This post is a part of the PL-300: Microsoft Power BI Data Analyst Exam Prep Hub; and this topic falls under these sections:
Manage and secure Power BI (15–20%)
   --> Secure and govern Power BI items
      --> Configure item-level access

Below are 10 practice questions (with answers and explanations) for this topic of the exam.
There are also 2 practice tests for the PL-300 exam with 60 questions each (with answers) available on the hub.

Practice Questions

Question 1

You want business users to create their own reports using an existing semantic model, but you do not want them to edit the model. What should you grant them?

A. Workspace Viewer role
B. Workspace Contributor role
C. Build permission on the semantic model
D. Read permission on the report

✅ Correct Answer: C

Explanation:
The Build permission allows users to create new reports using a semantic model without modifying it. Viewer access alone does not allow report creation, and Contributor access is broader than required.

Question 2

A user can view a dashboard but sees broken tiles that fail to load data. What is the most likely cause?

A. The dataset refresh failed
B. The user lacks Build permission
C. The user does not have access to the underlying report
D. The dashboard was shared incorrectly

✅ Correct Answer: C

Explanation:
Dashboard tiles link back to underlying reports. If the user does not have access to those reports, the tiles will not display correctly—even if the dashboard itself is shared.

Question 3

Which permission allows a user to create a new report in Power BI Desktop using a published semantic model?

A. Read
B. Viewer
C. Contributor
D. Build

✅ Correct Answer: D

Explanation:
Only the Build permission enables users to create new reports from an existing semantic model, including using Power BI Desktop or Analyze in Excel.

Question 4

You need to limit who can see specific reports within a Power BI app without creating multiple apps. What should you use?

A. Row-level security (RLS)
B. Workspace roles
C. App audiences
D. Dataset permissions

✅ Correct Answer: C

Explanation:
App audiences provide item-level visibility within an app, allowing different user groups to see different reports or dashboards.

Question 5

Which statement best describes item-level access?

A. It controls what data rows users can see
B. It controls access to entire workspaces
C. It controls access to individual Power BI items
D. It replaces workspace roles

✅ Correct Answer: C

Explanation:
Item-level access applies to individual items such as reports, dashboards, and datasets. It does not control row-level data access and does not replace workspace roles.

Question 6

A user has access to a report but cannot export data from it. What is the most likely explanation?

A. The dataset is using DirectQuery
B. The report is in a Premium workspace
C. Export permissions are restricted at the report or tenant level
D. The user lacks RLS permissions

✅ Correct Answer: C

Explanation:
Export behavior is governed by item-level settings and tenant-level policies, not RLS or workspace type alone.

Question 7

When sharing a report, which permission must be explicitly granted if the user needs to reshare it with others?

A. Build
B. Viewer
C. Contributor
D. Reshare

✅ Correct Answer: D

Explanation:
The Reshare permission must be explicitly enabled when sharing an item. Without it, users can view the report but cannot share it further.

Question 8

Which scenario requires item-level access instead of workspace roles?

A. Granting full control of all assets
B. Managing dataset refresh schedules
C. Allowing users to view only specific reports in a workspace
D. Enabling paginated report creation

✅ Correct Answer: C

Explanation:
Item-level access allows fine-grained control over individual assets, making it ideal when users should only see specific reports.

Question 9

How does item-level access differ from row-level security (RLS)?

A. Item-level access controls data rows
B. RLS controls report visibility
C. Item-level access controls content access; RLS controls data visibility
D. They serve the same purpose

✅ Correct Answer: C

Explanation:
Item-level access determines whether a user can open or interact with content, while RLS limits the data shown within that content.

Question 10

What is the recommended best practice when assigning item-level access at scale?

A. Assign permissions to individual users
B. Use workspace roles only
C. Use Azure AD security groups
D. Share reports anonymously

✅ Correct Answer: C

Explanation:
Using Azure AD security groups improves scalability, simplifies maintenance, and aligns with enterprise governance best practices.

Exam Readiness Tip

If you can confidently answer questions about:

• Build vs Read vs Reshare
• Dashboards vs reports vs datasets
• Item-level access vs workspace roles vs RLS

…you are in excellent shape for PL-300 questions in this domain.

Go back to the PL-300 Exam Prep Hub main page

This post is a part of the PL-300: Microsoft Power BI Data Analyst Exam Prep Hub; and this topic falls under these sections:
Manage and secure Power BI (15–20%)
   --> Secure and govern Power BI items
      --> Configure access to semantic models

Below are 10 practice questions (with answers and explanations) for this topic of the exam.
There are also 2 practice tests for the PL-300 exam with 60 questions each (with answers) available on the hub.

Practice Questions

Question 1

A user can view reports in a workspace but cannot create a new report using the existing semantic model. What is the most likely reason?

A. The user does not have Read permission on the semantic model
B. The user does not have Build permission on the semantic model
C. The user is not assigned a Row-Level Security role
D. The semantic model is not endorsed

Correct Answer: B

Explanation:
Creating new reports from a semantic model requires Build permission. A user can still view reports without Build permission, which makes this a common exam scenario.

Question 2

Which workspace role allows a user to edit semantic models and manage permissions?

A. Viewer
B. Contributor
C. Member
D. App user

Correct Answer: C

Explanation:
Members can publish, update, and manage semantic models, including assigning permissions. Contributors can edit content but cannot manage access.

Question 3

You want business users to create their own reports while preventing them from modifying the semantic model. What is the best approach?

A. Assign users the Viewer role and grant Build permission on the semantic model
B. Assign users the Contributor role
C. Assign users the Admin role
D. Publish the reports through a Power BI App only

Correct Answer: A

Explanation:
Granting Viewer role + Build permission enables self-service report creation without allowing model changes—this is a best practice and frequently tested.

Question 4

Where is Row-Level Security (RLS) enforced?

A. At the report level
B. At the dashboard level
C. At the semantic model level
D. At the workspace level

Correct Answer: C

Explanation:
RLS is defined in Power BI Desktop and enforced at the semantic model level, applying to all reports that use the model.

Question 5

Which DAX function is commonly used to implement dynamic Row-Level Security?

A. SELECTEDVALUE()
B. USERELATIONSHIP()
C. USERPRINCIPALNAME()
D. LOOKUPVALUE()

Correct Answer: C

Explanation:
USERPRINCIPALNAME() returns the logged-in user’s email or UPN and is commonly used in dynamic RLS filters.

Question 6

A user with Viewer access can see a report but receives an error when using Analyze in Excel. What is the most likely issue?

A. The user is not licensed for Power BI
B. The semantic model is not certified
C. The user does not have Build permission
D. RLS is incorrectly configured

Correct Answer: C

Explanation:
Analyze in Excel requires Build permission on the semantic model. Viewer role alone is insufficient.

Question 7

Which permission allows a user to share a semantic model with others?

A. Read
B. Build
C. Reshare
D. Admin

Correct Answer: C

Explanation:
The Reshare permission explicitly allows users to share the semantic model with other users or groups.

Question 8

What is the primary purpose of certifying a semantic model?

A. To apply Row-Level Security automatically
B. To improve query performance
C. To indicate the model is an approved and trusted data source
D. To allow external tool access

Correct Answer: C

Explanation:
Certification signals that a semantic model is officially approved and governed, helping users identify trusted data sources.

Question 9

Which approach is recommended for managing access to semantic models at scale?

A. Assign permissions to individual users
B. Use Microsoft Entra ID (Azure AD) security groups
C. Share semantic models directly from Power BI Desktop
D. Grant Admin role to all analysts

Correct Answer: B

Explanation:
Using security groups simplifies access management, supports scalability, and aligns with governance best practices.

Question 10

A report is published using a semantic model that has RLS enabled. A user accesses the report through a Power BI App. What happens?

A. RLS is ignored when using apps
B. RLS must be reconfigured for the app
C. RLS is enforced automatically
D. Only static RLS is applied

Correct Answer: C

Explanation:
Row-Level Security is always enforced at the semantic model level, regardless of whether content is accessed via a workspace, report, or app.

Final Exam Tips

• Build permission is the most frequently tested concept
• Viewer + Build is a common least-privilege design pattern
• RLS always applies at the semantic model level
• Certification is about trust and governance, not security
• Apps do not bypass semantic model security

Go back to the PL-300 Exam Prep Hub main page