nerdexam
Microsoft

DP-700 · Question #24

QUESTION 26 You have a Fabric capacity that contains a workspace named Workspace1. Workspace1 contains a lakehouse named Lakehouse1, a data pipeline, a notebook, and several Microsoft Power BI…

The correct answer is B. Assign User1 the Viewer role for Workspace1. Share Lakehouse1 with User1 and select Read all SQL endpoint data. To grant a user read-only SQL access to Lakehouse1 tables, prevent Spark access, and restrict access to other workspace items, assign the Viewer role to the workspace and then explicitly share the Lakehouse with 'Read all SQL endpoint data' permissions.

Manage data governance and security

Question

QUESTION 26 You have a Fabric capacity that contains a workspace named Workspace1. Workspace1 contains a lakehouse named Lakehouse1, a data pipeline, a notebook, and several Microsoft Power BI reports. A user named User1 wants to use SQL to analyze the data in Lakehouse1. You need to configure access for User1. The solution must meet the following requirements:
  • Provide User1 with read access to the table data in Lakehouse1.
  • Prevent User1 from using Apache Spark to query the underlying files in Lakehouse1.
  • Prevent User1 from accessing other items in Workspace1.
What should you do?

Options

  • AShare Lakehouse1 with User1 directly and select Read all SQL endpoint data.
  • BAssign User1 the Viewer role for Workspace1. Share Lakehouse1 with User1 and select Read all SQL endpoint data.
  • CShare Lakehouse1 with User1 directly and select Build reports on the default semantic model.
  • DAssign User1 the Member role for Workspace1. Share Lakehouse1 with User1 and select Read all SQL endpoint data.

How the community answered

(27 responses)
  • A
    4% (1)
  • B
    78% (21)
  • C
    15% (4)
  • D
    4% (1)

Why each option

To grant a user read-only SQL access to Lakehouse1 tables, prevent Spark access, and restrict access to other workspace items, assign the Viewer role to the workspace and then explicitly share the Lakehouse with 'Read all SQL endpoint data' permissions.

AShare Lakehouse1 with User1 directly and select Read all SQL endpoint data.

Sharing Lakehouse1 directly might not fully restrict access to other items if default permissions are too broad, and it doesn't robustly prevent Spark access as effectively as a Viewer role for the entire workspace.

BAssign User1 the Viewer role for Workspace1. Share Lakehouse1 with User1 and select Read all SQL endpoint data.Correct

Assigning the Viewer role to the workspace allows User1 to see items without modification rights, effectively preventing Spark access and limiting interaction with other items. Sharing Lakehouse1 with 'Read all SQL endpoint data' then explicitly grants SQL read access to its tables, meeting all requirements with least privilege.

CShare Lakehouse1 with User1 directly and select Build reports on the default semantic model.

'Build reports on the default semantic model' grants access to the semantic model for reporting, but not direct read access to the underlying Lakehouse tables via SQL, which is explicitly requested.

DAssign User1 the Member role for Workspace1. Share Lakehouse1 with User1 and select Read all SQL endpoint data.

Assigning the Member role to the workspace grants too much privilege, including the ability to create, edit, and delete content, violating the 'least privilege' principle and potentially allowing Spark access or access to other items beyond viewing.

Concept tested: Fabric workspace roles, Lakehouse sharing, and access control

Source: https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces#permissions

Topics

#Fabric Security#Lakehouse Permissions#Workspace Roles#SQL Endpoint Access

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DP-700 Practice