow role does not subtract an existing broad column permission.

Incorrect Answers

CLS operates on a column allow list in OneLake and does not depend on Delta column order. A second grant containing the column is the relevant discrepancy.

Dynamic data masking conceals values in supported SQL result sets; it is not equivalent to an effective OneLake CLS restriction for the analyst’s Delta-table path.

A notebook cryptography library is not a prerequisite for OneLake security roles. The conflicting all-column membership makes the column available.

Question 78

A new column-level restriction is applied to a Delta table. Which test verifies the intended boundary instead of checking only configuration metadata?

Inspect the CLS role configuration while signed in as a privileged workspace Member.
Query only columns unrelated to the protected bank-account field and assume it is hidden.
As the restricted analyst, query permitted columns successfully and attempt a query explicitly selecting the blocked sensitive column; also test the authorized reader.
Confirm that the sensitive column is absent from a report visual but do not attempt to query it.

Explanation

Correct Answer

The protected-column denial and permitted-column success show actual column-level enforcement and avoid confusing item discovery with data access.

Incorrect Answers

Privileged workspace roles can bypass OneLake restrictions on local tables. A configuration screenshot under an elevated identity cannot prove restricted users cannot select the column.

A successful allowed projection does not establish denial of an explicit unauthorized column read; both positive and negative paths must be checked.

Reports can omit a field without changing database authorization. The analyst may still be able to select it directly unless effective CLS is enforced.

Question 79

An analyst has Finance workspace Viewer access and can open the Warehouse, but must not query its protected `payroll_compensation` object through the Warehouse T-SQL endpoint. Which scoped control addresses this requirement?

Grant warehouse Read at the item level without reviewing protected SQL object privileges.
Restrict only a dashboard semantic model that reads the warehouse.
Add a OneLake role to an unrelated Finance lakehouse instead of the warehouse.
Configure an appropriate warehouse SQL object permission or role that omits SELECT on the protected object, and avoid a broader data grant that bypasses it.

Explanation

Correct Answer

Warehouse query access is governed by SQL/data permissions for the relevant object and identity; visibility of the workspace is not equivalent to SELECT permission.

Incorrect Answers

Item discovery and connection are separate from object-level SELECT permissions. Broad item access alone does not specifically restrict the payroll_compensation object.

An end-user could connect directly through T-SQL; semantic-model filters cannot replace authorization on the protected warehouse SQL object.

OneLake roles on a different item do not enforce granular SQL permissions on the Warehouse object being queried.

Question 80

An analyst can open a Fabric workspace and see a warehouse listed, but receives a SELECT permission denial on a protected table. Which distinction explains this?

Workspace visibility or warehouse connection capability is separate from permission to read each protected SQL object.
Warehouse table security is inherited from the Finance workspace display name.
The analyst’s default lakehouse attachment was removed from the SQL endpoint.
The protected table must have a Delta VACUUM job before SELECT can succeed.

Explanation

Correct Answer

An item can be discoverable without blanket data access; the SQL engine evaluates the object or schema access policy at query time.

Incorrect Answers

Names and catalog labels cannot grant or deny object-level SELECT. The presence of the warehouse item does not imply rights to each protected table.

Warehouse T-SQL object authorization is independent of a notebook’s default lakehouse attachment. The denial concerns a table grant or SQL role.

A table-retention operation does not issue data-plane SQL permissions. The analyst can connect to the warehouse but lacks SELECT at the relevant object scope.

Implementing Data Engineering Solutions Using Microsoft Fabric (DP-700) Practice Tests

Microsoft DP-700 Practice Test 6 - 10 Questions (Last Reviewed 29-Oct-2026)
Microsoft DP-700 Practice Test 7 - 10 Questions (Last Reviewed 28-Oct-2026)
Microsoft DP-700 Practice Test 8 - 10 Questions (Last Reviewed 27-Oct-2026)
Microsoft DP-700 Practice Test 9 - 10 Questions (Last Reviewed 26-Oct-2026)
Microsoft DP-700 Practice Test 10 - 10 Questions (Last Reviewed 25-Oct-2026)

Pass Your Microsoft DP-700 Exam Easy!

Question 70

Explanation

Correct Answers

Incorrect Answers

Question 71

Explanation

Correct Answer

Incorrect Answers

Question 72

Explanation

Correct Answer

Incorrect Answers

Question 73

Explanation

Correct Answer

Incorrect Answers

Question 74

Explanation

Correct Answers

Incorrect Answers

Question 75

Explanation

Correct Answer

Incorrect Answers

Question 76

Explanation

Correct Answer

Incorrect Answers

Question 77

Explanation

Correct Answer

Incorrect Answers

Question 78

Explanation

Correct Answer

Incorrect Answers

Question 79

Explanation

Correct Answer

Incorrect Answers

Question 80

Explanation

Correct Answer

Incorrect Answers

Implementing Data Engineering Solutions Using Microsoft Fabric (DP-700) Practice Tests