DP-600 - Maintain a Data Analytics Solution - Section 1.2

Implement row-level, column-level, object-level, and file-level access control across lakehouses, warehouses, and semantic models.

Distinguish row-level security, column-level security, and object-level security and understand where each is enforced across lakehouses, warehouses, and semantic models. Apply OneLake file-level access and dynamic RLS to control data visibility based on user identity.

row-level securitycolumn-level securityobject-level securityOneLake file-level accessdynamic RLS

Practice question for this objective

Free sampleMaintain a Data Analytics Solutionhard

A dynamic row-level security role on a "semantic model" maps each user to their permitted regions through a bridge table that holds one row per user and region. The model owner wants to confirm that a specific manager sees only their two regions before publishing the change to consumers. What is the appropriate way to validate the role's effect?

  • APublish the model to production first, then ask the manager to open a report and confirm that only their two regions appear in the visuals.
  • BRemove the dynamic filter temporarily and count the distinct regions returned, assuming the role works if the unfiltered total exceeds two for the manager.
  • CGrant the manager Admin on the workspace so they can inspect the role definition and self-verify that the mapping bridge lists exactly two regions.
  • DUse the View As capability to impersonate the manager's role and account, then check that queries against the model return only their two permitted regions. Correct
Validate dynamic row-level security with View As to impersonate a role and user before publishing, confirming filters resolve correctly. The View As function evaluates the model as a chosen role and impersonated user, so the dynamic USERPRINCIPALNAME mapping resolves to that manager's regions, letting the owner verify the filter offline before exposing it to consumers.

Why A is wrong: Validating in production exposes consumers to an unverified policy, and relying on a user's confirmation is slower and riskier than testing the role before publishing.

Why B is wrong: Counting regions with the filter removed tests nothing about the role, since disabling the predicate cannot demonstrate that it would scope the manager to two regions.

Why C is wrong: Granting Admin over-privileges the manager and inspecting the mapping does not prove the runtime filter behaviour, so it neither validates safely nor tests the effect.

Why D is correct: View As lets the owner impersonate a role and a specific user so the dynamic filter resolves as it would for that manager, confirming the two regions before any publish.

See more DP-600 practice questions, answers explained.

More in this domain

Back to all Maintain a Data Analytics Solution objectives, or the DP-600 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.