Layering row, column, object, and file-level security rules
Microsoft Fabric provides multiple layers of granular access control across its analytics items, allowing administrators to restrict data visibility by row, column, table/object, or folder/file path depending on the underlying item type (Warehouse, Lakehouse, Power BI semantic model, or OneLake). Each control type uses a different implementation mechanism: T-SQL security policies, OneLake data access roles, or Power BI RLS/OLS, so engineers must choose the right tool for the item and storage layer involved.
Must-know
- Row-Level Security (RLS) in Fabric Warehouses and SQL analytics endpoints is implemented using CREATE SECURITY POLICY with inline table-valued functions (Predicate-based, like SQL Server RLS), filtering rows returned to specific users or roles.
- Column-Level Security (CLS) in Warehouses/SQL endpoints is implemented via GRANT/DENY SELECT on specific columns or by using views that expose only permitted columns to certain roles.
- Object-Level Security (OLS) restricts access to entire tables, views, or stored procedures using standard SQL GRANT/DENY/REVOKE permissions, and it takes precedence over RLS/CLS since users need object access before row/column filters apply.
- OneLake data access roles (a Fabric Lakehouse feature) allow folder- and file-level access control by defining roles scoped to specific folders within a Lakehouse, using role assignments to Microsoft Entra ID users, groups, or Fabric workspace roles, separate from SQL permissions.
- Power BI semantic models support RLS and Object-Level Security (OLS) via roles defined in the model (using DAX filter expressions for RLS) and OLS configured through external tools like Tabular Editor, since OLS is not natively supported in the standard Power BI Desktop UI.
- Security policies and role assignments defined at the Warehouse/SQL endpoint are separate from OneLake folder-level roles, so implementing consistent security across both a Lakehouse's files and its SQL analytics endpoint requires configuring both layers independently.
A data engineer needs regional sales managers who query a Fabric Warehouse table to see only the sales rows belonging to their own region, without changing how the application connects or maintaining separate views per region. Which T-SQL based approach satisfies this requirement?
What you have tried across DP-700's objectives, not a readiness score.
Implement and manage an analytics solution
- Tuning a workspace's Spark compute defaults and pool sizing
- Grouping and governing workspaces with a Fabric domain
- Setting per-workspace defaults for OneLake storage
- Standing up an Airflow job runtime inside a workspace
- Connecting a workspace to a Git repository
- Managing schema changes with a database project
- Promoting Fabric items across environments with a deployment pipeline
- Granting and restricting access at the workspace level
- Locking down who can open a single Fabric item
- Layering row, column, object, and file-level security rules
- Hiding sensitive column values behind a dynamic mask
- Classifying Fabric items with a sensitivity label
- Marking a trusted item as promoted or certified
- Reading a Fabric audit log to see who did what
- Securing data at the OneLake storage layer
- Picking the right build tool among a dataflow, a pipeline, and a notebook
- Kicking off a job on a schedule or in response to an event
- Chaining notebooks and pipelines together with parameters and dynamic expressions
Ingest and transform data
- Deciding between a full reload and an incremental load
- Shaping source data ahead of a dimensional-model load
- Landing a continuous stream of data into storage
- Matching a workload to the right Fabric data store
- Picking a transformation tool from dataflows, notebooks, KQL, or T-SQL
- Linking to external data without copying it via a OneLake shortcut
- Keeping a source database continuously replicated into Fabric
- Moving data into Fabric with a data pipeline
- Writing transform logic in PySpark, SQL, or KQL
- Flattening related tables into one wide, denormalized shape
- Rolling records up with group-by aggregations
- Dealing with duplicate rows, gaps, and data that arrives late
- Selecting the right engine for a real-time workload
- Weighing storage-in-place against a linked shortcut for a Real-Time Intelligence table
- Weighing an accelerated shortcut against a standard one for query speed
- Routing and reshaping live events with an Eventstream
- Handling a continuous flow of records with Spark's structured streaming
- Querying and reshaping event data with KQL
- Aggregating a stream over sliding or tumbling time windows
Monitor and optimize an analytics solution
- Watching an ingestion job's health and progress
- Watching a transformation job's health and progress
- Tracking whether a semantic model's refresh actually succeeded
- Setting up an alert to catch a failure early
- Tracking down why a pipeline run failed and fixing it
- Diagnosing why a dataflow run failed
- Debugging a notebook run that failed
- Troubleshooting a misbehaving Eventhouse
- Troubleshooting a misbehaving Eventstream
- Debugging a T-SQL statement that failed
- Fixing a broken or unreachable shortcut
- Speeding up a Lakehouse table with maintenance operations
- Making a slow pipeline run faster
- Tuning a Fabric warehouse for faster queries
- Improving throughput on real-time streaming components
- Tuning a Spark job to run faster and cheaper
- Making a slow query run faster
Coverage checked against the published exam guide on Aug 11, 2026.
These are independent practice questions, written against this certification's published exam guide. They are not the certification vendor's own questions, and not the real exam.