Microsoft Fabric Data Engineer DP-700 Security, Governance And OneLake Access Control Practice Test

 

Topic 03 covers security, governance and onelake access control for Microsoft DP-700 practice. Study each scenario and select the best answer. For broader exam preparation, review the Microsoft DP-700 Exam Dumps page.

Question 1

For a global manufacturing data product, the organization has fixed the following constraint: the user must consume one analytics item without creating or editing workspace content. Which action best satisfies the requirement?

1. Assign Contributor only when the user must create or modify workspace content
2. Use item sharing instead of elevating the user to a broad workspace role
3. Use Member or Admin when the person must manage OneLake security roles
4. Keep an external consumer out of the authoring workspace and share only the approved item
5. Assign the user the Viewer workspace role and grant only the required item read permission

Correct Answer: E

Correct Answer

Answer E is correct because Viewer plus item permission limits management capability while allowing controlled consumption. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when an engineer needs to build and update Fabric items but must not manage workspace membership. Specifically, Contributor provides content authoring without Member/Admin membership-management capability, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when a person needs access to one item but not every item in the workspace. Specifically, item-level permission avoids unnecessary workspace-wide access, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when the user must create or edit granular OneLake security definitions. Specifically, OneLake security management requires the elevated workspace roles that can manage those roles, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when the consumer should not inherit access to unrelated workspace items. Specifically, item-scoped sharing is safer than broad workspace membership for a single deliverable, which does not resolve the decisive condition in this scenario.

Question 2

During an operational design review for a governed self-service analytics domain, engineers confirm that an engineer needs to build and update Fabric items but must not manage workspace membership. What should they do?

1. Keep an external consumer out of the authoring workspace and share only the approved item
2. Assign the user the Viewer workspace role and grant only the required item read permission
3. Assign Contributor only when the user must create or modify workspace content
4. Use item sharing instead of elevating the user to a broad workspace role
5. Use Member or Admin when the person must manage OneLake security roles

Correct Answer: C

Correct Answer

Answer C is correct because Contributor provides content authoring without Member/Admin membership-management capability. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when the consumer should not inherit access to unrelated workspace items. Specifically, item-scoped sharing is safer than broad workspace membership for a single deliverable, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when the user must consume one analytics item without creating or editing workspace content. Specifically, Viewer plus item permission limits management capability while allowing controlled consumption, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when a person needs access to one item but not every item in the workspace. Specifically, item-level permission avoids unnecessary workspace-wide access, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when the user must create or edit granular OneLake security definitions. Specifically, OneLake security management requires the elevated workspace roles that can manage those roles, which does not resolve the decisive condition in this scenario.

Question 3

After a recent change in a financial reporting workspace, the team determines that a person needs access to one item but not every item in the workspace. Which implementation should be selected?

1. Use item sharing instead of elevating the user to a broad workspace role
2. Use Member or Admin when the person must manage OneLake security roles
3. Keep an external consumer out of the authoring workspace and share only the approved item
4. Assign the user the Viewer workspace role and grant only the required item read permission
5. Assign Contributor only when the user must create or modify workspace content

Correct Answer: A

Correct Answer

Answer A is correct because item-level permission avoids unnecessary workspace-wide access. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer B is incorrect because this action is appropriate when the user must create or edit granular OneLake security definitions. Specifically, OneLake security management requires the elevated workspace roles that can manage those roles, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when the consumer should not inherit access to unrelated workspace items. Specifically, item-scoped sharing is safer than broad workspace membership for a single deliverable, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when the user must consume one analytics item without creating or editing workspace content. Specifically, Viewer plus item permission limits management capability while allowing controlled consumption, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when an engineer needs to build and update Fabric items but must not manage workspace membership. Specifically, Contributor provides content authoring without Member/Admin membership-management capability, which does not resolve the decisive condition in this scenario.

Question 4

A Fabric engineering team is reviewing a healthcare operations workspace. The user must create or edit granular OneLake security definitions Which action is most appropriate?

1. Assign the user the Viewer workspace role and grant only the required item read permission
2. Assign Contributor only when the user must create or modify workspace content
3. Use item sharing instead of elevating the user to a broad workspace role
4. Use Member or Admin when the person must manage OneLake security roles
5. Keep an external consumer out of the authoring workspace and share only the approved item

Correct Answer: D

Correct Answer

Answer D is correct because OneLake security management requires the elevated workspace roles that can manage those roles. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when the user must consume one analytics item without creating or editing workspace content. Specifically, Viewer plus item permission limits management capability while allowing controlled consumption, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when an engineer needs to build and update Fabric items but must not manage workspace membership. Specifically, Contributor provides content authoring without Member/Admin membership-management capability, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when a person needs access to one item but not every item in the workspace. Specifically, item-level permission avoids unnecessary workspace-wide access, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when the consumer should not inherit access to unrelated workspace items. Specifically, item-scoped sharing is safer than broad workspace membership for a single deliverable, which does not resolve the decisive condition in this scenario.

Question 5

A data engineer must correct a design for an IoT operations solution. The decisive requirement is that the consumer should not inherit access to unrelated workspace items. Which choice best addresses it?

1. Use Member or Admin when the person must manage OneLake security roles
2. Keep an external consumer out of the authoring workspace and share only the approved item
3. Assign the user the Viewer workspace role and grant only the required item read permission
4. Assign Contributor only when the user must create or modify workspace content
5. Use item sharing instead of elevating the user to a broad workspace role

Correct Answer: B

Correct Answer

Answer B is correct because item-scoped sharing is safer than broad workspace membership for a single deliverable. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when the user must create or edit granular OneLake security definitions. Specifically, OneLake security management requires the elevated workspace roles that can manage those roles, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when the user must consume one analytics item without creating or editing workspace content. Specifically, Viewer plus item permission limits management capability while allowing controlled consumption, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when an engineer needs to build and update Fabric items but must not manage workspace membership. Specifically, Contributor provides content authoring without Member/Admin membership-management capability, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when a person needs access to one item but not every item in the workspace. Specifically, item-level permission avoids unnecessary workspace-wide access, which does not resolve the decisive condition in this scenario.

Question 6

For a regional supply-chain platform, the organization has fixed the following constraint: a Viewer needs data-plane access to only a subset of a lakehouse item. Which action best satisfies the requirement?

1. Apply row-level security in the OneLake role
2. Apply column-level security in the OneLake role
3. Remove or narrow a broader DefaultReader grant before relying on a restrictive role
4. Grant ReadWrite only to the selected folder or table through OneLake security when granular write is required
5. Create a OneLake security role scoped to the required table or folder

Correct Answer: E

Correct Answer

Answer E is correct because OneLake security roles can grant granular access to selected tables and folders. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when members of a role may read a table but must see only rows that satisfy a defined predicate. Specifically, OneLake role RLS constrains rows within the granted table, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when members need the table but must not see a sensitive column. Specifically, OneLake role CLS restricts selected columns while preserving access to permitted data, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when a user still sees all data despite being added to a more restrictive OneLake role. Specifically, a broader existing grant can continue to provide access, so it must be removed or narrowed, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when a user should write to a limited data scope without receiving broad workspace authoring permissions. Specifically, current OneLake security supports scoped ReadWrite for supported items, which does not resolve the decisive condition in this scenario.

Question 7

During an operational design review for a shared business intelligence platform, engineers confirm that members of a role may read a table but must see only rows that satisfy a defined predicate. What should they do?

1. Grant ReadWrite only to the selected folder or table through OneLake security when granular write is required
2. Create a OneLake security role scoped to the required table or folder
3. Apply row-level security in the OneLake role
4. Apply column-level security in the OneLake role
5. Remove or narrow a broader DefaultReader grant before relying on a restrictive role

Correct Answer: C

Correct Answer

Answer C is correct because OneLake role RLS constrains rows within the granted table. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when a user should write to a limited data scope without receiving broad workspace authoring permissions. Specifically, current OneLake security supports scoped ReadWrite for supported items, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when a Viewer needs data-plane access to only a subset of a lakehouse item. Specifically, OneLake security roles can grant granular access to selected tables and folders, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when members need the table but must not see a sensitive column. Specifically, OneLake role CLS restricts selected columns while preserving access to permitted data, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when a user still sees all data despite being added to a more restrictive OneLake role. Specifically, a broader existing grant can continue to provide access, so it must be removed or narrowed, which does not resolve the decisive condition in this scenario.

Question 8

After a recent change in an enterprise lakehouse program, the team determines that members need the table but must not see a sensitive column. Which implementation should be selected?

1. Apply column-level security in the OneLake role
2. Remove or narrow a broader DefaultReader grant before relying on a restrictive role
3. Grant ReadWrite only to the selected folder or table through OneLake security when granular write is required
4. Create a OneLake security role scoped to the required table or folder
5. Apply row-level security in the OneLake role

Correct Answer: A

Correct Answer

Answer A is correct because OneLake role CLS restricts selected columns while preserving access to permitted data. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer B is incorrect because this action is appropriate when a user still sees all data despite being added to a more restrictive OneLake role. Specifically, a broader existing grant can continue to provide access, so it must be removed or narrowed, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when a user should write to a limited data scope without receiving broad workspace authoring permissions. Specifically, current OneLake security supports scoped ReadWrite for supported items, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when a Viewer needs data-plane access to only a subset of a lakehouse item. Specifically, OneLake security roles can grant granular access to selected tables and folders, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when members of a role may read a table but must see only rows that satisfy a defined predicate. Specifically, OneLake role RLS constrains rows within the granted table, which does not resolve the decisive condition in this scenario.

Question 9

A Fabric engineering team is reviewing a regulated retail analytics platform. A user still sees all data despite being added to a more restrictive OneLake role Which action is most appropriate?

1. Create a OneLake security role scoped to the required table or folder
2. Apply row-level security in the OneLake role
3. Apply column-level security in the OneLake role
4. Remove or narrow a broader DefaultReader grant before relying on a restrictive role
5. Grant ReadWrite only to the selected folder or table through OneLake security when granular write is required

Correct Answer: D

Correct Answer

Answer D is correct because a broader existing grant can continue to provide access, so it must be removed or narrowed.

Incorrect Answers

Answer A is incorrect because this action is appropriate when a Viewer needs data-plane access to only a subset of a lakehouse item. Specifically, OneLake security roles can grant granular access to selected tables and folders, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when members of a role may read a table but must see only rows that satisfy a defined predicate. Specifically, OneLake role RLS constrains rows within the granted table, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when members need the table but must not see a sensitive column. Specifically, OneLake role CLS restricts selected columns while preserving access to permitted data, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when a user should write to a limited data scope without receiving broad workspace authoring permissions. Specifically, current OneLake security supports scoped ReadWrite for supported items, which does not resolve the decisive condition in this scenario.

Question 10

A data engineer must correct a design for a real-time telemetry service. The decisive requirement is that a user should write to a limited data scope without receiving broad workspace authoring permissions. Which choice best addresses it?

1. Remove or narrow a broader DefaultReader grant before relying on a restrictive role
2. Grant ReadWrite only to the selected folder or table through OneLake security when granular write is required
3. Create a OneLake security role scoped to the required table or folder
4. Apply row-level security in the OneLake role
5. Apply column-level security in the OneLake role

Correct Answer: B

Correct Answer

Answer B is correct because current OneLake security supports scoped ReadWrite for supported items. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when a user still sees all data despite being added to a more restrictive OneLake role. Specifically, a broader existing grant can continue to provide access, so it must be removed or narrowed, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when a Viewer needs data-plane access to only a subset of a lakehouse item. Specifically, OneLake security roles can grant granular access to selected tables and folders, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when members of a role may read a table but must see only rows that satisfy a defined predicate. Specifically, OneLake role RLS constrains rows within the granted table, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when members need the table but must not see a sensitive column. Specifically, OneLake role CLS restricts selected columns while preserving access to permitted data, which does not resolve the decisive condition in this scenario.

Question 11

For a product usage analytics pipeline, the organization has fixed the following constraint: different business users query the same logical table but must automatically receive only rows for their tenant. Which action best satisfies the requirement?

1. Use column-level security to deny access to selected columns
2. Use object-level permissions to deny access to an entire table or view
3. Use dynamic data masking when authorized users may query the column but nonprivileged output should be obfuscated
4. Use a secured view when a curated projection must expose only approved columns and logic
5. Use row-level security for tenant-filtered query results

Correct Answer: E

Correct Answer

Answer E is correct because RLS applies a row predicate based on execution context. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when a role may query the table but must be unable to select the salary column. Specifically, CLS controls permission at the column level rather than merely obscuring values, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when a role should not discover or query a sensitive object at all. Specifically, object-level permission is the direct control for the whole object, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when the application can read a field but ordinary users should receive a masked representation rather than the underlying value. Specifically, dynamic data masking changes the presented value without replacing stronger access control, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when consumers need a stable governed interface with a subset of fields and computed rules. Specifically, a view can present a controlled object surface while base objects remain protected, which does not resolve the decisive condition in this scenario.

Question 12

During an operational design review for a customer-analytics environment, engineers confirm that a role may query the table but must be unable to select the salary column. What should they do?

1. Use a secured view when a curated projection must expose only approved columns and logic
2. Use row-level security for tenant-filtered query results
3. Use column-level security to deny access to selected columns
4. Use object-level permissions to deny access to an entire table or view
5. Use dynamic data masking when authorized users may query the column but nonprivileged output should be obfuscated

Correct Answer: C

Correct Answer

Answer C is correct because CLS controls permission at the column level rather than merely obscuring values. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when consumers need a stable governed interface with a subset of fields and computed rules. Specifically, a view can present a controlled object surface while base objects remain protected, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when different business users query the same logical table but must automatically receive only rows for their tenant. Specifically, RLS applies a row predicate based on execution context, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when a role should not discover or query a sensitive object at all. Specifically, object-level permission is the direct control for the whole object, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when the application can read a field but ordinary users should receive a masked representation rather than the underlying value. Specifically, dynamic data masking changes the presented value without replacing stronger access control, which does not resolve the decisive condition in this scenario.

Question 13

After a recent change in an internal finance data estate, the team determines that a role should not discover or query a sensitive object at all. Which implementation should be selected?

1. Use object-level permissions to deny access to an entire table or view
2. Use dynamic data masking when authorized users may query the column but nonprivileged output should be obfuscated
3. Use a secured view when a curated projection must expose only approved columns and logic
4. Use row-level security for tenant-filtered query results
5. Use column-level security to deny access to selected columns

Correct Answer: A

Correct Answer

Answer A is correct because object-level permission is the direct control for the whole object. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer B is incorrect because this action is appropriate when the application can read a field but ordinary users should receive a masked representation rather than the underlying value. Specifically, dynamic data masking changes the presented value without replacing stronger access control, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when consumers need a stable governed interface with a subset of fields and computed rules. Specifically, a view can present a controlled object surface while base objects remain protected, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when different business users query the same logical table but must automatically receive only rows for their tenant. Specifically, RLS applies a row predicate based on execution context, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when a role may query the table but must be unable to select the salary column. Specifically, CLS controls permission at the column level rather than merely obscuring values, which does not resolve the decisive condition in this scenario.

Question 14

A Fabric engineering team is reviewing a multi-team Fabric deployment. The application can read a field but ordinary users should receive a masked representation rather than the underlying value Which action is most appropriate?

1. Use row-level security for tenant-filtered query results
2. Use column-level security to deny access to selected columns
3. Use object-level permissions to deny access to an entire table or view
4. Use dynamic data masking when authorized users may query the column but nonprivileged output should be obfuscated
5. Use a secured view when a curated projection must expose only approved columns and logic

Correct Answer: D

Correct Answer

Answer D is correct because dynamic data masking changes the presented value without replacing stronger access control. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when different business users query the same logical table but must automatically receive only rows for their tenant. Specifically, RLS applies a row predicate based on execution context, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when a role may query the table but must be unable to select the salary column. Specifically, CLS controls permission at the column level rather than merely obscuring values, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when a role should not discover or query a sensitive object at all. Specifically, object-level permission is the direct control for the whole object, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when consumers need a stable governed interface with a subset of fields and computed rules. Specifically, a view can present a controlled object surface while base objects remain protected, which does not resolve the decisive condition in this scenario.

Question 15

A data engineer must correct a design for a logistics monitoring solution. The decisive requirement is that consumers need a stable governed interface with a subset of fields and computed rules. Which choice best addresses it?

1. Use dynamic data masking when authorized users may query the column but nonprivileged output should be obfuscated
2. Use a secured view when a curated projection must expose only approved columns and logic
3. Use row-level security for tenant-filtered query results
4. Use column-level security to deny access to selected columns
5. Use object-level permissions to deny access to an entire table or view

Correct Answer: B

Correct Answer

Answer B is correct because a view can present a controlled object surface while base objects remain protected. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when the application can read a field but ordinary users should receive a masked representation rather than the underlying value. Specifically, dynamic data masking changes the presented value without replacing stronger access control, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when different business users query the same logical table but must automatically receive only rows for their tenant. Specifically, RLS applies a row predicate based on execution context, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when a role may query the table but must be unable to select the salary column. Specifically, CLS controls permission at the column level rather than merely obscuring values, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when a role should not discover or query a sensitive object at all. Specifically, object-level permission is the direct control for the whole object, which does not resolve the decisive condition in this scenario.

Question 16

For a global manufacturing data product, the organization has fixed the following constraint: the item contains regulated data and its classification must travel with supported downstream use. Which action best satisfies the requirement?

1. Promote an item when the owner recommends it for broader organizational use
2. Certify an item after the organization-approved validation process
3. Remove an obsolete endorsement when the item is no longer the approved source
4. Keep classification and endorsement as separate controls
5. Apply the appropriate sensitivity label to the Fabric item

Correct Answer: E

Correct Answer

Answer E is correct because sensitivity labels identify the data classification and support governance handling. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when the dataset is useful and reviewed by its owner but has not completed formal certification. Specifically, promotion signals recommended content without asserting the stronger certification process, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when the item has passed formal governance validation and should be presented as authoritative. Specifically, certification is the stronger endorsement for governed trusted content, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when a replacement artifact is authoritative and the older item should not continue to signal trust. Specifically, endorsement must reflect the current governed source rather than historical status, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when an item is highly sensitive but not yet an approved enterprise source. Specifically, sensitivity describes data classification while endorsement describes trust/recommendation status, which does not resolve the decisive condition in this scenario.

Question 17

During an operational design review for a governed self-service analytics domain, engineers confirm that the dataset is useful and reviewed by its owner but has not completed formal certification. What should they do?

1. Keep classification and endorsement as separate controls
2. Apply the appropriate sensitivity label to the Fabric item
3. Promote an item when the owner recommends it for broader organizational use
4. Certify an item after the organization-approved validation process
5. Remove an obsolete endorsement when the item is no longer the approved source

Correct Answer: C

Correct Answer

Answer C is correct because promotion signals recommended content without asserting the stronger certification process. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when an item is highly sensitive but not yet an approved enterprise source. Specifically, sensitivity describes data classification while endorsement describes trust/recommendation status, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when the item contains regulated data and its classification must travel with supported downstream use. Specifically, sensitivity labels identify the data classification and support governance handling, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when the item has passed formal governance validation and should be presented as authoritative. Specifically, certification is the stronger endorsement for governed trusted content, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when a replacement artifact is authoritative and the older item should not continue to signal trust. Specifically, endorsement must reflect the current governed source rather than historical status, which does not resolve the decisive condition in this scenario.

Question 18

After a recent change in a financial reporting workspace, the team determines that the item has passed formal governance validation and should be presented as authoritative. Which implementation should be selected?

1. Certify an item after the organization-approved validation process
2. Remove an obsolete endorsement when the item is no longer the approved source
3. Keep classification and endorsement as separate controls
4. Apply the appropriate sensitivity label to the Fabric item
5. Promote an item when the owner recommends it for broader organizational use

Correct Answer: A

Correct Answer

Answer A is correct because certification is the stronger endorsement for governed trusted content. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer B is incorrect because this action is appropriate when a replacement artifact is authoritative and the older item should not continue to signal trust. Specifically, endorsement must reflect the current governed source rather than historical status, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when an item is highly sensitive but not yet an approved enterprise source. Specifically, sensitivity describes data classification while endorsement describes trust/recommendation status, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when the item contains regulated data and its classification must travel with supported downstream use. Specifically, sensitivity labels identify the data classification and support governance handling, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when the dataset is useful and reviewed by its owner but has not completed formal certification. Specifically, promotion signals recommended content without asserting the stronger certification process, which does not resolve the decisive condition in this scenario.

Question 19

A Fabric engineering team is reviewing a healthcare operations workspace. A replacement artifact is authoritative and the older item should not continue to signal trust Which action is most appropriate?

1. Apply the appropriate sensitivity label to the Fabric item
2. Promote an item when the owner recommends it for broader organizational use
3. Certify an item after the organization-approved validation process
4. Remove an obsolete endorsement when the item is no longer the approved source
5. Keep classification and endorsement as separate controls

Correct Answer: D

Correct Answer

Answer D is correct because endorsement must reflect the current governed source rather than historical status. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when the item contains regulated data and its classification must travel with supported downstream use. Specifically, sensitivity labels identify the data classification and support governance handling, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when the dataset is useful and reviewed by its owner but has not completed formal certification. Specifically, promotion signals recommended content without asserting the stronger certification process, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when the item has passed formal governance validation and should be presented as authoritative. Specifically, certification is the stronger endorsement for governed trusted content, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when an item is highly sensitive but not yet an approved enterprise source. Specifically, sensitivity describes data classification while endorsement describes trust/recommendation status, which does not resolve the decisive condition in this scenario.

Question 20

A data engineer must correct a design for an IoT operations solution. The decisive requirement is that an item is highly sensitive but not yet an approved enterprise source. Which choice best addresses it?

1. Remove an obsolete endorsement when the item is no longer the approved source
2. Keep classification and endorsement as separate controls
3. Apply the appropriate sensitivity label to the Fabric item
4. Promote an item when the owner recommends it for broader organizational use
5. Certify an item after the organization-approved validation process

Correct Answer: B

Correct Answer

Answer B is correct because sensitivity describes data classification while endorsement describes trust/recommendation status. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when a replacement artifact is authoritative and the older item should not continue to signal trust. Specifically, endorsement must reflect the current governed source rather than historical status, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when the item contains regulated data and its classification must travel with supported downstream use. Specifically, sensitivity labels identify the data classification and support governance handling, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when the dataset is useful and reviewed by its owner but has not completed formal certification. Specifically, promotion signals recommended content without asserting the stronger certification process, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when the item has passed formal governance validation and should be presented as authoritative. Specifically, certification is the stronger endorsement for governed trusted content, which does not resolve the decisive condition in this scenario.

Question 21

For a regional supply-chain platform, the organization has fixed the following constraint: an investigation needs actor and operation evidence for an administrative change. Which action best satisfies the requirement?

1. Correlate the audit event timestamp with the affected item and user
2. Use OneLake diagnostics for data-access diagnostics and Fabric audit logs for administrative activity
3. Retain audit evidence according to the organization investigation requirement
4. Avoid granting broader permissions merely to obtain audit visibility
5. Use Fabric audit logs to identify who changed the governed item

Correct Answer: E

Correct Answer

Answer E is correct because audit logs record Fabric activities for accountability and investigation. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when the team must determine whether a reported access change aligns with a specific administrative action. Specifically, correlation by actor, operation, item, and time establishes the relevant event sequence, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when the investigation spans low-level OneLake access and workspace/item governance changes. Specifically, the two telemetry sources serve different investigation layers and should be combined appropriately, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when compliance requires historical activity evidence beyond immediate troubleshooting. Specifically, retention should match the stated audit and investigation window, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when an auditor needs activity evidence but should not become a data author. Specifically, audit access should be granted through appropriate governance mechanisms rather than workspace authoring rights, which does not resolve the decisive condition in this scenario.

Question 22

During an operational design review for a shared business intelligence platform, engineers confirm that the team must determine whether a reported access change aligns with a specific administrative action. What should they do?

1. Avoid granting broader permissions merely to obtain audit visibility
2. Use Fabric audit logs to identify who changed the governed item
3. Correlate the audit event timestamp with the affected item and user
4. Use OneLake diagnostics for data-access diagnostics and Fabric audit logs for administrative activity
5. Retain audit evidence according to the organization investigation requirement

Correct Answer: C

Correct Answer

Answer C is correct because correlation by actor, operation, item, and time establishes the relevant event sequence. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when an auditor needs activity evidence but should not become a data author. Specifically, audit access should be granted through appropriate governance mechanisms rather than workspace authoring rights, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when an investigation needs actor and operation evidence for an administrative change. Specifically, audit logs record Fabric activities for accountability and investigation, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when the investigation spans low-level OneLake access and workspace/item governance changes. Specifically, the two telemetry sources serve different investigation layers and should be combined appropriately, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when compliance requires historical activity evidence beyond immediate troubleshooting. Specifically, retention should match the stated audit and investigation window, which does not resolve the decisive condition in this scenario.

Question 23

After a recent change in an enterprise lakehouse program, the team determines that the investigation spans low-level OneLake access and workspace/item governance changes. Which implementation should be selected?

1. Use OneLake diagnostics for data-access diagnostics and Fabric audit logs for administrative activity
2. Retain audit evidence according to the organization investigation requirement
3. Avoid granting broader permissions merely to obtain audit visibility
4. Use Fabric audit logs to identify who changed the governed item
5. Correlate the audit event timestamp with the affected item and user

Correct Answer: A

Correct Answer

Answer A is correct because the two telemetry sources serve different investigation layers and should be combined appropriately. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer B is incorrect because this action is appropriate when compliance requires historical activity evidence beyond immediate troubleshooting. Specifically, retention should match the stated audit and investigation window, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when an auditor needs activity evidence but should not become a data author. Specifically, audit access should be granted through appropriate governance mechanisms rather than workspace authoring rights, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when an investigation needs actor and operation evidence for an administrative change. Specifically, audit logs record Fabric activities for accountability and investigation, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when the team must determine whether a reported access change aligns with a specific administrative action. Specifically, correlation by actor, operation, item, and time establishes the relevant event sequence, which does not resolve the decisive condition in this scenario.

Question 24

A Fabric engineering team is reviewing a regulated retail analytics platform. Compliance requires historical activity evidence beyond immediate troubleshooting Which action is most appropriate?

1. Use Fabric audit logs to identify who changed the governed item
2. Correlate the audit event timestamp with the affected item and user
3. Use OneLake diagnostics for data-access diagnostics and Fabric audit logs for administrative activity
4. Retain audit evidence according to the organization investigation requirement
5. Avoid granting broader permissions merely to obtain audit visibility

Correct Answer: D

Correct Answer

Answer D is correct because retention should match the stated audit and investigation window. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when an investigation needs actor and operation evidence for an administrative change. Specifically, audit logs record Fabric activities for accountability and investigation, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when the team must determine whether a reported access change aligns with a specific administrative action. Specifically, correlation by actor, operation, item, and time establishes the relevant event sequence, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when the investigation spans low-level OneLake access and workspace/item governance changes. Specifically, the two telemetry sources serve different investigation layers and should be combined appropriately, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when an auditor needs activity evidence but should not become a data author. Specifically, audit access should be granted through appropriate governance mechanisms rather than workspace authoring rights, which does not resolve the decisive condition in this scenario.

Question 25

A data engineer must correct a design for a real-time telemetry service. The decisive requirement is that an auditor needs activity evidence but should not become a data author. Which choice best addresses it?

1. Retain audit evidence according to the organization investigation requirement
2. Avoid granting broader permissions merely to obtain audit visibility
3. Use Fabric audit logs to identify who changed the governed item
4. Correlate the audit event timestamp with the affected item and user
5. Use OneLake diagnostics for data-access diagnostics and Fabric audit logs for administrative activity

Correct Answer: B

Correct Answer

Answer B is correct because audit access should be granted through appropriate governance mechanisms rather than workspace authoring rights.

Incorrect Answers

Answer A is incorrect because this action is appropriate when compliance requires historical activity evidence beyond immediate troubleshooting. Specifically, retention should match the stated audit and investigation window, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when an investigation needs actor and operation evidence for an administrative change. Specifically, audit logs record Fabric activities for accountability and investigation, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when the team must determine whether a reported access change aligns with a specific administrative action. Specifically, correlation by actor, operation, item, and time establishes the relevant event sequence, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when the investigation spans low-level OneLake access and workspace/item governance changes. Specifically, the two telemetry sources serve different investigation layers and should be combined appropriately, which does not resolve the decisive condition in this scenario.

Question 26

For a product usage analytics pipeline, the organization has fixed the following constraint: different users have different permissions on the shortcut target and those target permissions must be enforced. Which action best satisfies the requirement?

1. Use delegated identity when the shortcut must access the target through a configured connection identity
2. Grant the workspace identity only the storage permissions required by the workload
3. Keep shortcut consumers read-only when the target is a mirrored or externally governed source
4. Revoke an engine identity from the workspace when its authorized OneLake integration is retired
5. Use pass-through identity for an internal shortcut when each reader must be authorized against the target

Correct Answer: E

Correct Answer

Answer E is correct because pass-through uses the calling user identity to authorize access to the target. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when the design intentionally centralizes access through one governed identity instead of every user authenticating to the target. Specifically, delegated identity uses the configured connection identity for target access, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when a Fabric item uses workspace identity against protected storage and currently receives access denied. Specifically, managed identity authentication still requires least-privilege authorization on the target resource, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when consumers should analyze shared data without becoming owners of the source system. Specifically, shortcut access exposes referenced data without transferring source-system write ownership, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when a third-party authorized engine must lose access to physical files and security metadata. Specifically, removing the engine identity from the workspace revokes the workspace-scoped authorization, which does not resolve the decisive condition in this scenario.

Question 27

During an operational design review for a customer-analytics environment, engineers confirm that the design intentionally centralizes access through one governed identity instead of every user authenticating to the target. What should they do?

1. Revoke an engine identity from the workspace when its authorized OneLake integration is retired
2. Use pass-through identity for an internal shortcut when each reader must be authorized against the target
3. Use delegated identity when the shortcut must access the target through a configured connection identity
4. Grant the workspace identity only the storage permissions required by the workload
5. Keep shortcut consumers read-only when the target is a mirrored or externally governed source

Correct Answer: C

Correct Answer

Answer C is correct because delegated identity uses the configured connection identity for target access. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when a third-party authorized engine must lose access to physical files and security metadata. Specifically, removing the engine identity from the workspace revokes the workspace-scoped authorization, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when different users have different permissions on the shortcut target and those target permissions must be enforced. Specifically, pass-through uses the calling user identity to authorize access to the target, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when a Fabric item uses workspace identity against protected storage and currently receives access denied. Specifically, managed identity authentication still requires least-privilege authorization on the target resource, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when consumers should analyze shared data without becoming owners of the source system. Specifically, shortcut access exposes referenced data without transferring source-system write ownership, which does not resolve the decisive condition in this scenario.

Question 28

After a recent change in an internal finance data estate, the team determines that a Fabric item uses workspace identity against protected storage and currently receives access denied. Which implementation should be selected?

1. Grant the workspace identity only the storage permissions required by the workload
2. Keep shortcut consumers read-only when the target is a mirrored or externally governed source
3. Revoke an engine identity from the workspace when its authorized OneLake integration is retired
4. Use pass-through identity for an internal shortcut when each reader must be authorized against the target
5. Use delegated identity when the shortcut must access the target through a configured connection identity

Correct Answer: A

Correct Answer

Answer A is correct because managed identity authentication still requires least-privilege authorization on the target resource. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer B is incorrect because this action is appropriate when consumers should analyze shared data without becoming owners of the source system. Specifically, shortcut access exposes referenced data without transferring source-system write ownership, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when a third-party authorized engine must lose access to physical files and security metadata. Specifically, removing the engine identity from the workspace revokes the workspace-scoped authorization, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when different users have different permissions on the shortcut target and those target permissions must be enforced. Specifically, pass-through uses the calling user identity to authorize access to the target, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when the design intentionally centralizes access through one governed identity instead of every user authenticating to the target. Specifically, delegated identity uses the configured connection identity for target access, which does not resolve the decisive condition in this scenario.

Question 29

A Fabric engineering team is reviewing a multi-team Fabric deployment. Consumers should analyze shared data without becoming owners of the source system Which action is most appropriate?

1. Use pass-through identity for an internal shortcut when each reader must be authorized against the target
2. Use delegated identity when the shortcut must access the target through a configured connection identity
3. Grant the workspace identity only the storage permissions required by the workload
4. Keep shortcut consumers read-only when the target is a mirrored or externally governed source
5. Revoke an engine identity from the workspace when its authorized OneLake integration is retired

Correct Answer: D

Correct Answer

Answer D is correct because shortcut access exposes referenced data without transferring source-system write ownership. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when different users have different permissions on the shortcut target and those target permissions must be enforced. Specifically, pass-through uses the calling user identity to authorize access to the target, which does not resolve the decisive condition in this scenario.

Answer B is incorrect because this action is appropriate when the design intentionally centralizes access through one governed identity instead of every user authenticating to the target. Specifically, delegated identity uses the configured connection identity for target access, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when a Fabric item uses workspace identity against protected storage and currently receives access denied. Specifically, managed identity authentication still requires least-privilege authorization on the target resource, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when a third-party authorized engine must lose access to physical files and security metadata. Specifically, removing the engine identity from the workspace revokes the workspace-scoped authorization, which does not resolve the decisive condition in this scenario.

Question 30

A data engineer must correct a design for a logistics monitoring solution. The decisive requirement is that a third-party authorized engine must lose access to physical files and security metadata. Which choice best addresses it?

1. Keep shortcut consumers read-only when the target is a mirrored or externally governed source
2. Revoke an engine identity from the workspace when its authorized OneLake integration is retired
3. Use pass-through identity for an internal shortcut when each reader must be authorized against the target
4. Use delegated identity when the shortcut must access the target through a configured connection identity
5. Grant the workspace identity only the storage permissions required by the workload

Correct Answer: B

Correct Answer

Answer B is correct because removing the engine identity from the workspace revokes the workspace-scoped authorization. This directly addresses the relevant Fabric behavior while preserving the other stated constraints.

Incorrect Answers

Answer A is incorrect because this action is appropriate when consumers should analyze shared data without becoming owners of the source system. Specifically, shortcut access exposes referenced data without transferring source-system write ownership, which does not resolve the decisive condition in this scenario.

Answer C is incorrect because this action is appropriate when different users have different permissions on the shortcut target and those target permissions must be enforced. Specifically, pass-through uses the calling user identity to authorize access to the target, which does not resolve the decisive condition in this scenario.

Answer D is incorrect because this action is appropriate when the design intentionally centralizes access through one governed identity instead of every user authenticating to the target. Specifically, delegated identity uses the configured connection identity for target access, which does not resolve the decisive condition in this scenario.

Answer E is incorrect because this action is appropriate when a Fabric item uses workspace identity against protected storage and currently receives access denied. Specifically, managed identity authentication still requires least-privilege authorization on the target resource, which does not resolve the decisive condition in this scenario.