Microsoft DP-600: Maintain a data analytics solution Practice Questions

The three correct steps work together: (1) Publishing the semantic model to a dedicated shared workspace and certifying it makes it discoverable and clearly marked as the authoritative source, steering report authors toward it. (2) Granting only the 'Build' permission on the semantic model (without Contributor/higher workspace access) allows report authors to create new reports on top of the model via a live connection but prevents them from editing or overwriting the model itself—enforcing the 'cannot modify the data model' requirement. (3) Using 'Connect to a dataset' (Live Connection) in Power BI Desktop creates a thin report file connected to the shared semantic model; report authors cannot alter the model's tables, measures, or relationships in this mode. Granting 'Write' permission would allow report authors to push changes to the semantic model via XMLA tools, violating the no-modification requirement. Placing everything in one workspace and assigning the Contributor role would allow report authors to edit and overwrite the semantic model. Configuring a deployment pipeline rule for non-CoE deployments is a useful governance control but does not by itself prevent report authors from modifying the model in the Development workspace.

A .pbit file is a Power BI template that stores the data model schema, relationships, measures, and report layout, but explicitly excludes all cached data. When a recipient opens it, they are prompted to supply parameter values or credentials and then load fresh data — ideal for distributing reusable report templates. A .pbix file always includes cached data (unless manually cleared, which is error-prone and not a supported 'template' mechanism). A .pbip folder is a developer-focused source-control format, not a template distribution format. A .pbids file only stores connection metadata (server, database, connection mode) and does not include a data model or report layout.

OneLake data access roles (available in Microsoft Fabric) allow administrators to define fine-grained, role-based access control at the folder level within a lakehouse — including within the Files section. This enables different security groups to access only their permitted folders without requiring separate workspaces or lakehouses. Separating users into different workspaces per group is operationally complex and does not leverage Fabric's built-in folder-level security capabilities. Sensitivity labels in Fabric provide classification and protection metadata but do not enforce folder-level access control within a lakehouse. Creating separate lakehouses per group and using shortcuts adds architectural complexity and is not the native Fabric approach for file-level security; OneLake data access roles are the correct solution.

Build permission is the specific permission required on a shared semantic model to allow a user to create new reports, export underlying data, and use the model in other tools like Analyze in Excel. Read permission alone only allows the user to view reports that already consume the model — it does not allow creating new content against it. Write permission is not a standard semantic model permission level in Fabric — it applies to item editing in workspaces. Reshare permission allows a user to share the model with others but does not itself grant the ability to build new reports against it.

Sensitivity label inheritance in Microsoft Fabric (and Power BI) automatically propagates a label from a data source — such as a semantic model — to downstream items like reports and dashboards that consume it, ensuring consistent classification without manual intervention. A mandatory label policy requires users to choose a label when publishing or saving an item but does not automatically copy the label from a connected upstream item. DLP policies in Purview can detect sensitive content and trigger alerts or restrictions, but they do not directly propagate labels from one Fabric item to another. Endorsement (Promoted or Certified) is a governance mechanism for indicating trustworthiness and has no relationship to sensitivity label propagation.