Microsoft DP-700 Practice Test 9

Question 80

An analyst can open a Fabric workspace and see a warehouse listed, but receives a SELECT permission denial on a protected table. Which distinction explains this?

Workspace visibility or warehouse connection capability is separate from permission to read each protected SQL object.
Warehouse table security is inherited from the Finance workspace display name.
The analyst’s default lakehouse attachment was removed from the SQL endpoint.
The protected table must have a Delta VACUUM job before SELECT can succeed.

Explanation

Correct Answer

An item can be discoverable without blanket data access; the SQL engine evaluates the object or schema access policy at query time.

Incorrect Answers

Names and catalog labels cannot grant or deny object-level SELECT. The presence of the warehouse item does not imply rights to each protected table.

Warehouse T-SQL object authorization is independent of a notebook’s default lakehouse attachment. The denial concerns a table grant or SQL role.

A table-retention operation does not issue data-plane SQL permissions. The analyst can connect to the warehouse but lacks SELECT at the relevant object scope.

Question 81

An administrator restricts one warehouse table to Finance. What evidence should be collected for a release audit?

Run the protected SELECT as the warehouse owner and record that it succeeds.
Execute SELECT against the protected table as Finance and non-Finance test principals, documenting the allowed response and expected permission error.
Check only that the warehouse is visible under the Finance domain.
Inspect the T-SQL view definition without executing it under the intended reader identities.

Explanation

Correct Answer

Testing the actual warehouse connection and object under distinct effective identities demonstrates SQL-level authorization rather than just listing workspace roles.

Incorrect Answers

The owner’s broader permissions do not establish the Finance-only access rule or denial for an unauthorized SQL principal.

Domain organization and item listing are not evidence of an effective object-level SQL SELECT restriction.

A definition is not an effective permission test. The controlled positive and denied SELECT outcomes must be observed for separate principals.

Question 82

A customer-support dashboard queries a Fabric Warehouse using T-SQL. Support users should see masked email values, but a specifically privileged role must see originals. Which SQL feature fits this display-level requirement?

Use SQL column-level security to hide the email field from all unprivileged SELECT results.
Use row-level security to omit all customers with populated email addresses.
Apply a supported dynamic data masking rule to the column and grant UNMASK only to principals authorized to view the underlying value.
Mask email strings only in the dashboard front end while leaving warehouse T-SQL unrestricted.

Explanation

Correct Answer

DDM changes the value returned to nonprivileged readers on supported SQL surfaces; it is not a physical rewrite or access denial mechanism.

Incorrect Answers

Hiding the entire email column fails the requirement to display a masked value in the existing support dashboard. Dynamic masking allows the column while obfuscating its returned content.

Removing customer rows prevents legitimate support totals and is not a display-level substitution of just the sensitive email text.

Client-side display formatting does not govern independent SQL queries against the same Warehouse. Server-enforced DDM with privilege scoping is needed.

Question 83

A masked email column appears in full for one warehouse user but masked for others. That user has UNMASK privileges. Why is the returned value different?

A masked column is automatically decrypted whenever its table is cached.
The privileged user ran a Spark OPTIMIZE command before querying Warehouse.
A sensitivity label alone makes selected users see the original SQL value.
The effective user has an exemption from the dynamic data masking policy through UNMASK rights.

Explanation

Correct Answer

Dynamic masking evaluates the querying principal’s permissions. It is normal for privileged roles to receive originals while ordinary readers see transformed display values.

Incorrect Answers

Result caching is not the documented reason one designated user sees plaintext while other users see masked output. UNMASK permission creates that privilege difference.

Delta file compaction does not determine T-SQL dynamic-data-masking exemptions. The read identity has UNMASK on the relevant column.

Classification labels and SQL masking permissions are distinct. The user’s effective UNMASK privilege explains the unmasked result.

Question 84

After implementing SQL dynamic data masking, which result is the strongest evidence of the required separation?

Run the same SELECT as a general support principal and as the designated UNMASK principal, comparing the returned email values without changing stored data.
Inspect only the `MASKED WITH` clause as a Warehouse administrator.
Run both comparisons using the same UNMASK account, changing only a WHERE predicate.
Read the raw email values from the physical source files and infer how SQL clients render them.

Explanation

Correct Answer

Identity-based output comparison demonstrates actual masking and its exception; checking only the stored column definition or row count is insufficient.

Incorrect Answers

The DDL can be present while effective permissions permit bypass. Verification requires querying with both masked and authorized-unmasked identities.

A filter does not simulate different identities. To test display-level separation, the two principals must have different effective masking privileges.

Dynamic data masking does not rewrite source bytes, and a raw-storage read bypasses the intended SQL result display behavior.

Question 85

A data product is ready for wider organization-wide discovery. Its owner wants consumers to distinguish a vetted, trustworthy item from ordinary drafts. Select TWO appropriate governance actions.

Submit the eligible Fabric item for endorsement through the organization’s authorized certification workflow rather than relying on an informal name or owner statement.
Mark the item Promoted and tell consumers that the promoted badge is identical to independent certification.
Confirm the required endorsement approver role and validate the displayed endorsement on the exact approved item.
Grant all workspace Viewers the ability to certify any item themselves.
Put Certified in the description field instead of using Fabric endorsement metadata.

Explanation

Correct Answers

Certification is an explicit Fabric endorsement status controlled by authorized certifiers. An owner may promote eligible items, but promotion alone must not be presented as the same independent trust signal as Certified status.

Certification and promotion have different authority requirements; verifying the correct item and approved badge avoids overstating governance approval.

Incorrect Answers

Promotion is an endorsement but does not mean an authorized certifier vetted the content. The workflow and actual status must not misstate the level of organizational trust.

Certification is controlled by designated approvers; broadening certification rights to all viewers undermines the required trust governance.

A description is owner-authored prose, not a platform endorsement with recorded organizational certification status.

Question 86

A workspace contributor expects to mark an item Certified but only a designated reviewer can certify artifacts. Why might the action be unavailable?

Workspace Contributor rights automatically include the organizational certification-authority role.
The lakehouse lacks a dataset-level Row Access Policy, which is mandatory for certification.
Certification requires governance authorization granted to approved certifiers; ordinary item-edit permissions do not automatically grant it.
The item must first be exported to Power BI before Fabric can certify it.

Explanation

Correct Answer

The endorsement workflow distinguishes content ownership from the organizational role permitted to assign certified status.

Incorrect Answers

An edit-capable workspace role does not by itself confer permission to certify an asset on behalf of the organization. Certification requires an approved certifier role.

Row restrictions are separate security controls, not the reason a Contributor lacks the Fabric endorsement permission for Certified status.

The supported Fabric endorsement workflow applies to eligible Fabric items; exporting a lakehouse cannot substitute for organizational certification authority.

Question 87

An item owner says an endorsed lakehouse has been certified for use. Which evidence should a reviewer inspect?

Confirm only that the item name begins with Certified.
Review a screenshot of a different lakehouse in the same Fabric domain.
Check the user count in the workspace without inspecting any endorsement field.
Inspect the specific lakehouse item and its current endorsement state, ensuring Certified rather than merely Promoted and identifying the approving process.

Explanation

Correct Answer

The current endorsement of the exact item is the relevant trust evidence, while naming or workspace presence alone cannot distinguish promotion from certification.

Incorrect Answers

Display names are not trusted endorsement metadata. Promoted and Certified are explicit different states recorded on the item.

Certification is item-specific. A sibling asset’s endorsement cannot establish that this exact lakehouse is Certified.

Workspace membership is unrelated to whether authorized certifiers approved the claimed asset and the current badge reflects that status.

Question 88

A regulated Fabric lakehouse must display its sensitivity classification in the item metadata, so approved integrations can recognize the classification. What should the data owner use?

Apply the organization’s authorized Microsoft Purview sensitivity label to the supported Fabric item and verify any required inheritance policy.
Give all approved consumers a OneLake Read role and treat that as a classification label.
Set a custom table property named sensitivity=Confidential without applying an item label.
Add the word Confidential to the lakehouse display name.

Explanation

Correct Answer

Sensitivity labels carry information-protection classification metadata. They are distinct from row/table access grants and must be applied through supported labeling controls.

Incorrect Answers

An authorization role specifies who can read data; it does not attach a Purview sensitivity label to the lakehouse for downstream classification and discovery.

A SQL or Delta metadata property is not necessarily recognized as the Fabric item’s official Purview sensitivity label by supported integrations.

Naming text can suggest sensitivity but carries none of the standardized Purview label metadata or policy behavior needed for reliable integrations.

Question 89

A lakehouse is labeled Confidential, but an unapproved reader still has access through a broad workspace Contributor grant. Why is this possible?

The Confidential label converts every Contributor into a read-only Viewer.
A sensitivity label does not itself revoke an existing broad Fabric data permission; access grants must be reviewed separately.
A label is treated as an explicit OneLake DENY on all files by default.
The lakehouse must run VACUUM before its label is enforced.

Explanation

Correct Answer

Classification and authorization are different controls. A label can coexist with elevated workspace permissions that already permit read/write access.

Incorrect Answers

Sensitivity labeling is not a workspace-role override. The user retains Contributor’s elevated item and data access unless that grant is changed.

OneLake authorization uses roles and grants; an information-protection classification alone does not revoke an existing broad workspace Write permission.

Delta cleanup is unrelated to the authorization granted by the Contributor role. A label can be present while the effective user still has write-capable access.

Question 90

The privacy team labeled a Fabric lakehouse and expects supported consumers to see its classification. Which acceptance check is appropriate?

Inspect the workspace sensitivity-label dropdown without checking the target item.
Open the source lakehouse as its owner and assume every exported file inherits its label.
Inspect the sensitivity label on the intended source item and on each supported downstream destination, taking documented propagation rules into account.
Check whether the table’s Delta files have been optimized instead of viewing label metadata.

Explanation

Correct Answer

A successful label assignment must be confirmed on actual items and consumers; the label does not necessarily propagate through every conversion or export.

Incorrect Answers

A workspace setting is not proof that the specified lakehouse and downstream exported artifacts carry the intended label.

Propagation varies by supported operation and destination. Classification on the source does not guarantee the export retained it.

File-layout maintenance cannot establish the Purview sensitivity label attached to the item or a specific downstream artifact.

Implementing Data Engineering Solutions Using Microsoft Fabric (DP-700) Practice Tests

Microsoft DP-700 Practice Test 7 - 10 Questions (Last Reviewed 28-Oct-2026)
Microsoft DP-700 Practice Test 8 - 10 Questions (Last Reviewed 27-Oct-2026)
Microsoft DP-700 Practice Test 9 - 10 Questions (Last Reviewed 26-Oct-2026)
Microsoft DP-700 Practice Test 10 - 10 Questions (Last Reviewed 25-Oct-2026)
Microsoft DP-700 Practice Test 11 - 10 Questions (Last Reviewed 24-Oct-2026)

Pass Your Microsoft DP-700 Exam Easy!

Question 80

Explanation

Correct Answer

Incorrect Answers

Question 81

Explanation

Correct Answer

Incorrect Answers

Question 82

Explanation

Correct Answer

Incorrect Answers

Question 83

Explanation

Correct Answer

Incorrect Answers

Question 84

Explanation

Correct Answer

Incorrect Answers

Question 85

Explanation

Correct Answers

Incorrect Answers

Question 86

Explanation

Correct Answer

Incorrect Answers

Question 87

Explanation

Correct Answer

Incorrect Answers

Question 88

Explanation

Correct Answer

Incorrect Answers

Question 89

Explanation

Correct Answer

Incorrect Answers

Question 90

Explanation

Correct Answer

Incorrect Answers

Implementing Data Engineering Solutions Using Microsoft Fabric (DP-700) Practice Tests