Microsoft DP-700 Practice Test 9
Question 80
Two OneLake roles separately grant different rows, potentially broadening what a user sees. What should the engineer review?
- Evaluate the effective union of OneLake security grants across the user's roles.
- Add a dynamic data masking policy to the warehouse email column using an appropriate mask function.
- Define and test row-level security based on the analyst's allowed region.
- Apply object-level access control to the sensitive table.
Explanation
Correct Answer
A:A second grant can expand visibility despite a restrictive first role; effective permissions must be tested together. Inspect the user's effective row access with both memberships.
Incorrect Answers
B:Dynamic data masking alters query-result presentation for nonprivileged users while leaving stored column values unchanged.
C:RLS evaluates which records a principal may access, instead of hiding an entire table or just masking a displayed value.
D:Object-level permission removes the unauthorized table from the user's accessible data rather than filtering its cells.
Question 81
A warehouse support user may query a customer email column, but the returned address should be obscured without changing stored values. What should be configured?
- Deny SELECT permission on the entire customer email column.
- Truncate the email field only in a Power BI report visual.
- Apply a sensitivity label to the warehouse item without a SQL masking rule.
- Add a dynamic data masking policy to the warehouse email column using an appropriate mask function.
Explanation
Correct Answer
D:Dynamic data masking alters query-result presentation for nonprivileged users while leaving stored column values unchanged. Query the same email column using an ordinary reader and an authorized unmasked identity.
Incorrect Answers
A:Denying column selection prevents the user from querying it at all; the stated requirement instead allows the field to be queried with obscured output.
B:Visual transformation affects that report, not direct warehouse SQL query results by the support user. The scenario, however, is that a warehouse support user may query a customer email column, but the returned address should be obscured without changing stored values.
C:Sensitivity labels support classification and governance but do not themselves replace a query-result masking policy. In the current incident, a warehouse support user may query a customer email column, but the returned address should be obscured without changing stored values.
Question 82
A data owner wants column restrictions while allowing members of the same role to edit data. What limitation blocks that combined role?
- Add a dynamic data masking policy to the warehouse email column using an appropriate mask function.
- Apply object-level access control to the sensitive table.
- Separate Read-based RLS or CLS policies from any ReadWrite grant model.
- Apply supported column-level security restricting the salary columns.
Explanation
Correct Answer
C:OneLake RLS and CLS are not configured on ReadWrite roles, so a single unrestricted writer role cannot enforce those reader filters. Check the role type and permitted operations before assigning users.
Incorrect Answers
A:Dynamic data masking alters query-result presentation for nonprivileged users while leaving stored column values unchanged.
B:Object-level permission removes the unauthorized table from the user's accessible data rather than filtering its cells.
D:CLS prevents unauthorized column access; merely masking the UI or filtering rows does not enforce the same column boundary.
Question 83
A table is physically stored as an arbitrary folder without a valid Delta log, yet the team expects OneLake table-level RLS. What must change?
- Apply object-level access control to the sensitive table.
- Store the data as a supported Delta table in the proper Tables hierarchy before applying table security.
- Define and test row-level security based on the analyst's allowed region.
- Add a dynamic data masking policy to the warehouse email column using an appropriate mask function.
Explanation
Correct Answer
B:OneLake table security requires a valid table representation; an arbitrary file folder is not automatically eligible for RLS or CLS. Validate the table layout and security behavior after conversion.
Incorrect Answers
A:Object-level permission removes the unauthorized table from the user's accessible data rather than filtering its cells.
C:RLS evaluates which records a principal may access, instead of hiding an entire table or just masking a displayed value.
D:Dynamic data masking alters query-result presentation for nonprivileged users while leaving stored column values unchanged.
Question 84
An engineer has to grant analysts read access to just two lakehouse tables. Where should the grant be defined?
- Apply OneLake authorization to the shortcut path in addition to validating its connection.
- Grant ReadWrite on that selected folder, with prerequisites satisfied.
- Inspect the All members in roles effective grants and the role that supplies access.
- Create a OneLake security role with selected tables and analyst group membership.
Explanation
Correct Answer
D:Selected-data roles express granular table scope; assigning Viewer alone may not give the intended direct table access. Inspect the role's selected data and users.
Incorrect Answers
A:The external credential grants source connectivity, while Fabric roles decide which identities can reach the shortcut data.
B:A scoped ReadWrite grant can authorize operations on the selected path for a read-only workspace user.
C:Effective-access inspection identifies alternative role memberships, including virtual members, that can grant the table.
Question 85
A new OneLake role unexpectedly allows access to future folders. Which setting should be reconsidered?
- Apply OneLake authorization to the shortcut path in addition to validating its connection.
- Replace All data with an explicit Selected data scope where future access is not intended.
- Review virtual members assigned through the role's permission groups.
- Rename the role to a unique alphanumeric name starting with a letter, such as FinanceRead7.
Explanation
Correct Answer
B:An All data role covers new objects as they appear; selected scope limits the grant to approved tables and folders. Add a test folder and verify the user cannot read it.
Incorrect Answers
A:The external credential grants source connectivity, while Fabric roles decide which identities can reach the shortcut data.
C:Permission-group membership can add identities without manual entry, so removing a displayed member directly may not revoke the underlying grant.
D:OneLake security role names must begin with a letter and use alphanumeric characters; punctuation and numeric initial characters are invalid.
Question 86
A OneLake role must permit file updates in one folder for a Viewer. What permission should be assigned?
- Rename the role to a unique alphanumeric name starting with a letter, such as FinanceRead7.
- Grant ReadWrite on that selected folder, with prerequisites satisfied.
- Review virtual members assigned through the role's permission groups.
- Apply OneLake authorization to the shortcut path in addition to validating its connection.
Explanation
Correct Answer
B:A scoped ReadWrite grant can authorize operations on the selected path for a read-only workspace user. Test creation and deletion only inside the folder.
Incorrect Answers
A:OneLake security role names must begin with a letter and use alphanumeric characters; punctuation and numeric initial characters are invalid.
C:Permission-group membership can add identities without manual entry, so removing a displayed member directly may not revoke the underlying grant.
D:The external credential grants source connectivity, while Fabric roles decide which identities can reach the shortcut data.
Question 87
A dataset owner needs to understand why a user can read a table despite not being in the expected group. Which view helps?
- Grant ReadWrite on that selected folder, with prerequisites satisfied.
- Rename the role to a unique alphanumeric name starting with a letter, such as FinanceRead7.
- Inspect the All members in roles effective grants and the role that supplies access.
- Replace All data with an explicit Selected data scope where future access is not intended.
Explanation
Correct Answer
C:Effective-access inspection identifies alternative role memberships, including virtual members, that can grant the table. Trace the granted table back to its role.
Incorrect Answers
A:A scoped ReadWrite grant can authorize operations on the selected path for a read-only workspace user.
B:OneLake security role names must begin with a letter and use alphanumeric characters; punctuation and numeric initial characters are invalid.
D:An All data role covers new objects as they appear; selected scope limits the grant to approved tables and folders.
Question 88
A group is automatically included in a OneLake role based on item-level ReadAll permission. What membership mechanism is involved?
- Apply OneLake authorization to the shortcut path in addition to validating its connection.
- Review virtual members assigned through the role's permission groups.
- Inspect the All members in roles effective grants and the role that supplies access.
- Rename the role to a unique alphanumeric name starting with a letter, such as FinanceRead7.
Explanation
Correct Answer
B:Permission-group membership can add identities without manual entry, so removing a displayed member directly may not revoke the underlying grant. Inspect the Added using value for that user.
Incorrect Answers
A:The external credential grants source connectivity, while Fabric roles decide which identities can reach the shortcut data.
C:Effective-access inspection identifies alternative role memberships, including virtual members, that can grant the table.
D:OneLake security role names must begin with a letter and use alphanumeric characters; punctuation and numeric initial characters are invalid.
Question 89
An engineer attempts to create a OneLake security role named 7-finance-read and receives a role-name validation error. What should be corrected?
- Reuse the name of an existing role with different letter capitalization.
- Rename the role to a unique alphanumeric name starting with a letter, such as FinanceRead7.
- Change the name to Finance-Read7 while keeping its descriptive hyphen.
- Change the name to _FinanceRead7 so the digit is no longer first.
Explanation
Correct Answer
B:OneLake security role names must begin with a letter and use alphanumeric characters; punctuation and numeric initial characters are invalid. Create the renamed role and confirm it appears in the role list.
Incorrect Answers
A:Role names are case-insensitive and must be unique; changing case alone does not resolve a name collision or other validation issues.
C:OneLake role names accept only letters and digits; the hyphen remains invalid even after moving the initial digit. In the current incident, an engineer attempts to create a OneLake security role named 7-finance-read and receives a role-name validation error.
D:The underscore is not alphanumeric and the initial character still must be a letter. Those effects are relevant to a different technical condition. In this case, an engineer attempts to create a OneLake security role named 7-finance-read and receives a role-name validation error.
Question 90
An external shortcut is readable only with valid storage credentials. What does OneLake role membership add?
- Replace All data with an explicit Selected data scope where future access is not intended.
- Apply OneLake authorization to the shortcut path in addition to validating its connection.
- Grant ReadWrite on that selected folder, with prerequisites satisfied.
- Review virtual members assigned through the role's permission groups.
Explanation
Correct Answer
B:The external credential grants source connectivity, while Fabric roles decide which identities can reach the shortcut data. Test an unauthorized identity against a working shortcut connection.
Incorrect Answers
A:An All data role covers new objects as they appear; selected scope limits the grant to approved tables and folders.
C:A scoped ReadWrite grant can authorize operations on the selected path for a read-only workspace user.
D:Permission-group membership can add identities without manual entry, so removing a displayed member directly may not revoke the underlying grant.
