Tag: Microsoft Certified: Fabric Data Engineer Associate

Data Security, DP-700, Microsoft Certification, Microsoft Fabric June 3, 2026

Apply sensitivity labels to items (DP-700 Exam Prep)

This post is a part of the DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric Exam Prep Hub.
This topic falls under these sections:
Implement and manage an analytics solution (30–35%)
   --> Configure security and governance
      --> Apply sensitivity labels to items

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

Data is one of an organization’s most valuable assets, and not all data carries the same level of sensitivity. Some information can be shared broadly across the organization, while other information must be protected due to regulatory, legal, contractual, or business requirements.

Examples include:

Financial reports
Employee records
Customer information
Healthcare data
Intellectual property
Confidential business plans

Microsoft Fabric integrates with Microsoft Information Protection (MIP) and Microsoft Purview sensitivity labels, enabling organizations to classify and protect data assets throughout their lifecycle.

Sensitivity labels help users understand the importance of data, enforce governance policies, and support compliance initiatives. They can be applied to many Fabric items, including reports, semantic models, dashboards, and other assets.

For the DP-700 exam, it is important to understand what sensitivity labels are, how they work, how they are applied, and how they differ from other security mechanisms such as Row-Level Security (RLS), Object-Level Security (OLS), and workspace permissions.

What Are Sensitivity Labels?

A sensitivity label is a classification tag that identifies the sensitivity level of data or content.

Examples include:

Label	Typical Meaning
Public	Safe for general sharing
General	Internal business use
Confidential	Restricted business information
Highly Confidential	Highly sensitive information
Restricted	Maximum protection required

Organizations can create custom sensitivity labels to align with their governance policies.

Purpose of Sensitivity Labels

Sensitivity labels help organizations:

Classify data consistently
Protect sensitive information
Improve data governance
Support regulatory compliance
Enable data discovery
Increase user awareness
Reduce accidental data exposure

Sensitivity labels serve as both a classification mechanism and, in some scenarios, a protection mechanism.

Sensitivity Labels in Microsoft Fabric

Microsoft Fabric integrates with Microsoft Purview Information Protection.

This integration allows labels to be applied to Fabric assets and propagated through data workflows.

Examples of Fabric items that can support sensitivity labels include:

Reports
Semantic Models
Dashboards
Data Warehouses
Lakehouses
Notebooks
Dataflows
Other supported Fabric artifacts

How Sensitivity Labels Work

A sensitivity label is associated with an item.

Example:

			
Executive Financial Report
Label: Highly Confidential

Users accessing the item can immediately identify its classification level.

The label travels with the item and may also propagate to downstream artifacts depending on organizational policies and supported scenarios.

Common Sensitivity Label Classifications

Public

Data intended for unrestricted access.

Examples:

Public website content
Marketing brochures
Published documentation

General

Data intended for internal use.

Examples:

Departmental reports
Internal project tracking

Confidential

Data requiring controlled access.

Examples:

Financial reports
Customer information
Internal analytics

Highly Confidential

Data requiring strict protection.

Examples:

Payroll information
Acquisition plans
Executive strategy documents

Restricted

Data requiring maximum protection.

Examples:

Legal investigations
Security credentials
Highly regulated information

Applying Sensitivity Labels

Sensitivity labels can be applied manually or automatically depending on organizational configurations.

Manual Labeling

Users select the appropriate label.

Example:

			
Report
 ↓
Apply Label
 ↓
Confidential

		

Manual labeling is commonly used when users understand the business context of the data.

Automatic Labeling

Organizations may configure policies that automatically apply labels based on:

Sensitive information types
Data patterns
Business rules
Compliance requirements

Example:

			
Contains Credit Card Data
           ↓
Apply Highly Confidential

Label Inheritance and Propagation

One of the most important DP-700 exam topics related to sensitivity labels is inheritance.

Labels may propagate from source items to downstream artifacts.

Example:

			
Lakehouse
(Confidential)
      ↓
Semantic Model
      ↓
Report

		

The downstream item may inherit the sensitivity label from its source.

This helps maintain governance consistency throughout the analytics lifecycle.

Benefits of Label Propagation

Without propagation:

			
Sensitive Data
       ↓
Unlabeled Report

Risk:

Users may unknowingly share sensitive information.

With propagation:

			
Sensitive Data
       ↓
Confidential Report

Users are immediately aware of the sensitivity level.

Sensitivity Labels vs Security Permissions

This distinction is frequently tested on certification exams.

Sensitivity Labels	Security Permissions
Classify data	Control access
Provide governance context	Enforce authorization
Improve awareness	Restrict usage
Support compliance	Protect resources

Example:

A report may be labeled:

Highly Confidential

But unless appropriate permissions exist, the label alone does not automatically prevent access.

Sensitivity Labels vs Row-Level Security

Sensitivity Labels	Row-Level Security
Classify content	Filter data rows
Governance feature	Access control feature
Applies to items	Applies to data records

Example:

RLS:

			
East Manager
↓
East Region Rows Only

Sensitivity Label:

Confidential Report

Both can be used together.

Sensitivity Labels vs Dynamic Data Masking

Sensitivity Labels	Dynamic Data Masking
Classifies data	Obscures sensitive values
Governance-focused	Security-focused
Does not change data display	Changes displayed values

Example:

Label:

Highly Confidential

Masking:

XXXX-XXXX-1234

Sensitivity Labels and Compliance

Sensitivity labels play an important role in compliance initiatives such as:

GDPR
HIPAA
PCI DSS
SOX
Internal governance programs

They help organizations:

Identify sensitive assets
Demonstrate governance controls
Improve audit readiness

Sensitivity Labels and Microsoft Purview

Microsoft Purview provides centralized governance capabilities.

Organizations can use Purview to:

Define sensitivity labels
Publish labels
Manage classification policies
Track protected content
Support compliance reporting

Fabric integrates with these governance capabilities.

Real-World Scenarios

Scenario 1

A finance report contains quarterly earnings information.

Solution:

Apply a Confidential sensitivity label.

Scenario 2

A payroll dataset contains salary and compensation data.

Solution:

Apply a Highly Confidential sensitivity label.

Scenario 3

A public product catalog is intended for external customers.

Solution:

Apply a Public label.

Scenario 4

A report inherits data from a Confidential semantic model.

Result:

The report may inherit the Confidential label through label propagation.

Best Practices

Establish a Clear Classification Framework

Create standardized labels such as:

Public
General
Confidential
Highly Confidential

Use Consistent Labeling

Apply labels consistently across Fabric assets.

Leverage Label Propagation

Allow downstream artifacts to inherit labels when appropriate.

Train Users

Ensure users understand:

Label meanings
Sharing responsibilities
Governance requirements

Combine Labels with Security Controls

Use labels alongside:

Workspace permissions
Item permissions
Row-Level Security
Object-Level Security
Dynamic Data Masking

Review Labels Regularly

Data classifications may change over time.

DP-700 Exam Focus Areas

You should understand:

✓ Sensitivity label concepts

✓ Microsoft Purview integration

✓ Classification levels

✓ Manual labeling

✓ Automatic labeling

✓ Label inheritance

✓ Label propagation

✓ Governance benefits

✓ Compliance scenarios

✓ Sensitivity labels versus security permissions

✓ Sensitivity labels versus RLS

✓ Sensitivity labels versus Dynamic Data Masking

Practice Exam Questions

Question 1

What is the primary purpose of a sensitivity label in Microsoft Fabric?

A. To classify and identify the sensitivity level of data

B. To encrypt data at rest

C. To filter rows of data

D. To assign workspace roles

Answer: A

Explanation

Sensitivity labels classify data according to its sensitivity and governance requirements. They are primarily used for data classification and protection awareness.

Question 2

Which Microsoft service provides the sensitivity labeling framework used by Microsoft Fabric?

A. Microsoft Purview

B. Microsoft Defender

C. Microsoft Sentinel

D. Azure Key Vault

Answer: A

Explanation

Microsoft Fabric integrates with Microsoft Purview Information Protection to provide sensitivity labeling capabilities.

Question 3

A company wants reports containing payroll information to be clearly identified as highly sensitive.

Which feature should be used?

A. Dynamic Data Masking

B. Row-Level Security

C. Sensitivity Labels

D. Deployment Pipelines

Answer: C

Explanation

Sensitivity labels classify and identify the sensitivity level of data assets such as payroll reports.

Question 4

What is label propagation?

A. Automatic workspace creation

B. Automatic dataset refresh

C. Automatic role assignment

D. Automatic inheritance of sensitivity labels to downstream items

Answer: D

Explanation

Label propagation helps maintain consistent governance by carrying sensitivity classifications to derived artifacts.

Question 5

Which statement best describes the relationship between sensitivity labels and security permissions?

A. Sensitivity labels replace security permissions.

B. Security permissions automatically create labels.

C. Sensitivity labels classify data, while permissions control access.

D. Sensitivity labels filter rows of data.

Answer: C

Explanation

Labels provide classification and governance context, while permissions determine who can access resources.

Question 6

A report inherits data from a semantic model labeled Confidential.

What may happen if label propagation is enabled?

A. The report may inherit the Confidential label.

B. The report becomes encrypted automatically.

C. The report is deleted after publication.

D. Workspace permissions are removed.

Answer: A

Explanation

Label propagation can automatically apply inherited classifications to downstream assets.

Question 7

Which classification would generally represent the highest level of protection?

A. Public

B. General

C. Confidential

D. Highly Confidential

Answer: D

Explanation

Highly Confidential labels are typically used for the most sensitive business information.

Question 8

Which statement about sensitivity labels is correct?

A. They filter records based on user identity.

B. They hide columns from users.

C. They help classify and govern data assets.

D. They assign workspace roles.

Answer: C

Explanation

Sensitivity labels primarily support classification, governance, and compliance initiatives.

Question 9

A company wants to automatically classify files containing credit card information.

Which capability supports this requirement?

A. Automatic sensitivity labeling

B. Dynamic Data Masking

C. Workspace Viewer permissions

D. Object-Level Security

Answer: A

Explanation

Automatic labeling policies can identify sensitive information patterns and apply appropriate labels.

Question 10

Why should sensitivity labels be combined with security controls?

A. Labels automatically replace encryption.

B. Labels alone do not control access to data.

C. Labels remove the need for governance policies.

D. Labels prevent all data leakage scenarios.

Answer: B

Explanation

Sensitivity labels provide classification and governance information, but access controls such as permissions, RLS, and masking are still required to secure data.

Exam Tip

A common DP-700 exam challenge is distinguishing classification technologies from access control technologies.

Remember:

Requirement	Solution
Classify data sensitivity	Sensitivity Labels
Restrict who can access data	Permissions
Restrict which rows users see	Row-Level Security
Hide sensitive values	Dynamic Data Masking
Hide tables or objects	Object-Level Security

If the question focuses on identifying, classifying, labeling, governing, or tracking sensitive data, the correct answer is often Sensitivity Labels rather than a traditional security control.

Go to the DP-700 Exam Prep Hub main page.

DP-700, Microsoft Certification, Microsoft Fabric June 3, 2026June 3, 2026

Implement dynamic data masking (DP-700 Exam Prep)

This post is a part of the DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric Exam Prep Hub.
This topic falls under these sections:
Implement and manage an analytics solution (30–35%)
   --> Configure security and governance
      --> Implement dynamic data masking

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

Protecting sensitive data is a critical responsibility for data engineers. Organizations routinely store confidential information such as:

Personally Identifiable Information (PII)
Social Security numbers
Credit card information
Email addresses
Phone numbers
Employee salaries
Customer account details

While some users require access to this information, many others only need access to the surrounding business data. Granting unrestricted visibility to sensitive values can increase security risks and create compliance concerns.

Dynamic Data Masking (DDM) is a security feature that limits the exposure of sensitive data by masking values for non-privileged users while allowing authorized users to see the original values.

For the DP-700 exam, it is important to understand how Dynamic Data Masking works, its use cases, limitations, and how it differs from other security mechanisms such as Row-Level Security (RLS), Column-Level Security (CLS), and encryption.

What Is Dynamic Data Masking?

Dynamic Data Masking is a security feature that obscures sensitive data at query time.

The actual data remains unchanged in storage.

Instead, unauthorized users see a masked version of the data.

Example:

Actual data:

CustomerName	Email
John Smith	john.smith@contoso.com

Masked view:

CustomerName	Email
John Smith	jXXXXXXX@XXXX.com

The original data still exists in the database.

Only the displayed results are modified.

Why Use Dynamic Data Masking?

Organizations often need to:

Protect confidential information
Limit exposure of sensitive fields
Support regulatory compliance
Reduce accidental data disclosure
Allow broader access to datasets without exposing confidential values

Dynamic Data Masking provides a simple way to accomplish these goals.

How Dynamic Data Masking Works

The masking process occurs during query execution.

			
User Query
     ↓
Security Evaluation
     ↓
Masking Applied
     ↓
Results Returned

		

Authorized users:

john.smith@contoso.com

Unauthorized users:

jXXXXXXX@XXXX.com

The underlying stored value never changes.

Common Dynamic Data Masking Use Cases

Customer Contact Information

Sensitive fields:

Email addresses
Phone numbers
Mailing addresses

Example:

			
Actual:
john.smith@contoso.com
Masked:
jXXXXXXX@XXXX.com

Employee Information

Sensitive fields:

Salary
Bonus information
Tax identifiers

Example:

			
Actual:
$120,000
Masked:
$XXXXXX

Financial Information

Sensitive fields:

Credit card numbers
Bank account numbers
Account balances

Example:

			
Actual:
4321-5678-9876-1234
Masked:
XXXX-XXXX-XXXX-1234

Types of Data That Can Be Masked

Common candidates include:

Email addresses
Phone numbers
National identification numbers
Credit card numbers
Salary data
Medical information
Customer account information

Generally, highly sensitive columns are good candidates for masking.

Dynamic Data Masking vs Encryption

This distinction is frequently tested on certification exams.

Dynamic Data Masking	Encryption
Protects displayed results	Protects stored data
Data remains visible to privileged users	Data is encrypted at rest or in transit
User-facing security feature	Storage and transport security feature
Does not alter stored values	Changes stored representation

Example

Dynamic Data Masking:

			
Stored:
123-45-6789
Displayed:
XXX-XX-6789

Encryption:

			
Stored:
A7F4D93C12...

Dynamic Data Masking vs Row-Level Security

These concepts are often confused.

Dynamic Data Masking	Row-Level Security
Hides data values	Filters rows
Same rows visible	Different rows visible
Column-focused	Row-focused
Data remains visible in masked form	Rows may be completely hidden

Example:

RLS:

			
East Region Manager
→ East Region Rows Only

DDM:

			
All Rows Visible
→ Sensitive Values Masked

Dynamic Data Masking vs Column-Level Security

Another important distinction.

Dynamic Data Masking	Column-Level Security
Shows masked values	Hides column entirely
User sees partial data	User cannot access column
More flexible visibility	More restrictive security

Example:

DDM:

			
Salary
XXXXXX

CLS:

			
Salary Column
Not Visible

Dynamic Data Masking vs Object-Level Security

Dynamic Data Masking	Object-Level Security
Masks data values	Hides objects
User accesses table	Table may be hidden
Granular data visibility	Object visibility control

Example:

DDM:

Salary = XXXXX

OLS:

Payroll Table Hidden

Benefits of Dynamic Data Masking

Simplified Security

Protects sensitive values without redesigning datasets.

Reduced Data Exposure

Users only see the information necessary for their role.

Regulatory Support

Can help support compliance initiatives involving:

GDPR
HIPAA
PCI DSS
Internal governance policies

Easier Data Sharing

Organizations can provide broader dataset access while reducing risk.

Limitations of Dynamic Data Masking

For the DP-700 exam, understanding limitations is important.

Dynamic Data Masking:

Does NOT Encrypt Data

Data remains stored in its original form.

Does NOT Replace Access Controls

Users still require appropriate permissions.

Does NOT Replace RLS

Rows remain visible.

Does NOT Replace CLS

Columns remain accessible.

Is Not a Complete Security Solution

DDM should be combined with other security mechanisms.

Layered Security Approach

Organizations commonly combine:

			
Workspace Security
        ↓
Item Security
        ↓
Row-Level Security
        ↓
Column-Level Security
        ↓
Dynamic Data Masking
        ↓
Encryption

		

Each layer provides additional protection.

Common DP-700 Exam Scenarios

Scenario 1

Requirement:

Customer service representatives should view customer records but not full credit card numbers.

Solution:

Implement Dynamic Data Masking.

Scenario 2

Requirement:

Managers should only see employees within their region.

Solution:

Implement Row-Level Security.

Scenario 3

Requirement:

Payroll data should be completely hidden from analysts.

Solution:

Implement Object-Level Security or Column-Level Security.

Scenario 4

Requirement:

Protect sensitive data stored on disk.

Solution:

Use encryption rather than Dynamic Data Masking.

Best Practices

Mask Sensitive Columns

Focus on:

PII
Financial data
Healthcare information
Confidential business information

Combine DDM with Other Controls

Use:

Workspace permissions
Item permissions
RLS
CLS
OLS

for comprehensive protection.

Follow Least Privilege

Limit access to unmasked data.

Regularly Review Security Policies

Verify masking requirements align with governance policies.

Protect Production Data

Apply masking wherever sensitive data exposure could occur.

DP-700 Exam Focus Areas

You should understand:

✓ Dynamic Data Masking concepts

✓ How masking works

✓ Common masking scenarios

✓ Sensitive data protection

✓ Dynamic Data Masking vs Encryption

✓ Dynamic Data Masking vs RLS

✓ Dynamic Data Masking vs CLS

✓ Dynamic Data Masking vs OLS

✓ Security best practices

✓ Layered security approaches

Practice Exam Questions

Question 1

What is the primary purpose of Dynamic Data Masking?

A. Encrypt stored data

B. Restrict workspace access

C. Filter rows returned by a query

D. Hide sensitive data values from unauthorized users

Answer: D

Explanation

Dynamic Data Masking obscures sensitive data values in query results while leaving the underlying stored data unchanged.

Question 2

Which statement about Dynamic Data Masking is true?

A. It permanently modifies stored data.

B. It encrypts data at rest.

C. It masks data at query time for unauthorized users.

D. It removes sensitive columns.

Answer: C

Explanation

DDM operates at query time and displays masked values to users who do not have permission to view the actual data.

Question 3

A company wants customer service agents to view customer records while masking credit card numbers.

Which feature should be implemented?

A. Dynamic Data Masking

B. Row-Level Security

C. Deployment Rules

D. Workspace Viewer Role

Answer: A

Explanation

DDM allows users to view records while hiding sensitive portions of specific data fields.

Question 4

What is the primary difference between Dynamic Data Masking and Row-Level Security?

A. DDM encrypts data while RLS does not.

B. DDM controls workspace permissions while RLS controls item permissions.

C. DDM hides columns while RLS hides tables.

D. DDM masks values while RLS filters rows.

Answer: D

Explanation

RLS determines which rows are visible, while DDM determines how sensitive values are displayed.

Question 5

Which security feature completely hides a column from users?

A. Dynamic Data Masking

B. Column-Level Security

C. Row-Level Security

D. Encryption

Answer: B

Explanation

Column-Level Security removes access to the column entirely, whereas DDM displays masked values.

Question 6

A company needs to protect sensitive data stored on disk.

Which technology should be used?

A. Dynamic Data Masking

B. Build Permission

C. Encryption

D. Row-Level Security

Answer: C

Explanation

Encryption protects stored data, while DDM only affects how data is displayed.

Question 7

Which type of data is commonly protected using Dynamic Data Masking?

A. Email addresses

B. Credit card numbers

C. Social Security numbers

D. All of the above

Answer: D

Explanation

DDM is commonly used to protect various forms of sensitive personal and financial information.

Question 8

A user can access a salary column but sees masked values instead of actual salaries.

Which security feature is being used?

A. Row-Level Security

B. Dynamic Data Masking

C. Object-Level Security

D. Folder-Level Security

Answer: B

Explanation

DDM allows access to the column while masking sensitive values.

Question 9

Which statement accurately describes Dynamic Data Masking?

A. It replaces all other security controls.

B. It prevents users from accessing tables.

C. It should be combined with other security mechanisms.

D. It filters data based on user region.

Answer: C

Explanation

DDM is one layer of security and should be used alongside permissions, RLS, CLS, and encryption.

Question 10

A company wants users to see the last four digits of credit card numbers while masking the rest.

Which solution is most appropriate?

A. Object-Level Security

B. Workspace-Level Security

C. Encryption

D. Dynamic Data Masking

Answer: D

Explanation

Dynamic Data Masking can reveal portions of sensitive values while masking the remaining characters.

Exam Tip

One of the most common DP-700 exam traps is confusing Dynamic Data Masking with other security technologies.

Remember:

Requirement	Solution
Hide sensitive values	Dynamic Data Masking
Filter rows	Row-Level Security
Hide columns	Column-Level Security
Hide tables or measures	Object-Level Security
Protect stored data	Encryption

If users should still be able to access a column but only see a masked version of its contents, Dynamic Data Masking is usually the correct answer.

Go to the DP-700 Exam Prep Hub main page.

DP-700, Microsoft Certification, Microsoft Fabric June 3, 2026

Create and configure deployment pipelines (DP-700 Exam Prep)

This post is a part of the DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric Exam Prep Hub.
This topic falls under these sections:
Implement and manage an analytics solution (30–35%)
   --> Implement lifecycle management in Fabric
      --> Create and configure deployment pipelines

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

One of the most important aspects of enterprise analytics development is ensuring that changes move safely and consistently from development environments into production. Without a structured deployment process, organizations face risks such as inconsistent configurations, accidental overwrites, insufficient testing, and production outages.

Microsoft Fabric Deployment Pipelines provide a controlled mechanism for promoting content through different stages of the software development lifecycle. Deployment Pipelines help organizations implement DataOps and DevOps practices by enabling repeatable, auditable, and governed deployments.

For the DP-700 exam, you should understand how Deployment Pipelines work, how to create and configure them, how content is promoted between stages, how deployment rules work, and how Deployment Pipelines integrate with source control and lifecycle management strategies.

What Are Deployment Pipelines?

A Deployment Pipeline is a Fabric feature that enables content to move through multiple environments in a controlled manner.

A typical deployment pipeline consists of three stages:

			
Development
      ↓
Test
      ↓
Production

		

Each stage is associated with a separate Fabric workspace.

Deployment Pipelines help ensure that content is properly validated before reaching production.

Why Deployment Pipelines Are Important

Without Deployment Pipelines:

Developers may deploy directly to production.
Environment configurations may become inconsistent.
Testing may be skipped.
Rollbacks become more difficult.

Deployment Pipelines provide:

Controlled releases
Environment separation
Repeatable deployments
Reduced deployment risk
Improved governance
Better collaboration

Deployment Pipeline Architecture

A common architecture consists of:

			
Development Workspace
          ↓
     Deploy
          ↓
Test Workspace
          ↓
     Deploy
          ↓
Production Workspace

		

Each workspace contains a version of the solution appropriate for that stage.

Deployment Pipeline Stages

Development Stage

The Development stage is where new work is performed.

Activities include:

Creating notebooks
Building pipelines
Modifying warehouses
Developing Dataflows Gen2
Testing new features

Characteristics:

Frequent changes
Active development
Potential instability

Test Stage

The Test stage is used for validation.

Activities include:

Functional testing
Integration testing
User acceptance testing
Performance testing

Characteristics:

Controlled environment
Representative data
Validation before production

Production Stage

The Production stage contains approved content used by business users.

Characteristics:

Stable environment
Business-critical workloads
Strict change control

Creating a Deployment Pipeline

Creating a Deployment Pipeline generally involves the following steps.

Step 1: Create the Pipeline

From the Fabric workspace experience:

Create a new Deployment Pipeline.
Assign a pipeline name.
Configure the stages.

Example:

Sales Analytics Pipeline

Step 2: Assign Workspaces

Associate each stage with a Fabric workspace.

Example:

Stage	Workspace
Development	Sales-Dev
Test	Sales-Test
Production	Sales-Prod

Each workspace should be dedicated to its specific purpose.

Step 3: Validate Content

Ensure workspace content is configured properly before deployment.

Examples:

Notebooks
Data Pipelines
Dataflows Gen2
Warehouses
Lakehouses
Reports
Semantic Models

Step 4: Deploy Content

Deploy content from one stage to the next.

Example:

			
Development
      ↓
Deploy
      ↓
Test

		

After validation:

			
Test
      ↓
Deploy
      ↓
Production

		

Supported Fabric Items

Deployment Pipelines support many Fabric artifacts.

Common examples include:

Data Pipelines
Notebooks
Lakehouses
Warehouses
Semantic Models
Reports
Dataflows Gen2
Environments

The exact list of supported items may evolve as Fabric continues to expand.

Understanding Deployment

A deployment copies supported metadata and configurations from one stage to another.

Deployment typically includes:

Definitions
Metadata
Configurations

Deployment does not generally mean copying large volumes of production data between workspaces.

This distinction is important for exam questions.

Comparing Stages

Deployment Pipelines provide stage comparison capabilities.

Administrators can identify:

New items
Modified items
Missing items

Example:

Item	Development	Test
Customer Notebook	Updated	Old Version
Sales Pipeline	New	Missing

Comparison helps determine what should be deployed.

Deployment Rules

One of the most important DP-700 topics is Deployment Rules.

Deployment Rules allow environment-specific settings to be maintained during deployment.

Without Deployment Rules:

			
Development Connection String
          ↓
Deploy
          ↓
Production Connection String Overwritten

		

With Deployment Rules:

			
Development Connection String
          ↓
Deploy
          ↓
Production Connection String Preserved

		

Why Deployment Rules Matter

Organizations often have different settings per environment.

Examples include:

Environment	Data Source
Development	Dev Database
Test	Test Database
Production	Production Database

Deployment Rules prevent deployments from overwriting these environment-specific settings.

Common Deployment Rule Scenarios

Data Source Connections

Development:

SalesDB-Dev

Production:

SalesDB-Prod

Deployment Rules preserve the correct environment-specific connection.

Parameter Values

Different environments may use:

Different storage accounts
Different schemas
Different APIs

Deployment Rules ensure correct values remain in place.

Integration with Git

Deployment Pipelines and Git serve different purposes.

Feature	Purpose
Git	Source control
Deployment Pipeline	Environment promotion

Git manages:

Version history
Branching
Collaboration

Deployment Pipelines manage:

Test promotion
Production releases
Environment consistency

Exam Tip

A common DP-700 question asks which technology should be used.

If the requirement is:

Track changes → Git
Promote between environments → Deployment Pipeline

Deployment Pipeline Workflow

A common enterprise workflow:

			
Developer
      ↓
Git Repository
      ↓
Development Workspace
      ↓
Deployment Pipeline
      ↓
Test Workspace
      ↓
Deployment Pipeline
      ↓
Production Workspace

		

This architecture aligns with modern DevOps practices.

Security and Permissions

To manage Deployment Pipelines, users typically require:

Appropriate Fabric permissions
Access to associated workspaces

Common workspace roles include:

Role	Capability
Admin	Full pipeline management
Member	Manage workspace content
Contributor	Create and edit content
Viewer	Read-only access

Administrators generally oversee deployments.

Monitoring Deployments

Deployment Pipelines provide visibility into:

Deployment history
Successful deployments
Failed deployments
Content differences

Benefits include:

Troubleshooting support
Change auditing
Governance tracking

Common DP-700 Exam Scenarios

Scenario 1

A company wants separate development, test, and production environments.

Solution:

Create a Deployment Pipeline with three stages.

Scenario 2

A deployment should not overwrite production database connections.

Solution:

Configure Deployment Rules.

Scenario 3

Developers need to promote tested notebooks into production.

Solution:

Deploy through a Deployment Pipeline.

Scenario 4

A company needs to track source code history.

Solution:

Use Git, not Deployment Pipelines.

Best Practices

Use Separate Workspaces

Maintain dedicated workspaces for:

Development
Test
Production

Never Develop in Production

All changes should originate in Development.

Use Deployment Rules

Prevent environment-specific settings from being overwritten.

Validate Before Promotion

Test thoroughly before promoting content.

Combine Git and Deployment Pipelines

Use:

Git for version control
Deployment Pipelines for deployment

Document Deployment Processes

Establish consistent promotion procedures.

DP-700 Exam Focus Areas

You should understand:

✓ Deployment Pipeline architecture

✓ Development, Test, and Production stages

✓ Workspace assignment

✓ Deployment operations

✓ Supported Fabric items

✓ Stage comparisons

✓ Deployment Rules

✓ Environment-specific configurations

✓ Integration with Git

✓ Security considerations

✓ Monitoring and auditing

Practice Exam Questions

Question 1

What is the primary purpose of a Deployment Pipeline in Microsoft Fabric?

A. Track source code changes

B. Manage Spark clusters

C. Promote content between environments

D. Store warehouse data

Answer: C

Explanation

Deployment Pipelines are designed to move content through development, test, and production environments in a controlled manner.

Question 2

Which stage typically contains content actively being developed?

A. Development

B. Test

C. Production

D. Deployment

Answer: A

Explanation

The Development stage is where developers create and modify Fabric artifacts before testing and deployment.

Question 3

A company wants to validate notebooks before releasing them to business users.

Which deployment stage should be used before Production?

A. Archive

B. Sandbox

C. Workspace

D. Test

Answer: D

Explanation

The Test stage allows organizations to validate functionality before promoting content to Production.

Question 4

What is the purpose of Deployment Rules?

A. Improve Spark performance

B. Control notebook versioning

C. Create Git branches

D. Preserve environment-specific settings

Answer: D

Explanation

Deployment Rules allow different environments to maintain their own configuration values during deployments.

Question 5

Which technology should be used to maintain source code history?

A. Deployment Pipeline

B. Monitoring Hub

C. Git Integration

D. Capacity Metrics

Answer: C

Explanation

Git provides version control, branching, collaboration, and historical tracking capabilities.

Question 6

Which Fabric item can be promoted through a Deployment Pipeline?

A. Data Pipeline

B. Notebook

C. Lakehouse

D. All of the above

Answer: D

Explanation

Deployment Pipelines support many Fabric artifacts, including pipelines, notebooks, and Lakehouses.

Question 7

A deployment from Development to Production overwrites a production connection string.

Which feature could have prevented this?

A. Lineage View

B. Deployment Rule

C. Gateway Cluster

D. Dataflow Refresh

Answer: B

Explanation

Deployment Rules preserve environment-specific values such as connection strings and parameter settings.

Question 8

What is the recommended sequence for a deployment pipeline?

A. Production → Test → Development

B. Test → Development → Production

C. Development → Test → Production

D. Workspace → Git → Production

Answer: C

Explanation

Changes should move from Development to Test and finally to Production after validation.

Question 9

Which statement best describes the relationship between Git and Deployment Pipelines?

A. They serve the same purpose.

B. Deployment Pipelines replace Git.

C. Git replaces Deployment Pipelines.

D. Git manages source control while Deployment Pipelines manage environment promotion.

Answer: D

Explanation

Git handles version control and collaboration, while Deployment Pipelines handle content promotion between environments.

Question 10

A company wants to compare the contents of Development and Test before deployment.

Which Deployment Pipeline capability should they use?

A. Stage comparison

B. Dataflow lineage

C. Capacity monitoring

D. Spark history

Answer: A

Explanation

Stage comparison identifies differences between environments, helping administrators determine what should be deployed.

Exam Tip

For DP-700, one of the most common lifecycle management distinctions is:

Requirement	Solution
Track changes and maintain history	Git Integration
Promote content across environments	Deployment Pipeline
Preserve environment-specific values	Deployment Rules
Validate content before production	Test Stage

When you see questions involving Development, Test, and Production workspaces, the correct answer is often related to Deployment Pipelines. When you see questions involving version history, branching, merging, or rollback, the correct answer is typically Git integration.

Go to the DP-700 Exam Prep Hub main page.

DP-700, Microsoft Certification, Microsoft Fabric June 3, 2026

Implement row-level, column-level, object-level, and folder/file-level access controls (DP-700 Exam Prep)

This post is a part of the DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric Exam Prep Hub.
This topic falls under these sections:
Implement and manage an analytics solution (30–35%)
   --> Configure security and governance
      --> Implement row-level, column-level, object-level, and folder/file-level access controls

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

Modern data platforms must secure information at multiple layers. While workspace-level and item-level permissions determine who can access Fabric assets, organizations often require much more granular control over the data itself.

For example:

A regional sales manager should only see sales data for their region.
Human Resources staff should see salary information, while other users should not.
Analysts should access specific tables but not highly sensitive tables.
Data engineers should have access to specific folders within OneLake while being restricted from others.

Microsoft Fabric supports multiple layers of security to address these requirements:

Row-Level Security (RLS)
Column-Level Security (CLS)
Object-Level Security (OLS)
Folder/File-Level Security

These controls help organizations implement the Principle of Least Privilege while supporting regulatory compliance, governance requirements, and data protection initiatives.

For the DP-700 exam, understanding the differences between these security mechanisms and when to use each one is extremely important.

Understanding Security Layers

Security in Fabric is often implemented as multiple layers.

			
Workspace Security
        ↓
Item Security
        ↓
Row-Level Security
        ↓
Column-Level Security
        ↓
Object-Level Security
        ↓
Folder/File Security

		

Each layer controls access to increasingly granular portions of data.

Row-Level Security (RLS)

What Is Row-Level Security?

Row-Level Security restricts which rows of data a user can view.

Users access the same table or report but see different subsets of data.

Example table:

Employee	Region	Sales
John	East	100,000
Sarah	West	150,000
Mike	East	120,000

With RLS:

User	Visible Data
East Manager	East rows only
West Manager	West rows only

Why Use RLS?

Organizations commonly use RLS to:

Restrict regional data
Secure department-specific data
Support multi-tenant solutions
Enforce business ownership boundaries

Static RLS

Static RLS uses predefined security roles.

Example:

Region = "East"

Users assigned to the role see only East region data.

Dynamic RLS

Dynamic RLS evaluates the currently logged-in user.

Example:

USERPRINCIPALNAME()

The system automatically determines which rows the user should access.

Dynamic RLS is commonly used in enterprise implementations because it scales better than manually assigning users to roles.

Common DP-700 RLS Scenario

A company has regional managers.

Requirement:

Each manager should only see data for their assigned region.

Solution:

Implement Row-Level Security.

Column-Level Security (CLS)

What Is Column-Level Security?

Column-Level Security restricts access to specific columns while allowing access to the rest of the table.

Example table:

EmployeeID	Name	Salary
1001	John	90,000
1002	Sarah	110,000

With CLS:

HR Users:

EmployeeID	Name	Salary
1001	John	90,000

Non-HR Users:

EmployeeID	Name
1001	John

The Salary column is hidden.

Why Use CLS?

CLS is commonly used to protect:

Salary information
Personally identifiable information (PII)
Social Security numbers
Healthcare data
Financial account information

Benefits of CLS

Protects sensitive fields
Simplifies compliance efforts
Reduces data exposure
Supports privacy regulations

Common DP-700 CLS Scenario

Requirement:

Managers need employee information but must not see salary data.

Solution:

Implement Column-Level Security.

Object-Level Security (OLS)

What Is Object-Level Security?

Object-Level Security controls access to entire database objects.

Examples include:

Tables
Views
Columns
Measures

Rather than filtering data, OLS completely hides objects from users.

Example

Database Objects:

			
Sales Table
Customer Table
Payroll Table

Finance Users:

			
Sales Table
Customer Table
Payroll Table

Sales Users:

			
Sales Table
Customer Table

The Payroll table is completely hidden.

OLS vs CLS

This distinction is frequently tested on the DP-700 exam.

Feature	CLS	OLS
Hides columns	Yes	Yes
Hides tables	No	Yes
Hides measures	No	Yes
Hides entire objects	No	Yes

Why Use OLS?

Organizations use OLS when users should not even know an object exists.

Examples:

Payroll tables
Executive compensation data
Audit tables
Compliance datasets

Common DP-700 OLS Scenario

Requirement:

Analysts should not see the Payroll table at all.

Solution:

Implement Object-Level Security.

Folder-Level Security

What Is Folder-Level Security?

Folder-level security controls access to folders within storage structures such as OneLake.

Example:

			
Finance
│
├── Payroll
├── Budgets
└── Forecasts
Sales
│
├── Regional
└── Territory

		

Finance users may access:

Finance/*

while Sales users may access:

Sales/*

Why Folder-Level Security Matters

Benefits include:

Departmental separation
Data governance
Simplified access management
Better organization

OneLake Considerations

Microsoft Fabric’s OneLake serves as the unified storage layer.

Organizations often structure OneLake data using:

			
Department
    ↓
Project
    ↓
Files

		

Folder-level controls help restrict access appropriately.

File-Level Security

What Is File-Level Security?

File-level security controls access to individual files.

Example:

			
EmployeeData.parquet
Payroll.parquet
Benefits.parquet

A user may be granted access to:

EmployeeData.parquet

while being denied access to:

Payroll.parquet

Use Cases

File-level security is useful when:

Sensitive files exist within shared folders
Regulatory restrictions apply
Individual datasets require additional protection

Folder-Level vs File-Level Security

Folder Security	File Security
Controls entire folder	Controls individual files
Easier to manage	More granular
Less administrative effort	Greater precision

Comparing All Four Security Models

Security Type	Controls
Row-Level Security	Which rows users can see
Column-Level Security	Which columns users can see
Object-Level Security	Which tables, views, measures, or columns exist for users
Folder/File Security	Which storage locations users can access

Security Layer Examples

Example 1: Regional Sales

Requirement:

Users should only see sales for their region.

Solution:

Row-Level Security

Example 2: Salary Protection

Requirement:

Users can see employee records but not salary information.

Solution:

Column-Level Security

Example 3: Payroll Table Protection

Requirement:

Payroll tables should be invisible to most users.

Solution:

Object-Level Security

Example 4: Departmental Data Separation

Requirement:

Finance files should not be accessible by Sales users.

Solution:

Folder-Level Security

Combining Security Controls

Enterprise environments often combine multiple controls.

Example:

			
Workspace Permission
        ↓
Item Permission
        ↓
RLS
        ↓
CLS
        ↓
OLS
        ↓
Folder Security

		

This layered approach provides stronger protection.

Best Practices

Follow Least Privilege

Grant only required access.

Prefer Dynamic RLS

Dynamic RLS scales better than manually maintained security roles.

Use OLS for Highly Sensitive Objects

Hide entire tables when appropriate.

Protect Sensitive Columns

Use CLS for PII and confidential information.

Organize OneLake Carefully

Use logical folder structures to simplify governance.

Audit Security Regularly

Review permissions and security configurations periodically.

DP-700 Exam Focus Areas

You should understand:

✓ Row-Level Security (RLS)

✓ Static versus Dynamic RLS

✓ Column-Level Security (CLS)

✓ Object-Level Security (OLS)

✓ Folder-level access controls

✓ File-level access controls

✓ OneLake security concepts

✓ Security layering

✓ Least-privilege principles

✓ Common security implementation scenarios

Practice Exam Questions

Question 1

A company wants regional managers to see only sales records from their assigned region.

Which security feature should be implemented?

A. File-Level Security

B. Object-Level Security

C. Workspace Security

D. Row-Level Security

Answer: D

Explanation

Row-Level Security filters rows based on user identity or role, allowing managers to view only relevant regional data.

Question 2

A user should be able to view employee records but not salary information.

Which security feature should be used?

A. Row-Level Security

B. Workspace Viewer Role

C. Column-Level Security

D. Deployment Rules

Answer: C

Explanation

Column-Level Security restricts access to specific columns while allowing access to the rest of the table.

Question 3

Which security feature can completely hide a table from users?

A. Row-Level Security

B. Object-Level Security

C. File-Level Security

D. Workspace Security

Answer: B

Explanation

Object-Level Security can hide entire tables, views, columns, and measures.

Question 4

A company wants to prevent users from accessing a specific file within a shared OneLake folder.

Which security mechanism is most appropriate?

A. Row-Level Security

B. Column-Level Security

C. Object-Level Security

D. File-Level Security

Answer: D

Explanation

File-Level Security controls access to individual files.

Question 5

What is a key advantage of Dynamic RLS compared to Static RLS?

A. Faster query execution

B. Automatically adjusts security based on the logged-in user

C. Eliminates the need for semantic models

D. Removes workspace permissions

Answer: B

Explanation

Dynamic RLS uses user identity functions to determine appropriate data access automatically.

Question 6

Which security control is best suited for hiding a Payroll table from analysts?

A. Column-Level Security

B. Folder-Level Security

C. Object-Level Security

D. Row-Level Security

Answer: C

Explanation

OLS completely hides the table from unauthorized users.

Question 7

A company wants Finance users to access the Finance folder but not the Sales folder.

Which security mechanism should be implemented?

A. Folder-Level Security

B. Row-Level Security

C. Column-Level Security

D. Build Permission

Answer: A

Explanation

Folder-Level Security restricts access to specific storage locations.

Question 8

Which statement correctly describes Column-Level Security?

A. It filters rows of data.

B. It hides specific columns while keeping the table accessible.

C. It hides entire tables.

D. It controls workspace membership.

Answer: B

Explanation

CLS allows access to the table while restricting access to designated columns.

Question 9

What is the primary purpose of Object-Level Security?

A. Filter data rows

B. Control notebook execution

C. Hide entire data objects from users

D. Manage workspace permissions

Answer: C

Explanation

OLS controls visibility of tables, views, columns, and measures.

Question 10

Which combination provides the most granular data protection?

A. Workspace Security only

B. Workspace Security and Item Security only

C. Row-Level Security only

D. Layered security using RLS, CLS, OLS, and folder/file controls

Answer: D

Explanation

Layering multiple security mechanisms provides comprehensive protection across multiple levels of the data platform.

Exam Tip

For the DP-700 exam, remember these distinctions:

Requirement	Solution
Restrict specific records	Row-Level Security (RLS)
Hide specific columns	Column-Level Security (CLS)
Hide entire tables, views, or measures	Object-Level Security (OLS)
Restrict storage locations	Folder/File-Level Security

A common exam strategy is to identify what is being protected:

Rows → RLS
Columns → CLS
Objects (tables/views/measures) → OLS
Files/Folders → Folder/File-Level Security

Many DP-700 questions present multiple security options that seem plausible. Focusing on the exact scope of the restriction usually leads directly to the correct answer.

Go to the DP-700 Exam Prep Hub main page.

DP-700, Microsoft Certification, Microsoft Fabric June 3, 2026

Implement item-level access controls (DP-700 Exam Prep)

This post is a part of the DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric Exam Prep Hub.
This topic falls under these sections:
Implement and manage an analytics solution (30–35%)
   --> Configure security and governance
      --> Implement item-level access controls

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

While workspace-level permissions provide the first layer of security in Microsoft Fabric, they are often not sufficient for enterprise environments. Organizations frequently need to grant users access to specific assets without providing access to everything within a workspace.

This is where item-level access controls become important.

Item-level access controls allow administrators and data engineers to secure individual Fabric items such as Lakehouses, Warehouses, Semantic Models, Reports, Dashboards, and other assets. These controls provide more granular security than workspace permissions and help organizations implement governance, compliance, and least-privilege access models.

For the DP-700 exam, it is important to understand how item-level permissions work, how they interact with workspace permissions, and when to use item-level controls instead of workspace-level access.

What Are Item-Level Access Controls?

Item-level access controls are permissions assigned directly to specific Fabric assets rather than to an entire workspace.

For example:

			
Workspace
│
├── Lakehouse A
├── Lakehouse B
├── Warehouse A
├── Warehouse B
└── Notebook A

		

A user might need access only to:

Lakehouse A
Warehouse A

without gaining access to the entire workspace.

Item-level permissions make this possible.

Why Item-Level Security Is Important

Many organizations have:

Sensitive financial data
Human resources data
Customer information
Regulatory data
Executive reporting data

Providing broad workspace access could expose data unnecessarily.

Item-level controls allow organizations to:

Restrict sensitive assets
Share specific content
Improve governance
Support compliance requirements
Implement least-privilege security

Workspace Permissions vs Item-Level Permissions

One of the most frequently tested DP-700 topics is understanding the difference between workspace-level and item-level permissions.

Workspace-Level Access	Item-Level Access
Applies to entire workspace	Applies to specific items
Broader permissions	Granular permissions
Easier administration	More precise security
Used for collaboration	Used for controlled sharing

Example

A data engineer may need:

Contributor access to a workspace

while an executive may only need:

Access to a single report

In this scenario, item-level permissions are the preferred solution.

Permission Inheritance

Understanding inheritance is critical for the DP-700 exam.

Workspace permissions often provide access to contained items.

However, item-level permissions can be used to:

Grant access beyond workspace membership
Share specific assets
Restrict access to sensitive content

Exam Tip

Many questions focus on determining whether workspace-level permissions or item-level permissions should be used.

A good rule is:

Access to many assets → Workspace permissions
Access to one or a few assets → Item-level permissions

Item-Level Security for Lakehouses

Lakehouses contain:

Delta tables
Files
Structured data
Unstructured data

Organizations often need to control who can access these assets.

Examples include:

Finance Lakehouse
HR Lakehouse
Customer Analytics Lakehouse

Item-level permissions can limit access to specific Lakehouses without exposing all workspace assets.

Item-Level Security for Warehouses

Fabric Data Warehouses frequently contain business-critical data.

Examples include:

Sales metrics
Financial transactions
Customer information

Warehouse permissions can be assigned independently of workspace permissions.

This helps organizations:

Restrict data access
Support regulatory requirements
Enforce data ownership

Item-Level Security for Reports

Reports are one of the most commonly shared Fabric assets.

A user may need:

Access to a report
No access to development artifacts

Examples:

Executive dashboards
Department reports
Operational reporting

Item-level sharing enables this scenario.

Semantic Model Permissions

Semantic Models serve as the foundation for many reporting solutions.

Permissions can control who may:

View the model
Build reports from the model
Query the model

Common permissions include:

Read access
Build permission

Understanding Build Permission

Build permission is a commonly tested Fabric security topic.

Users with Build permission can:

Create reports from a semantic model
Analyze data using approved tools
Reuse trusted datasets

Without Build permission, users may be able to view reports but not create new reports from the underlying semantic model.

Example

			
Semantic Model
       ↓
Build Permission
       ↓
Create New Reports

		

This distinction frequently appears in exam questions.

Sharing Items

Fabric allows users to share individual assets.

Examples include:

Reports
Semantic Models
Dashboards

Sharing provides targeted access without adding users to the workspace.

Benefits include:

Reduced administrative overhead
Improved security
Easier collaboration

Row-Level Security (RLS)

Although RLS is often discussed separately from item permissions, it is closely related to access control.

Row-Level Security restricts which rows a user can view.

Example:

User	Visible Region
Alice	East
Bob	West

Both users access the same report but see different data.

Important Distinction

Item-level permissions control:

Who can access the item

RLS controls:

What data they can see within the item

This distinction is commonly tested.

Object-Level Security (OLS)

Object-Level Security provides even more granular control.

OLS can restrict access to:

Tables
Columns
Measures

Example:

Finance users:

Salary Column = Visible

General users:

Salary Column = Hidden

Combining Security Layers

Enterprise security often combines:

			
Workspace Security
        ↓
Item Security
        ↓
Row-Level Security
        ↓
Object-Level Security

		

Each layer provides additional protection.

Security Groups and Item Permissions

Best practice is to assign item permissions through Microsoft Entra ID groups rather than individual users.

Example:

			
Finance Executives Group
       ↓
Executive Dashboard Access

Benefits include:

Easier administration
Consistent security
Simplified auditing

Common DP-700 Exam Scenarios

Scenario 1

A CEO needs access to a financial dashboard but should not access the entire workspace.

Solution:

Use item-level sharing on the report.

Scenario 2

Analysts need to create reports from a semantic model.

Solution:

Grant Build permission.

Scenario 3

Regional managers should only see sales data for their region.

Solution:

Implement Row-Level Security.

Scenario 4

Users should not see salary-related columns.

Solution:

Implement Object-Level Security.

Best Practices

Follow Least Privilege

Grant only necessary permissions.

Use Security Groups

Avoid assigning permissions to individual users whenever possible.

Use Build Permission Carefully

Build permission enables report creation and data exploration.

Combine Security Layers

Use:

Workspace permissions
Item permissions
RLS
OLS

where appropriate.

Audit Permissions Regularly

Review access assignments periodically.

Secure Sensitive Assets Separately

Finance, HR, and compliance data should receive additional scrutiny.

DP-700 Exam Focus Areas

You should understand:

✓ Item-level permissions

✓ Workspace vs item-level security

✓ Semantic model permissions

✓ Build permission

✓ Report sharing

✓ Lakehouse permissions

✓ Warehouse permissions

✓ Permission inheritance

✓ Row-Level Security (RLS)

✓ Object-Level Security (OLS)

✓ Security group assignments

✓ Least-privilege principles

Practice Exam Questions

Question 1

A user needs access to a single report but should not have access to the workspace.

What should be used?

A. Workspace Admin role

B. Workspace Member role

C. Item-level sharing

D. Capacity assignment

Answer: C

Explanation

Item-level sharing allows access to a specific report without granting workspace access.

Question 2

What is the primary purpose of item-level access controls?

A. Manage Fabric capacities

B. Secure specific Fabric assets

C. Configure deployment pipelines

D. Manage Spark pools

Answer: B

Explanation

Item-level permissions provide granular security for individual Fabric items.

Question 3

Which permission allows users to create reports from an existing semantic model?

A. Viewer

B. Contributor

C. Read

D. Build

Answer: D

Explanation

Build permission allows users to create new reports and analyses from a semantic model.

Question 4

A user can access a report but should only see rows for their assigned sales region.

Which security feature should be implemented?

A. Item sharing

B. Workspace Viewer role

C. Object-Level Security

D. Row-Level Security

Answer: D

Explanation

Row-Level Security filters data based on user identity or role.

Question 5

What is the primary difference between workspace-level and item-level permissions?

A. Item-level permissions apply to specific assets

B. Workspace permissions only apply to reports

C. Item permissions control Spark resources

D. Workspace permissions cannot be assigned to groups

Answer: A

Explanation

Workspace permissions affect the entire workspace, while item-level permissions affect specific assets.

Question 6

A company wants users to access an executive dashboard without viewing development notebooks.

What should be implemented?

A. Workspace Admin access

B. Workspace Contributor access

C. Item-level access to the dashboard

D. Capacity permissions

Answer: C

Explanation

Item-level sharing allows access to specific assets without exposing the broader workspace.

Question 7

What does Object-Level Security (OLS) control?

A. Workspace membership

B. Data refresh schedules

C. Deployment permissions

D. Access to tables, columns, and measures

Answer: D

Explanation

OLS provides granular security at the database object level.

Question 8

A user belongs to a workspace but should not access a highly sensitive financial warehouse.

What security approach is most appropriate?

A. Use item-level controls on the warehouse

B. Increase capacity

C. Configure deployment rules

D. Create a notebook

Answer: A

Explanation

Item-level permissions provide additional control over access to sensitive assets.

Question 9

Which statement about Build permission is correct?

A. It grants workspace administration rights.

B. It allows users to create reports from a semantic model.

C. It controls deployment pipelines.

D. It replaces Row-Level Security.

Answer: B

Explanation

Build permission enables report creation and data exploration based on a semantic model.

Question 10

What is considered a best practice when assigning item-level permissions?

A. Assign permissions directly to every user

B. Use only Admin roles

C. Use Microsoft Entra ID groups

D. Disable item sharing

Answer: C

Explanation

Group-based permission management improves consistency, scalability, and governance.

Exam Tip

For the DP-700 exam, remember the following hierarchy:

Security Layer	Purpose
Workspace Security	Controls access to the workspace
Item-Level Security	Controls access to specific assets
Row-Level Security (RLS)	Controls which rows users can see
Object-Level Security (OLS)	Controls which tables, columns, or measures users can access

A common exam strategy is to identify whether the question is asking who can access an asset (item permissions) or what data they can see after gaining access (RLS/OLS). This distinction often leads directly to the correct answer.

Go to the DP-700 Exam Prep Hub main page.

Analytics, DP-700, Microsoft Certification, Microsoft Fabric June 3, 2026

Implement workspace-level access controls (DP-700 Exam Prep)

This post is a part of the DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric Exam Prep Hub.
This topic falls under these sections:
Implement and manage an analytics solution (30–35%)
   --> Configure security and governance
      --> Implement workspace-level access controls

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

Security and governance are foundational components of any enterprise analytics platform. In Microsoft Fabric, workspaces serve as the primary organizational boundary for managing content, collaboration, and permissions. Because workspaces often contain sensitive data assets such as Lakehouses, Warehouses, Data Pipelines, Notebooks, and Reports, controlling who can access and modify these assets is critical.

Workspace-level access controls provide the first layer of security within Fabric. They determine who can view, create, modify, share, and administer workspace content. Properly configured access controls help organizations implement the principle of least privilege, improve governance, reduce security risks, and ensure compliance with organizational policies.

For the DP-700 exam, you should understand workspace roles, permission inheritance, Microsoft Entra ID integration, security best practices, and common access-control scenarios.

Understanding Fabric Workspaces

A workspace is a collaborative environment used to organize and manage Fabric assets.

Examples of assets stored within a workspace include:

Lakehouses
Data Warehouses
Data Pipelines
Dataflows Gen2
Notebooks
Semantic Models
Reports
Eventstreams
Environments

Workspaces serve as the primary security boundary for these resources.

Why Workspace-Level Access Controls Matter

Without proper access controls:

Unauthorized users may access sensitive data.
Critical assets may be modified accidentally.
Governance requirements may not be met.
Production environments may be compromised.

Workspace-level security helps organizations:

Restrict access
Protect sensitive data
Separate responsibilities
Support auditing and compliance
Implement least-privilege security

Microsoft Entra ID Integration

Microsoft Fabric uses Microsoft Entra ID for authentication and identity management.

Users access Fabric using their organizational accounts.

Benefits include:

Centralized identity management
Single sign-on (SSO)
Multi-factor authentication support
Group-based security management
Conditional Access integration

Fabric does not maintain a separate user authentication system.

Workspace Roles

Workspace access is controlled through predefined roles.

The four primary workspace roles are:

Role	Purpose
Admin	Full workspace control
Member	Create, edit, and publish content
Contributor	Create and modify content
Viewer	Read-only access

Understanding these roles is extremely important for the DP-700 exam.

Admin Role

Admins have complete control over the workspace.

Capabilities include:

Manage workspace settings
Add or remove users
Assign roles
Delete workspace content
Configure Git integration
Configure deployment pipelines
Manage permissions

Admins effectively own the workspace.

Use Cases

Platform administrators
Workspace owners
Data engineering leads

Member Role

Members can actively participate in workspace development.

Capabilities include:

Create content
Modify content
Publish content
Collaborate with team members

However, Members do not have all administrative capabilities.

Use Cases

Senior developers
Data engineers
Analytics developers

Contributor Role

Contributors can create and modify content but have fewer management capabilities than Members.

Capabilities include:

Create notebooks
Create pipelines
Modify assets
Build solutions

Contributors generally focus on development activities rather than workspace administration.

Use Cases

Developers
Data engineers
ETL specialists

Viewer Role

Viewers have read-only access.

Capabilities include:

View reports
View data assets
Review content

Restrictions include:

Cannot modify content
Cannot create content
Cannot administer the workspace

Use Cases

Business users
Auditors
Stakeholders

Workspace Permission Assignment

Permissions can be assigned to:

Individual users
Security groups
Microsoft Entra ID groups

Best practice is to assign permissions through groups whenever possible.

Example:

			
Finance-DataEngineers → Contributor
Finance-Developers → Member
Finance-Managers → Viewer

Benefits include:

Easier administration
Reduced maintenance
Improved consistency

Principle of Least Privilege

One of the most important security concepts for DP-700 is the Principle of Least Privilege.

This principle states:

Users should receive only the permissions necessary to perform their job functions.

Example:

User Type	Recommended Role
Report Consumer	Viewer
Data Engineer	Contributor
Team Lead	Member
Workspace Owner	Admin

Over-permissioning increases security risks.

Permission Inheritance

Workspace-level permissions often provide access to items contained within the workspace.

Examples include:

Lakehouses
Warehouses
Notebooks
Dataflows

A user with workspace access generally gains access to supported content based on their assigned role.

However, some Fabric items support additional item-level permissions that can supplement workspace-level controls.

Exam Tip

Workspace permissions and item-level permissions are related but not identical.

Many exam questions test your understanding of this distinction.

Workspace Access and OneLake

OneLake security is closely tied to Fabric permissions.

When users access:

Lakehouses
Warehouse data
OneLake files

their permissions are generally governed through Fabric security controls.

This means workspace permissions play a significant role in determining data accessibility.

Separating Development, Test, and Production Access

Organizations commonly implement separate workspaces for:

			
Development
      ↓
Test
      ↓
Production

		

Different access controls are applied to each environment.

Example:

Environment	Typical Permissions
Development	Contributors and Members
Test	Limited Contributors
Production	Mostly Viewers

This reduces the risk of unauthorized production changes.

Workspace Security Best Practices

Use Security Groups

Prefer:

Sales-DataEngineers

instead of assigning permissions to individual users.

Minimize Admins

Only a small number of users should have Admin privileges.

Separate Production Access

Production workspaces should have stricter permissions.

Review Permissions Regularly

Conduct periodic audits of workspace access.

Follow Least Privilege

Assign the lowest role necessary.

Use Dedicated Service Principals

Automated processes should use service principals rather than personal accounts.

Common Security Scenarios

Scenario 1

A business analyst needs to view reports but should not modify content.

Solution:

Assign the Viewer role.

Scenario 2

A data engineer needs to build pipelines and notebooks but should not manage workspace permissions.

Solution:

Assign the Contributor role.

Scenario 3

A workspace owner needs to manage users and configure workspace settings.

Solution:

Assign the Admin role.

Scenario 4

A team lead needs to create and manage content while collaborating with developers.

Solution:

Assign the Member role.

Auditing and Governance

Workspace access controls support governance by enabling:

Access reviews
Compliance reporting
Security audits
Change tracking

Administrators should periodically verify:

User memberships
Group assignments
Admin privileges
Production access

These activities help maintain a secure Fabric environment.

DP-700 Exam Focus Areas

You should understand:

✓ Workspace roles

✓ Admin, Member, Contributor, and Viewer permissions

✓ Microsoft Entra ID integration

✓ Security group assignments

✓ Least-privilege principles

✓ Workspace permission inheritance

✓ Item-level versus workspace-level security

✓ Production environment security

✓ Service principal usage

✓ Governance and auditing practices

Practice Exam Questions

Question 1

Which workspace role provides full control over workspace settings and permissions?

A. Admin

B. Member

C. Contributor

D. Viewer

Answer: A

Explanation

Admins have complete control over workspace management, including permissions, settings, and content administration.

Question 2

A user needs read-only access to reports and data assets in a workspace.

Which role should be assigned?

A. Admin

B. Member

C. Contributor

D. Viewer

Answer: D

Explanation

The Viewer role allows users to access and view content without modifying it.

Question 3

Which Microsoft service provides identity and authentication for Fabric users?

A. Azure Data Lake Storage

B. Microsoft Entra ID

C. OneLake

D. Fabric Capacity

Answer: B

Explanation

Microsoft Entra ID provides authentication, identity management, and access control for Fabric users.

Question 4

A data engineer needs to create notebooks and pipelines but should not manage workspace permissions.

Which role is most appropriate?

A. Viewer

B. Admin

C. Contributor

D. Workspace Owner

Answer: C

Explanation

Contributors can create and modify content without having full administrative privileges.

Question 5

What is the primary goal of the Principle of Least Privilege?

A. Maximize workspace access

B. Reduce storage costs

C. Improve Spark performance

D. Grant only the permissions required to perform a job

Answer: D

Explanation

Least privilege reduces security risks by ensuring users receive only the permissions necessary for their responsibilities.

Question 6

Which approach is generally recommended for assigning workspace permissions?

A. Assign permissions directly to every user

B. Use Microsoft Entra ID security groups

C. Give all users Member access

D. Assign Admin access broadly

Answer: B

Explanation

Group-based permission management simplifies administration and improves consistency.

Question 7

A team lead needs to create content, collaborate with developers, and participate in solution management but does not require full administrative control.

Which role is most appropriate?

A. Viewer

B. Contributor

C. Member

D. Admin

Answer: C

Explanation

Members can actively manage and collaborate on workspace content without having full administrative authority.

Question 8

Why should organizations limit the number of workspace Admins?

A. To reduce Spark resource consumption

B. To simplify notebook development

C. To improve deployment speed

D. To reduce security risk and administrative exposure

Answer: D

Explanation

Admin roles have extensive privileges and should be assigned only when necessary.

Question 9

A company wants automated deployment processes that are not dependent on employee accounts.

What should be used?

A. Viewer accounts

B. Personal accounts

C. Service principals

D. Shared passwords

Answer: C

Explanation

Service principals provide stable, secure identities for automation and deployment activities.

Question 10

What is the primary benefit of separating Development, Test, and Production workspaces?

A. Increased storage capacity

B. Improved security and change control

C. Reduced OneLake storage usage

D. Faster notebook execution

Answer: B

Explanation

Environment separation helps prevent accidental production changes and supports proper testing and governance.

Exam Tip

For the DP-700 exam, many security questions can be solved by understanding the differences between the four workspace roles:

Role	Key Capability
Admin	Full control and permissions management
Member	Create, manage, and collaborate on content
Contributor	Create and modify content
Viewer	Read-only access

When evaluating scenarios, choose the lowest role that satisfies the requirement. Microsoft frequently tests the Principle of Least Privilege, making it one of the most important security concepts to master for the exam.

Go to the DP-700 Exam Prep Hub main page.

DP-700, Microsoft Certification, Microsoft Fabric June 3, 2026

Implement database projects (DP-700 Exam Prep)

This post is a part of the DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric Exam Prep Hub.
This topic falls under these sections:
Implement and manage an analytics solution (30–35%)
   --> Implement lifecycle management in Fabric
      --> Implement database projects

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations adopt DevOps and DataOps practices, managing database changes through source control and automated deployments has become a critical requirement. Traditionally, database development was performed directly against production systems, often leading to inconsistent environments, deployment risks, and limited change tracking.

Database projects address these challenges by allowing database objects and schema definitions to be treated as code. This approach enables version control, collaboration, automated testing, continuous integration (CI), and continuous deployment (CD).

In Microsoft Fabric, database projects are particularly important when working with Fabric Data Warehouses. Database projects allow teams to manage warehouse schemas using modern software development practices and integrate them into broader lifecycle management processes.

For the DP-700 exam, you should understand the purpose of database projects, how they support DevOps workflows, their relationship to source control and deployment pipelines, and how they are used to manage Fabric Warehouse schemas.

What Is a Database Project?

A database project is a collection of files that define database objects and schema structures as source code.

Instead of creating objects directly within a database, developers define them in project files.

Examples include:

Tables
Views
Stored procedures
Functions
Security objects
Schemas
Constraints

The database project becomes the authoritative source for database definitions.

Why Database Projects Matter

Without database projects:

Schema changes may be undocumented.
Developers may overwrite each other’s work.
Production environments can drift from development environments.
Rollbacks become difficult.

Database projects provide:

Version control
Repeatable deployments
Change tracking
Environment consistency
Team collaboration

These capabilities align with modern DataOps and DevOps practices.

Database-as-Code

Database projects support the concept of Database-as-Code.

Database-as-Code means:

Database objects are stored as code files.
Changes are tracked through source control.
Deployments are automated.
Changes can be reviewed before implementation.

Instead of manually executing SQL scripts against production systems, organizations deploy controlled changes from source-controlled projects.

Database Projects and Fabric Warehouses

In Microsoft Fabric, database projects are primarily associated with Data Warehouses.

Fabric Warehouse objects such as:

Tables
Views
Stored procedures
Security definitions

can be managed through database projects.

This allows warehouse development to follow the same lifecycle management practices used for application development.

Components of a Database Project

A database project typically contains:

Schema Definitions

Definitions of database structures.

Examples:

			
CREATE TABLE Sales
(
    SalesID INT,
    Amount DECIMAL(18,2)
);

		

Views

Reusable query definitions.

Example:

			
CREATE VIEW vwSalesSummary
AS
SELECT SalesID, Amount
FROM Sales;

Stored Procedures

Reusable business logic.

Example:

			
CREATE PROCEDURE uspLoadSales
AS
BEGIN
    -- ETL logic
END;

		

Security Objects

Objects such as:

Users
Roles
Permissions

can also be defined and managed.

Database Projects and Source Control

One of the primary benefits of database projects is Git integration.

Database project files can be stored in repositories such as:

Azure DevOps
GitHub

Benefits include:

Change tracking
Auditability
Collaboration
Rollback capability

For DP-700, understand that database projects are often managed using the same source control processes as notebooks, pipelines, and other Fabric assets.

Version Control Workflow

A typical workflow looks like:

			
Developer
    ↓
Database Project
    ↓
Git Repository
    ↓
Validation
    ↓
Deployment

		

Benefits include:

Controlled releases
Code review processes
Consistent environments

Branching Strategies

Database projects commonly use standard Git branching practices.

Main Branch

Contains production-ready code.

main

Development Branch

Contains active development work.

			
main
 │
 └── develop

Feature Branches

Used for individual enhancements.

			
main
 │
 ├── feature/new-customer-table
 ├── feature/security-update
 └── feature-reporting-view

		

Feature branches reduce conflicts and improve collaboration.

Database Project Deployment

After changes are approved, they must be deployed.

The deployment process typically:

Compares source and target schemas.
Identifies differences.
Generates deployment actions.
Applies approved changes.

This process reduces manual effort and deployment errors.

Schema Comparison

Schema comparison is a key database project capability.

It identifies differences between:

Development and test environments
Test and production environments
Project definitions and deployed databases

Examples:

Object	Development	Production
Sales Table	Exists	Missing
Customer View	Updated	Old Version

Schema comparison helps maintain consistency across environments.

Database Projects and CI/CD

Database projects are frequently integrated into CI/CD pipelines.

CI/CD stands for:

Continuous Integration
Continuous Deployment

Typical process:

			
Developer Changes
        ↓
Git Commit
        ↓
Build Validation
        ↓
Testing
        ↓
Deployment Pipeline
        ↓
Production

		

Benefits:

Faster releases
Reduced risk
Increased automation
Improved reliability

Database Projects and Fabric Deployment Pipelines

Deployment pipelines complement database projects.

Database projects manage:

Database definitions
Source code
Schema changes

Deployment pipelines manage:

Promotion between environments
Release processes

Typical environment flow:

			
Development
      ↓
Test
      ↓
Production

		

This separation of responsibilities is important for the exam.

Managing Warehouse Objects Through Projects

Database projects help manage common warehouse objects.

Tables

Examples:

Fact tables
Dimension tables

Views

Used for:

Business reporting
Data abstraction
Security

Stored Procedures

Used for:

ETL operations
Data loading
Data quality checks

Security Definitions

Used for:

Role management
Permission assignments

Benefits of Database Projects

Improved Collaboration

Multiple developers can work simultaneously.

Repeatable Deployments

Deployments become consistent across environments.

Auditability

All changes are tracked through source control.

Rollback Capability

Previous versions can be restored.

Reduced Human Error

Automation reduces deployment mistakes.

Common DP-700 Exam Scenarios

Scenario 1

Multiple developers are modifying warehouse schemas.

Requirement:

Track changes and prevent overwriting.

Solution:

Implement a database project with Git integration.

Scenario 2

A company needs consistent schemas across development, test, and production environments.

Solution:

Use database projects and deployment pipelines.

Scenario 3

An accidental schema change is deployed.

Requirement:

Restore a previous version.

Solution:

Rollback using source control history.

Best Practices

Store All Database Objects in Source Control

Treat schemas as code.

Use Feature Branches

Avoid direct modifications to production branches.

Perform Code Reviews

Review schema changes before deployment.

Automate Deployments

Use deployment pipelines whenever possible.

Maintain Environment Consistency

Use schema comparison tools to identify drift.

Document Changes

Use meaningful commit messages.

Example:

Added customer dimension surrogate key support

DP-700 Exam Focus Areas

You should understand:

✓ Purpose of database projects

✓ Database-as-Code concepts

✓ Source control integration

✓ Git repositories

✓ Schema comparison

✓ Deployment processes

✓ CI/CD integration

✓ Branching strategies

✓ Warehouse schema management

✓ Rollback and versioning

✓ Relationship to deployment pipelines

Practice Exam Questions

Question 1

What is the primary purpose of a database project?

A. Execute Spark workloads

B. Store warehouse data files

C. Manage database schemas as source-controlled code

D. Monitor Fabric capacities

Answer: C

Explanation

Database projects allow database objects and schemas to be defined, tracked, and managed as code. This supports version control, collaboration, and automated deployments.

Question 2

Which Fabric item is most commonly managed through a database project?

A. Data Warehouse

B. Eventstream

C. Notebook

D. Lakehouse Shortcut

Answer: A

Explanation

Database projects are primarily associated with Fabric Data Warehouses and their schema objects.

Question 3

What is a key benefit of storing database projects in source control?

A. Increased storage capacity

B. Change tracking and version history

C. Faster SQL execution

D. Reduced OneLake usage

Answer: B

Explanation

Source control provides auditability, rollback capabilities, collaboration support, and historical tracking of schema changes.

Question 4

Which Git branching strategy allows developers to work on isolated enhancements?

A. Feature branch

B. Production branch

C. Release branch

D. Main-only development

Answer: A

Explanation

Feature branches enable developers to work independently and merge approved changes later.

Question 5

What is the purpose of schema comparison in a database project?

A. Increase warehouse performance

B. Compare Fabric capacities

C. Identify differences between database environments

D. Create deployment pipelines

Answer: C

Explanation

Schema comparison identifies discrepancies between source and target databases, helping maintain consistency.

Question 6

Which process typically occurs after a developer commits database project changes?

A. Data replication

B. Build validation and testing

C. Spark optimization

D. Capacity scaling

Answer: B

Explanation

CI/CD workflows generally include validation and testing before deployment occurs.

Question 7

Which database object can be managed within a database project?

A. Table

B. View

C. Stored Procedure

D. All of the above

Answer: D

Explanation

Database projects can manage tables, views, stored procedures, functions, schemas, and security objects.

Question 8

What is the primary role of deployment pipelines when used with database projects?

A. Store source code

B. Manage Git repositories

C. Promote changes between environments

D. Execute SQL queries

Answer: C

Explanation

Deployment pipelines move validated changes through development, test, and production environments.

Question 9

A team needs the ability to restore a previous schema version after a failed deployment.

Which capability should they use?

A. Version control rollback

B. Capacity monitoring

C. Spark session recovery

D. Dataflow refresh

Answer: A

Explanation

Source control systems maintain historical versions, enabling rollback to previous states when necessary.

Question 10

What does the term “Database-as-Code” refer to?

A. Storing data in code files

B. Executing SQL through notebooks

C. Converting SQL to Spark code

D. Managing database objects through source-controlled definitions

Answer: D

Explanation

Database-as-Code treats database definitions as managed source code artifacts that can be versioned, reviewed, tested, and deployed through automated processes.

Exam Tip

For the DP-700 exam, remember that database projects are fundamentally about applying software engineering practices to database development. Questions often focus on source control, schema management, CI/CD, deployment consistency, and collaboration. If a scenario involves managing warehouse schemas across multiple environments, tracking changes, enabling rollbacks, or automating deployments, a database project is often a key part of the solution.

Go to the DP-700 Exam Prep Hub main page.

Analytics, DP-700, Microsoft Certification, Microsoft Fabric June 3, 2026

Implement and use Microsoft Fabric audit logs (DP-700 Exam Prep)

This post is a part of the DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric Exam Prep Hub.
This topic falls under these sections:
Implement and manage an analytics solution (30–35%)
   --> Configure security and governance
      --> Implement and use Microsoft Fabric audit logs

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations adopt Microsoft Fabric for enterprise analytics, data engineering, and business intelligence workloads, maintaining visibility into user activity becomes increasingly important. Administrators and governance teams need to answer questions such as:

Who accessed a specific report?
Who deleted a workspace item?
When was a dataset modified?
Which users shared sensitive information?
What actions were performed during a security incident investigation?

Microsoft Fabric Audit Logs provide a detailed record of user and administrative activities across the Fabric environment. These logs are essential for governance, security monitoring, compliance reporting, operational troubleshooting, and forensic investigations.

For the DP-700 exam, you should understand what audit logs are, how they work, what information they capture, where they can be accessed, and how they support security and governance requirements.

What Are Microsoft Fabric Audit Logs?

Audit logs are records of activities performed within Microsoft Fabric.

They capture information about:

User actions
Administrative actions
Security-related events
Content access
Item modifications
Sharing activities
Workspace operations

Audit logs provide a historical record that organizations can use for monitoring and investigation purposes.

Why Audit Logging Is Important

Audit logging helps organizations:

Monitor user activity
Detect suspicious behavior
Support compliance requirements
Investigate security incidents
Verify governance policies
Track administrative changes
Understand platform usage

Without audit logs, organizations have limited visibility into how Fabric resources are being used.

Types of Activities Captured

Microsoft Fabric audit logs can capture many types of events.

Examples include:

Workspace Activities

Workspace creation
Workspace deletion
Workspace updates
Membership changes

Item Activities

Report creation
Report deletion
Dataset creation
Semantic model updates
Lakehouse modifications
Warehouse modifications

Sharing Activities

Sharing reports
Sharing datasets
Permission changes
External sharing actions

Security Activities

Role assignments
Permission updates
Access changes
Governance actions

Administrative Activities

Tenant setting modifications
Capacity changes
Configuration updates

Audit Log Architecture

A simplified workflow looks like this:

			
User Action
      ↓
Fabric Records Event
      ↓
Audit Log Entry Created
      ↓
Administrator Reviews Activity

		

Every significant operation can generate an audit event that becomes part of the organization’s audit trail.

Information Captured in Audit Logs

A typical audit log entry may contain:

Field	Description
Timestamp	When the action occurred
User	Who performed the action
Activity	What action occurred
Item Name	Object involved
Workspace	Location of activity
Operation Status	Success or failure
Additional Details	Context information

Example:

			
Timestamp: 2026-01-15 10:42 AM
User: jsmith@contoso.com
Activity: Deleted Report
Report: Executive Dashboard
Workspace: Finance
Status: Success

		

Microsoft Fabric and Microsoft 365 Audit Logs

Fabric auditing is integrated into the broader Microsoft ecosystem.

Audit events are available through Microsoft 365 audit capabilities, allowing organizations to centralize monitoring and investigation activities.

This integration provides:

Unified auditing
Centralized investigation
Compliance support
Enterprise-wide visibility

Common Audit Log Use Cases

Security Investigations

A sensitive report is accidentally deleted.

Administrators can review audit logs to determine:

Who deleted the report
When the deletion occurred
Which workspace was affected

Compliance Audits

Regulators request evidence of access controls.

Audit logs provide historical records of:

User access
Permission changes
Administrative actions

Governance Reviews

An organization wants to understand how frequently critical assets are used.

Audit logs can reveal:

Access patterns
Sharing activities
Usage trends

Operational Troubleshooting

A workspace suddenly becomes unavailable.

Audit logs may identify:

Recent configuration changes
Role assignments
Administrative actions

Audit Logs vs Monitoring Metrics

This distinction is commonly tested.

Audit Logs	Monitoring Metrics
Who performed an action	Resource performance
Historical activity records	Capacity utilization
Security and governance focus	Performance focus
User behavior tracking	System behavior tracking

Example:

Audit Log:

User deleted dataset

Monitoring Metric:

CPU utilization reached 85%

Audit Logs vs Activity Monitoring

Although related, they serve different purposes.

Audit Logs

Focus on:

Security
Governance
Compliance
User activity

Monitoring Tools

Focus on:

Performance
Capacity utilization
Query execution
System health

Audit Logs and Compliance

Audit logging plays an important role in regulatory frameworks such as:

GDPR
HIPAA
SOX
PCI DSS
Internal governance standards

Organizations often require audit trails to demonstrate:

Accountability
Access monitoring
Change tracking
Security oversight

Key Security Benefits

Audit logs help organizations:

Detect Unauthorized Activity

Example:

Multiple unexpected permission changes

Investigate Security Incidents

Example:

Who accessed sensitive data?

Support Forensics

Example:

Timeline of events before a breach

Improve Accountability

Every action is associated with a user identity.

Common Audit Events for DP-700

Candidates should recognize events such as:

Create Workspace
Delete Workspace
Update Workspace
Create Report
Delete Report
Modify Dataset
Share Content
Change Permissions
Update Tenant Settings
Assign Roles

Audit Log Retention

Organizations should understand that audit logs are retained according to Microsoft and organizational retention policies.

Longer retention periods support:

Compliance investigations
Historical analysis
Security reviews

Retention capabilities may vary depending on licensing and organizational configuration.

Best Practices

Enable Auditing

Ensure audit logging is enabled and properly configured.

Review Logs Regularly

Perform periodic reviews for:

Security incidents
Governance violations
Unusual activity

Protect Audit Data

Audit logs themselves may contain sensitive information and should be protected appropriately.

Integrate with Security Processes

Use audit data alongside:

Security monitoring
Governance reviews
Compliance audits

Establish Alerting Procedures

Monitor for:

Unexpected permission changes
Mass deletions
Excessive sharing
Administrative changes

Retain Logs Appropriately

Align retention periods with:

Regulatory requirements
Organizational policies
Security needs

Common DP-700 Exam Scenarios

Scenario 1

A report is unexpectedly deleted.

Question:

How do you determine who deleted it?

Solution:

Review Microsoft Fabric audit logs.

Scenario 2

Management requests evidence showing who modified workspace permissions.

Solution:

Use audit logs to review permission-change events.

Scenario 3

A compliance auditor requests historical access records.

Solution:

Provide relevant audit log entries.

Scenario 4

An administrator wants to determine which users shared a sensitive dashboard.

Solution:

Review sharing-related audit events.

DP-700 Exam Focus Areas

You should understand:

✓ Purpose of audit logging

✓ Types of activities captured

✓ Security investigation scenarios

✓ Compliance use cases

✓ Governance monitoring

✓ Audit log contents

✓ Audit logs versus monitoring metrics

✓ Audit logs versus performance monitoring

✓ User activity tracking

✓ Administrative activity tracking

✓ Best practices for auditing

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Fabric audit logs?

A. To track user and administrative activities

B. To improve query performance

C. To optimize storage usage

D. To automate data ingestion

Answer: A

Explanation

Audit logs provide a historical record of user and administrative actions for governance, compliance, and security purposes.

Question 2

Which activity would most likely appear in a Fabric audit log?

A. CPU utilization reaching 90%

B. Network latency measurements

C. A user deleting a report

D. Spark memory allocation

Answer: C

Explanation

Audit logs capture user actions such as creating, modifying, sharing, and deleting Fabric items.

Question 3

A compliance auditor asks for evidence showing who changed workspace permissions last month.

Which feature should be used?

A. Audit logs

B. Capacity Metrics App

C. Query Insights

D. Spark Monitoring

Answer: A

Explanation

Audit logs record permission changes and can be used to identify who performed administrative actions.

Question 4

Which information is commonly included in an audit log entry?

A. CPU utilization percentage

B. Cluster memory consumption

C. Spark executor count

D. Timestamp, user, and activity performed

Answer: D

Explanation

Audit logs typically record who performed an action, when it occurred, and what operation was performed.

Question 5

A report was accidentally deleted. What is the best way to determine who deleted it?

A. Review workspace endorsements

B. Review sensitivity labels

C. Review audit logs

D. Review data lineage

Answer: C

Explanation

Audit logs provide detailed records of item deletion events and the users responsible for them.

Question 6

How do audit logs differ from monitoring metrics?

A. Audit logs track activities, while monitoring metrics track performance and resource usage.

B. Audit logs improve query performance.

C. Monitoring metrics identify user actions.

D. Monitoring metrics replace audit logs.

Answer: A

Explanation

Audit logs focus on user and administrative actions, whereas monitoring metrics focus on system and workload performance.

Question 7

Which scenario represents a common use of audit logs?

A. Scaling Spark clusters

B. Monitoring storage capacity growth

C. Determining who shared a sensitive report

D. Configuring deployment pipelines

Answer: C

Explanation

Audit logs capture sharing events and can be used to investigate who shared content.

Question 8

Which governance objective is best supported by audit logs?

A. Data compression

B. Accountability and traceability

C. Capacity scaling

D. Schema optimization

Answer: B

Explanation

Audit logs establish accountability by recording user actions and maintaining an activity history.

Question 9

Why are audit logs important during a security investigation?

A. They automatically restore deleted content.

B. They optimize warehouse performance.

C. They classify data sensitivity.

D. They provide a timeline of user and administrative activities.

Answer: D

Explanation

Audit logs help investigators reconstruct events and determine what actions occurred during a security incident.

Question 10

An organization wants to review all permission changes made during the last quarter.

Which Microsoft Fabric capability should be used?

A. Capacity Metrics

B. Query Monitoring

C. Audit Logs

D. Dataflows Gen2

Answer: C

Explanation

Audit logs record permission modifications and provide historical visibility into administrative actions.

Exam Tip

A frequent DP-700 exam challenge is distinguishing between audit logs, monitoring tools, and governance features.

Remember:

Requirement	Solution
Determine who performed an action	Audit Logs
Monitor system performance	Monitoring Metrics
Track capacity utilization	Capacity Monitoring
Classify sensitive content	Sensitivity Labels
Identify trusted content	Endorsements

If a question asks who did something, when it happened, or what changes were made, the correct answer is usually Audit Logs. If the question focuses on CPU, memory, performance, or utilization, the answer is likely a monitoring tool rather than auditing.

Go to the DP-700 Exam Prep Hub main page.

DP-700, Microsoft Certification June 3, 2026

DP-700 Practice Exam #4 (30 questions with answers)

Question 1

You need to grant a group of analysts read-only access to all Fabric items within a workspace.

Which workspace role should you assign?

A. Admin

B. Member

C. Contributor

D. Viewer

Answer: D

Explanation

The Viewer role provides read-only access to workspace content.

Admin allows full management.
Member allows content creation and modification.
Contributor allows editing.
Viewer is the least privileged role that satisfies the requirement.

Question 2

A company stores raw CSV files in a Bronze layer and cleansed Delta tables in a Silver layer.

What is the primary purpose of the Silver layer?

A. Long-term archival

B. Cleansed and validated data

C. Business reporting

D. Security auditing

Answer: B

Explanation

The Silver layer contains validated, transformed, and standardized data prepared for downstream analytics.

Question 3

Select TWO answers.

Which Fabric items can directly consume data from OneLake shortcuts?

A. Lakehouse

B. Warehouse

C. Eventstream

D. Dataflow Gen2

E. Activator

Answer: A, B

Explanation

OneLake shortcuts are commonly used by Lakehouses and Warehouses to access external data without duplication.

Question 4

Match each technology to its primary use case.

Technology	Use Case
1. Dataflow Gen2	A. Streaming event processing
2. Eventstream	B. Low-code data transformation
3. Notebook	C. Advanced Spark development

Answer

1 → B
2 → A
3 → C

Explanation

Each Fabric component addresses a specific processing requirement.

Question 5

Fill in the blank.

Delta tables use the __________ transaction log to provide ACID compliance.

Answer

Delta Log

Explanation

The Delta Log records transactional metadata and enables reliable operations.

Question 6

A Fabric pipeline must execute three data loads in a specific order because each load depends on the previous one.

What should you configure?

A. Sequential dependencies

B. Parallel execution

C. Eventhouse ingestion

D. Activator triggers

Answer: A

Explanation

Dependent tasks should execute sequentially using activity dependencies.

Question 7

A real-time analytics solution requires querying billions of telemetry events with low latency.

Which Fabric component is best suited for this workload?

A. Semantic Model

B. Warehouse

C. Eventhouse

D. Dataflow Gen2

Answer: C

Explanation

Eventhouse is optimized for high-volume, low-latency analytical workloads.

Question 8

Which KQL operator is primarily used to filter rows?

A. summarize

B. project

C. extend

D. where

Answer: D

Explanation

The where operator filters data based on specified conditions.

Question 9

A notebook execution fails due to an OutOfMemory error.

What should you investigate first?

A. Spark pool sizing

B. Workspace permissions

C. Semantic model refresh schedule

D. Pipeline trigger settings

Answer: A

Explanation

Memory-related failures typically indicate insufficient Spark resources.

Question 10

Select THREE answers.

Which factors commonly improve Lakehouse query performance?

A. V-Order optimization

B. Partition pruning

C. Delta optimization

D. Increasing file fragmentation

E. Removing statistics

Answer: A, B, C

Explanation

These optimizations reduce scanning and improve storage efficiency.

Question 11

You need to monitor Fabric capacity consumption over time.

Which tool should you use?

A. Eventstream diagnostics

B. Capacity Metrics App

C. Warehouse explorer

D. Semantic model lineage view

Answer: B

Explanation

The Capacity Metrics App provides detailed capacity usage and performance insights.

Question 12

A data engineering team wants to ingest data from Azure Event Hubs into Fabric in real time.

Which Fabric component should be configured first?

A. Warehouse

B. Notebook

C. Eventstream

D. Semantic Model

Answer: C

Explanation

Eventstreams are designed for real-time event ingestion.

Question 13

Match the optimization technique to the benefit.

Technique	Benefit
1. Broadcast Join	A. Reduce network shuffle
2. Caching	B. Speed repeated access
3. Partition Pruning	C. Reduce scanned data

Answer

1 → A
2 → B
3 → C

Question 14

A Dataflow Gen2 refresh succeeds but loads fewer rows than expected.

What should you investigate first?

A. Applied transformation steps

B. Workspace branding

C. Capacity SKU name

D. Semantic model permissions

Answer: A

Explanation

Filtering or transformation logic may be unintentionally excluding records.

Question 15

Which Spark Structured Streaming feature helps handle late-arriving data?

A. Repartitioning

B. Watermarking

C. Broadcast joins

D. Delta optimization

Answer: B

Explanation

Watermarks define how long late events can be accepted.

Question 16

Select TWO answers.

Which destinations are commonly used with Eventstreams?

A. Eventhouse

B. Lakehouse

C. Semantic Model

D. Power BI Dashboard

Answer: A, B

Explanation

Eventstreams commonly route data into Eventhouse and Lakehouse destinations.

Question 17

Fill in the blank.

The KQL __________ operator is frequently used to aggregate data into groups.

Answer

summarize

Explanation

summarize performs aggregations such as count(), avg(), and max().

Question 18

A Fabric warehouse query experiences poor performance due to scanning an entire fact table.

Which optimization should be considered first?

A. More dashboards

B. Query filtering

C. Additional workspaces

D. Manual report refreshes

Answer: B

Explanation

Proper filtering significantly reduces data scanned.

Question 19

A team needs to access external Amazon S3 data without copying it into Fabric.

Which feature should they use?

A. Data Activator

B. Deployment Pipeline

C. OneLake Shortcut

D. Semantic Link

Answer: C

Explanation

OneLake shortcuts provide logical access to external storage.

Question 20

A streaming solution requires event aggregation every five minutes.

Which concept should be implemented?

A. Delta optimization

B. Windowing

C. Caching

D. Workspace roles

Answer: B

Explanation

Windowing groups events into time-based intervals.

Question 21

A notebook suddenly fails after a package upgrade.

What is the most likely cause?

A. Dependency incompatibility

B. Lakehouse corruption

C. Eventstream throttling

D. Capacity scaling

Answer: A

Explanation

Package upgrades frequently introduce compatibility issues.

Question 22

Select THREE answers.

Which metrics are useful when monitoring Eventhouse ingestion?

A. Ingestion latency

B. Throughput

C. Failed ingestions

D. Workspace color settings

E. Queue backlog

Answer: A, B, C

Explanation

These metrics directly measure ingestion health and performance.

Question 23

A Fabric administrator wants to identify which workloads consume the most capacity units.

Which tool should be used?

A. Dataflow Gen2

B. Activator

C. Capacity Metrics App

D. Eventstream canvas

Answer: C

Explanation

The Capacity Metrics App breaks down workload consumption.

Question 24

A pipeline includes several independent copy activities.

What is the best way to improve overall execution speed?

A. Disable monitoring

B. Execute sequentially

C. Reduce logging

D. Execute in parallel

Answer: D

Explanation

Parallel execution reduces total pipeline duration.

Question 25

Match each item to the most likely troubleshooting location.

Issue	Tool
1. Notebook error	A. Spark execution logs
2. Pipeline failure	B. Pipeline run history
3. Eventhouse ingestion issue	C. Ingestion diagnostics

Answer

1 → A
2 → B
3 → C

Question 26

You need to improve performance of repeated Spark computations.

Which technique should you use?

A. Increase shuffle operations

B. Remove partitions

C. Cache intermediate DataFrames

D. Disable parallelism

Answer: C

Explanation

Caching avoids recomputation of frequently accessed datasets.

Question 27

A company wants automatic notifications when a streaming metric exceeds a threshold.

Which Fabric feature should be implemented?

A. Warehouse

B. Data Activator

C. Notebook

D. Shortcut

Answer: B

Explanation

Data Activator enables event-driven notifications and actions.

Question 28

Select TWO answers.

Which actions help optimize Eventhouse query performance?

A. Use filtering predicates

B. Reduce scanned data

C. Increase file fragmentation

D. Remove aggregation logic

Answer: A, B

Explanation

Filtering and reducing scanned data improve query efficiency.

Question 29

Fill in the blank.

A Fabric deployment pipeline is primarily used to promote content between development, test, and __________ environments.

Answer

production

Explanation

Deployment pipelines support lifecycle management across environments.

Question 30

A Fabric solution experiences intermittent performance degradation during peak business hours.

Which action should be performed first?

A. Delete semantic models

B. Disable monitoring

C. Review workload utilization and capacity metrics

D. Rebuild all Lakehouses

Answer: C

Explanation

Capacity metrics help identify bottlenecks, workload spikes, throttling, and resource contention before major architectural changes are made.

Go to the DP-700 Exam Prep Hub main page.

DP-700, Microsoft Certification June 3, 2026June 3, 2026

DP-700 Practice Exam #3 (30 questions with answers)

Question 1

You need to provide data engineers access to create Lakehouses and Data Warehouses within a Fabric workspace. However, they should not be able to manage workspace permissions.

Which workspace role should you assign?

A. Viewer

B. Contributor

C. Member

D. Admin

Answer: C

Explanation

Members can create and manage content within a workspace but cannot perform all administrative functions available to Admins.

A is incorrect because Viewers have read-only access.
B is incorrect because Contributors cannot manage all workspace content ownership scenarios.
C is correct.
D is incorrect because Admin grants excessive permissions.

Question 2

You are implementing a Medallion architecture.

Match each layer to its primary purpose.

Layer	Purpose
1. Bronze	A. Business-ready curated data
2. Silver	B. Raw ingested data
3. Gold	C. Cleansed and validated data

Answer

1 → B
2 → C
3 → A

Explanation

Bronze stores raw data, Silver contains cleansed and transformed data, and Gold provides analytics-ready datasets.

Question 3

A Fabric Eventstream receives telemetry from 50,000 IoT devices.

You need to route the incoming events to multiple destinations simultaneously.

Which feature should you use?

A. Dataflow Gen2

B. Eventstream routing

C. Notebook scheduling

D. Warehouse shortcuts

Answer: B

Explanation

Eventstreams can route a single event stream to multiple destinations.

Question 4

Select TWO answers.

Which destinations can Eventstreams write to directly?

A. Eventhouse

B. Lakehouse

C. SQL Database

D. Notebook

E. Activator

Answer: A, E

Explanation

Common Eventstream destinations include:

Eventhouse
Activator
Lakehouse
KQL Database

Notebook is not a direct destination.

Question 5

Fill in the blank.

A OneLake shortcut allows users to access data without creating a physical __________ of the data.

Answer

Copy

Explanation

Shortcuts create logical references to data rather than duplicating storage.

Question 6

A Fabric notebook processing job frequently fails due to insufficient executor resources.

What should you do first?

A. Increase notebook timeout

B. Rebuild the Lakehouse

C. Scale Spark resources

D. Delete checkpoints

Answer: C

Explanation

Resource shortages are typically addressed by increasing Spark capacity or executor allocation.

Question 7

You are designing a real-time analytics solution.

Requirements:

Ingest millions of events per minute
Sub-second querying
Time-series analysis

Which technology is most appropriate?

A. Dataflow Gen2

B. Eventhouse

C. Warehouse

D. Semantic Model

Answer: B

Explanation

Eventhouse is optimized for high-volume streaming analytics and KQL workloads.

Question 8

Which KQL operator is used to aggregate records?

A. project

B. where

C. extend

D. summarize

Answer: D

Explanation

The summarize operator performs aggregations such as count(), avg(), and sum().

Question 9

A Dataflow Gen2 refresh suddenly begins failing after a source schema change.

What is the most likely cause?

A. Workspace permissions

B. Network latency

C. Column mismatch

D. Spark pool scaling

Answer: C

Explanation

Schema changes commonly cause transformation failures when expected columns are missing or renamed.

Question 10

Select THREE answers.

Which actions help improve Delta table performance?

A. OPTIMIZE

B. V-Order

C. Small file generation

D. Compaction

E. Disabling partitioning

Answer: A, B, D

Explanation

OPTIMIZE, V-Order, and compaction improve query efficiency and storage organization.

Question 11

You need to monitor Fabric pipeline execution history.

Where should you start?

A. Capacity Metrics App

B. Pipeline monitoring pane

C. Purview Hub

D. Semantic model settings

Answer: B

Explanation

Pipeline monitoring provides execution status, duration, and error details.

Question 12

A streaming solution requires SQL-like processing over continuously arriving data.

Which option should you choose?

A. Data Factory

B. Eventstream

C. Warehouse stored procedures

D. Power BI Report

Answer: B

Explanation

Eventstreams support real-time stream processing and routing.

Question 13

Match the technology to its primary purpose.

Technology	Purpose
1. Eventhouse	A. Batch orchestration
2. Pipeline	B. Real-time analytics
3. Notebook	C. Spark processing

Answer

1 → B
2 → A
3 → C

Question 14

You need to reduce query latency against large Delta tables.

Which strategy is most effective?

A. Increase report refresh frequency

B. Create more workspaces

C. Enable V-Order optimization

D. Disable partitioning

Answer: C

Explanation

V-Order reorganizes storage to improve analytical query performance.

Question 15

A warehouse query scans billions of rows unnecessarily.

What should you investigate first?

A. Query filters

B. Workspace permissions

C. Capacity region

D. Semantic model ownership

Answer: A

Explanation

Missing predicates often cause excessive data scans.

Question 16

Select TWO answers.

Which items can be sources for OneLake shortcuts?

A. ADLS Gen2

B. Amazon S3

C. Power BI Report

D. Notebook

Answer: A, B

Explanation

Shortcuts commonly connect to ADLS Gen2 and Amazon S3 data.

Question 17

Fill in the blank.

Spark Structured Streaming processes data using incremental __________.

Answer

Micro-batches

Explanation

Structured Streaming generally operates through continuous micro-batch execution.

Question 18

A Fabric capacity consistently shows high CU utilization.

What should you do?

A. Delete semantic models

B. Reduce storage

C. Review workload consumption patterns

D. Disable monitoring

Answer: C

Explanation

Investigating workload usage is the first step before scaling or optimization.

Question 19

Which KQL function is commonly used to create time windows?

A. datetime_diff()

B. bin()

C. tostring()

D. strcat()

Answer: B

Explanation

bin() groups timestamps into fixed intervals for windowed analysis.

Question 20

You need to process late-arriving streaming events.

Which concept should be configured?

A. Watermarking

B. Capacity scaling

C. Workspace role assignment

D. Notebook scheduling

Answer: A

Explanation

Watermarks help define how late data should be handled.

Question 21

A notebook execution fails with a Python module import error.

What is the most likely cause?

A. Missing package dependency

B. Lakehouse corruption

C. Capacity throttling

D. Semantic model refresh issue

Answer: A

Explanation

Import failures typically indicate missing libraries.

Question 22

Select THREE answers.

Which metrics are useful when monitoring data ingestion?

A. Throughput

B. Latency

C. Failure rate

D. Workspace color theme

E. Event volume

Answer: A, B, C

Explanation

Throughput, latency, and failures are key ingestion health indicators.

Question 23

You want to accelerate analytical queries against external data accessed through shortcuts.

Which feature should you consider?

A. Semantic Links

B. Query Acceleration

C. Spark Monitoring

D. Activator

Answer: B

Explanation

Query Acceleration improves performance when querying external shortcut data.

Question 24

A pipeline contains five independent activities.

How can you reduce overall execution time?

A. Execute activities sequentially

B. Disable retries

C. Run activities in parallel

D. Convert activities to reports

Answer: C

Explanation

Independent tasks should execute concurrently whenever possible.

Question 25

Match the optimization technique to its purpose.

Technique	Purpose
1. Partitioning	A. Reduce file count
2. Compaction	B. Improve data pruning
3. Caching	C. Reduce repeated reads

Answer

1 → B
2 → A
3 → C

Question 26

Which Fabric component is best suited for orchestration of complex ETL workflows?

A. Eventhouse

B. Data Pipeline

C. Semantic Model

D. Activator

Answer: B

Explanation

Pipelines coordinate and orchestrate end-to-end workflows.

Question 27

A real-time dashboard requires alerts when sensor temperature exceeds a threshold.

Which Fabric capability is most appropriate?

A. Activator

B. Warehouse

C. Notebook

D. V-Order

Answer: A

Explanation

Activator enables event-driven actions and alerts.

Question 28

Select TWO answers.

Which actions commonly improve Spark job performance?

A. Reduce shuffle operations

B. Use broadcast joins when appropriate

C. Increase small file generation

D. Disable partition pruning

Answer: A, B

Explanation

Reducing shuffles and using broadcast joins can significantly improve Spark efficiency.

Question 29

A warehouse workload contains many repeated analytical queries.

Which optimization is most likely to help?

A. Remove statistics

B. Increase file fragmentation

C. Use result caching

D. Disable parallelism

Answer: C

Explanation

Result caching can dramatically improve repeated query performance.

Question 30

A data engineering team must investigate intermittent Eventstream ingestion failures.

What should be reviewed first?

A. Report visualizations

B. Eventstream monitoring and diagnostics

C. Semantic model relationships

D. Workspace themes

Answer: B

Explanation

Eventstream diagnostics provide details about ingestion health, routing issues, throughput bottlenecks, and destination errors, making them the best starting point for troubleshooting.

Go to the DP-700 Exam Prep Hub main page.