Workspace and Item Access Controls: 10 practice questions

Question 1 of 10

Which access mechanism applies to every item in a Fabric workspace?

1. AA workspace role
2. BA lakehouse Read permission
3. CAn item permission
4. DA SQL endpoint data permission

Question 2 of 10

What can a user with the Viewer workspace role do by default?

1. AShare listed workspace content with underlying OneLake data access
2. BView listed workspace content without underlying OneLake data access
3. CCreate new workspace content with underlying SQL data access
4. DModify listed workspace content without underlying SQL data access

Question 3 of 10

What does the Read permission granted when sharing a lakehouse provide?

1. AAccess to all data through the SQL endpoint
2. BAccess to item metadata and associated reports
3. CAccess to all data through Apache Spark
4. DAccess to create items across the workspace

Question 4 of 10

Which workspace role can create and modify all content without adding sharing or permission-management capabilities?

1. AMember
2. BViewer workspace role
3. CAdmin
4. DContributor

Question 5 of 10

Where do you assign a user to a workspace role?

1. ABuild reports on the default model
2. BRead all SQL endpoint data for one item
3. CManage access in the workspace
4. DManage permissions on one item

Question 6 of 10

Which additional lakehouse permission enables T-SQL reads from its SQL analytics endpoint?

1. ARead all SQL endpoint data
2. BRead item metadata and reports
3. CBuild reports on the default semantic model
4. DRead all Apache Spark and subscribe to events

Question 7 of 10

A lakehouse has a separate Power BI semantic model built on it. A colleague must create new reports from that model without joining the workspace. What do you grant?

1. ARead all Apache Spark and subscribe to events
2. BBuild permission on that semantic model
3. CManage access for the entire workspace
4. DRead all data from the SQL endpoint

Question 8 of 10

An analyst needs to see one lakehouse's metadata and associated reports, but must not query its underlying data or access other workspace items. What should you grant?

1. AAssign Contributor without additional item permissions
2. BShare the lakehouse with Apache Spark access
3. CAssign Viewer and grant SQL endpoint access
4. DShare the lakehouse with Read permission

Question 9 of 10

A security group already holds the Viewer role on a workspace. One person in that group must also run T-SQL queries against a single lakehouse there, and nothing may change for the rest of the group. What do you configure?

1. AMove the whole security group to the Contributor workspace role
2. BShare the lakehouse with them and add SQL endpoint access
3. CAdd the person to the workspace with the Member role
4. DGrant the person Build reports on the default semantic model

Question 10 of 10

A contractor needs T-SQL read access to all tables in one lakehouse's SQL analytics endpoint but should receive neither Spark access nor workspace-wide membership. Which configuration matches the requirement?

1. AAssign the contractor the Viewer workspace role
2. BShare the lakehouse with Read all SQL endpoint data
3. CShare the lakehouse with basic Read permission alone
4. DShare the lakehouse with Apache Spark and event access