DP-700 · Practice set 14 of 17
Workspace Roles: 10 practice questions
10 free DP-700 practice questions on Workspace Roles, with an explanation for every answer. Untimed. The full mock exam and the timed version are in the app.
-
Question 1 of 10
A new data engineer must create Fabric items in one workspace and read all the data of its lakehouse. The engineer must not share items or manage permissions. Which role fits?
- AAdmin in that workspace
- BMember in that workspace
- CViewer in that workspace
- DContributor in that workspace
Show the answer
Read the roles as a ladder: Viewer views, Contributor also creates and modifies, Member also shares, Admin also manages permissions. Pick the lowest step that covers the need. Creating items starts at Contributor, and sharing starts one step higher.
Next → 1 / 10 -
Question 2 of 10
A regional lead must modify and share every item in the workspace of one region. The lead must not reach the workspaces of other regions, and must not be able to delete the workspace or remove its users. Which assignment fits?
- AMember in the regional workspace
- BAdmin in the regional workspace
- CContributor in the regional workspace
- DContributor in every regional workspace
Show the answer
Two things decide this: the step on the ladder and the boundary. Sharing starts at Member, and only an Admin can delete the workspace or remove people, so Member is the step. A workspace role stops at its own workspace, so one assignment in one region keeps the other regions closed.
Next → 2 / 10 -
Question 3 of 10
A user has only the Viewer role in a workspace that contains a lakehouse. Which action works by default?
- ALoad the tables with Spark in a notebook
- BBrowse the table data in Lakehouse explorer
- CQuery the tables with T-SQL
- DRead the table files through OneLake APIs
Show the answer
A lakehouse has two ways of reading. T-SQL through the SQL analytics endpoint uses ReadData, which all four roles have. Spark, OneLake APIs, and Lakehouse explorer use ReadAll, which starts at Contributor. So a Viewer has the SQL way only.
Next → 3 / 10 -
Question 4 of 10
A service principal has the Viewer role in a workspace. A tool uses it to call the Job Scheduler API. What can the tool do?
- ANothing, because service principals cannot hold roles
- BMonitor run status and view output, but not start runs
- CStart runs, because API calls ignore workspace roles
- DStart and cancel runs, but not view the execution output
Show the answer
A service principal gets the same permissions as a user with the same role, also through the APIs. So ask what a Viewer can do: watch, not act. Monitoring status and viewing output are open to all roles. Starting or cancelling a run needs Contributor or higher.
Next → 4 / 10 -
Question 5 of 10
Lee is in a security group that has the Viewer role in a workspace. Lee is also in a Microsoft 365 group that has the Contributor role in the same workspace. What can Lee do there?
- AView content only, until an Admin picks one role
- BNothing, because two roles on one user conflict
- CView content only, because the lower role wins
- DView and modify content, as a Contributor
Show the answer
When a person is in several groups with different roles, the person gets the highest level of permission. Compare the roles and take the higher one. Here Contributor is above Viewer, so Lee can view and modify content.
Next → 5 / 10 -
Keep the ones you got wrong
In the app, every question you miss comes back exactly when you’re about to forget it.
Opens in your browser. Nothing to install.
Start studyingOn your phone, with the same account
-
Question 6 of 10
Which operation can only a workspace Admin perform?
- AAdd a new user with the Contributor role
- BCancel the execution of a running pipeline
- CModify a warehouse item
- DCreate a workspace identity
Show the answer
Keep the short Admin-only list in mind: update and delete the workspace, add or remove people including other admins, create a workspace identity, and connect the workspace to a Git repository. Everything else in the options starts at a lower role.
Next → 6 / 10 -
Question 7 of 10
A Member tries to change a colleague from Viewer to Contributor in the workspace and cannot do it. What must happen before the colleague can get the new role?
- AThe colleague must first leave every security group
- BA Contributor must first approve the new role assignment
- CAn Admin must first remove the colleague from the workspace
- DThe Member must first get the Reshare permission on all items
Show the answer
A Member can add users with lower permissions, but cannot change the role of a user who is already in the workspace and cannot remove users. So the change takes two steps: an Admin removes the user, and then the user is added again with the new role.
Next → 7 / 10 -
Question 8 of 10
A compliance officer must configure and query the audit logs of a warehouse. A support engineer must query `sys.dm_exec_requests` on it and must not add users to the workspace. Which roles give each person the least privilege that works?
- AAdmin for the officer, Viewer for the engineer
- BMember for the officer, Contributor for the engineer
- CAdmin for the officer, Contributor for the engineer
- DAdmin for the officer, Member for the engineer
Show the answer
Match each task to its warehouse permission. Audit logs need Audit, which only Admin has. Dynamic management views need Monitor, which Admin, Member, and Contributor have. Both come from the workspace role by default, and neither can be granted on its own. Contributor is the lowest role with Monitor.
Next → 8 / 10 -
Question 9 of 10
Omar is in the group Ext-Analysts, which has the Viewer role in a workspace, and in the group Data-Eng, which has the Contributor role. Omar must keep viewing content but must stop modifying it. The other members of Data-Eng must keep their rights. Which change works?
- ARemove Omar from the Ext-Analysts group
- BRemove Omar from the Data-Eng group
- CChange the role of Data-Eng to Viewer
- DAdd Omar to a new group that has Viewer
Show the answer
A person in several groups gets the highest role. To lower the access of one person, take away the higher assignment for that person only. Without Data-Eng, Omar keeps Viewer through Ext-Analysts, and the rest of Data-Eng is not touched.
Next → 9 / 10 -
Question 10 of 10
What can a workspace Member do that a Contributor cannot?
- AAdd users with lower permissions
- BExecute and cancel pipelines
- CConnect the workspace to a Git repository
- DRemove other users from the workspace
Show the answer
Member is one step above Contributor. The step adds two things: adding members or others with lower permissions, and allowing others to reshare items. The operations that only an Admin can do stay out of reach for both roles.
Next → 10 / 10 -
You’ve finished this set
That’s 10 questions on Workspace Roles. In the app the ones you miss come back exactly when you’re about to forget them.
Back to the course Next lesson: Item Permissions and SharingOpens in your browser. Nothing to install.
Start studyingOn your phone, with the same account
The whole course, on your computer and your phone
Lessons you can read, audio you can listen to on the way to work, and practice that remembers what you got wrong.
Opens in your browser. Nothing to install.
Start studyingOn your phone, with the same account
“This app is the ‘One Lake’ for preparing the certification exams. Really worth it.”