Exam PL-300 All QuestionsBrowse all questions from this exam
Go to Exam
Question 47

You have a Microsoft Power BI data model that contains three tables named Orders, Date, and City. There is a one-to-many relationship between Date and

Orders and between City and Orders.

The model contains two row-level security (RLS) roles named Role1 and Role2. Role1 contains the following filter.

City[State Province] = "Kentucky"

Role2 contains the following filter.

Date[Calendar Year] = 2020 -

If a user is a member of both Role1 and Role2, what data will they see in a report that uses the model?

    Correct Answer: A

    When a report user is assigned to multiple roles in Power BI, the Row-Level Security (RLS) filters become additive. This means the user will see data that satisfies either of the conditions specified by the roles combined, hence they can see datasets where the State Province value is Kentucky or where the Calendar Year is 2020.

Discussion
MuffinshowOption: A

Wrong , correct answer is A

NGenov

User is limited to only Kentucky AND year 2020. He should not have rights to see other years or areas. Come on guys its simple OR/AND!

NevilleV

Which means D is the correct answer

cnmc

Yes it's simple OR/AND, and you simply don't understand how RLS works. Read Microsoft's doc, and pay attention to this sentence: "Take care: Should a report user map to both roles, they'll see all Payroll table rows." https://learn.microsoft.com/en-us/power-bi/guidance/rls-guidance That means different rules don't "merge" to become the most restrictive of the component rules. In the context of this question, IF I want to restrict this user to see ONLY Kentucky IN the year 2020, then I'd set up a RLS that has both of those conditions...

semauni

I tend to agree with what you're saying, but in that example it's a TRUE() going against a FALSE(). One role is explicitly going against the other role, in this case both roles could supplement each other. Again, I agree that this likely means that it's not only the intersection of the two conditions you'll see, but I'm not 100% sure based on that example.

itenginerd

For example, if a user belongs to both the "Sales" and "Marketing" roles, they can see data for both these roles. https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls#faq

e31df62

cnmc : Thank YOU! YOU R RIGHT! Straight away lifted from microsft page: "When a report user is assigned to multiple roles, RLS filters become additive. It means report users can see table rows that represent the union of those filters. What's more, in some scenarios it's not possible to guarantee that a report user doesn't see rows in a table. So, unlike permissions applied to SQL Server database objects (and other permission models), the "once denied always denied" principle doesn't apply." Link: https://learn.microsoft.com/en-us/power-bi/guidance/rls-guidance Just do Cntrl+F and search on this page.

Mizaan

D is correct. Why? Because if they could see Kentucky OR 2020 data then they just have to select Kentucky and they would be able to see data from all years, which would defeat the purpose of RLS

Churato

"Multiple role mappings can result in unexpected outcomes. When a report user is assigned to multiple roles, RLS filters become ADDITIVE. It means report users can see table rows that represent the UNION of those filters." Source : https://learn.microsoft.com/en-us/power-bi/guidance/rls-guidance

cnmc

They would be able to select Kentucky and they would see the KENTUCKY data from all years. They would not be able to see, say New York data or California for years other than 2020

md_sultan

I have tried and I was able to see for the year 2020 and area , so D should be correct

Mlak_Lou

Same i made the test. D is correct !

Sophieeeeee

I also tried by creating two roles and assigned the contrains to each but the result is A. D works when I put both two constrains under the same role.

FinelogBiseum

Check out this video: https://www.youtube.com/watch?v=0OPcZeLHbfY

ThariCDOption: A

Answer should be A, from the Microsoft documentation (https://docs.microsoft.com/en-us/power-bi/guidance/rls-guidance): "When a report user is assigned to multiple roles, RLS filters become additive. It means report users can see table rows that represent the union of those filters." This means that you would see all data where either Role1 OR Role2 applies, so the answer is A not D.

rashjan

Thank you, that is the right description.

olajor

Union is everything in both, i.e Role1 and Role2

nucleus21

it's A i just recreated the scenario and it shows all the lines for the Role 1 and adds all the lines for the Role 2. so keeps all the lines that meet Role 1 OR Role 2

Dumi44

That means exactly the opposite "can see table rows that represent the union of those filters." Tables that represent the union of the filters, not the union of the rows displayed by each filter

taod

I'd say that you are talking about the intersection

sarraEBOption: A

"When a report user is assigned to multiple roles, RLS filters become additive. It means report users can see table rows that represent the union of those filters." UNION takes all the lines of filter 1 and all lines of filter 2 => Answer is A https://www.youtube.com/watch?v=0OPcZeLHbfY

souhailftwOption: A

A he will see both

sm222Option: A

The answer is A. The terminology is what confuses people. So, according to Microsoft learn . A Union is shown when multiple roles are selected or when a user is a member of both roles. This mean the user will be able to see all rows of Role1 and all rows of role2. However, the terminology will use OR because it means the user will see either of the data from role1 and role2 . If we consider D, it says that user will see data from role1 and role2 which is an intersection or like an inner join which is wrong

ageleeOption: D

https://learn.microsoft.com/en-us/power-bi/guidance/rls-guidance

FlixOption: D

With RLS it's always the combination. Meaning: the user sees the full set for 2020 and the full set for Kentucky. If you want the user to only see the year 2020 for Kentucky, than combine this in the same role.

SophieeeeeeOption: A

I tried on Power BI. If you create TWO roles, like Role 1 and Role 2, and assign the province and year to EACH OF THEM SEPERATELY, then the answer will be A -- which is the answer for this question. However, if you only create ONE role and put BOTH province and year UNDER THIS ROLE, the answer will be D.

Tinashe16Option: D

I think the confusion on this question is on semantics, a lot people who are saying answer is not D are programmers who want to see brackets enclosing (Kentarky and Year 2020)

e3ddcebOption: D

The correct answer is D. The user will only see data for which the State Province value is Kentucky and the Calendar Year is 2020. In Power BI, if a user is a member of multiple roles, the filters from all roles are applied. This means that the user will only see data that meets all the conditions from all roles. In this case, the user must see data where the State Province is Kentucky (from Role1) and the Calendar Year is 2020 (from Role2).

Onizuka911Option: A

When a report user is assigned to multiple roles, RLS filters become additive. It means report users can see table rows that represent the union of those filters.

Deva_1Option: D

D. The user will only see data for which the State Province value is Kentucky and the Calendar Year is 2020. Because user is member of both Roles and hence member access the data only when they statisfies both the condition.

shahrzadkhbOption: A

I tested in in power BI and I am pretty sure that 'A' is the correct answer.

0e18c76Option: A

Wrong, correct answer should be A. Based on description D can not be correct. In the described context (two roles) you would see data from other cities besides Kentucky and you would see data from other years besides 2020. To get the results from the intersection between Kentucky and year 2020, you should create one specific role and define on this same role, a filter for the city and another filter for the year. This means, that the rule of AND and OR only applies if both filters, for city Kentucky and year 2020, are defined on the same role. Please check the following youtube video: https://www.youtube.com/watch?v=M5K_jKPxdqI

Mani1994Option: A

Correct answer is A

ab97776Option: A

With multiple roles does RLS become more restrictive or permissive? Permissive according to https://learn.microsoft.com/en-us/power-bi/guidance/rls-guidance. The user with 2 roles can see data unrelated to Kentucky, but when they do look at data outside of Kentucky the year filter is applied. When they look at Kentucky data no year filter is applied. choice D suggests they can see a very limited set of data. A set of data that is more restrictive and only allows them to see Kentucky data from the year 2020 Choice A might be more clear if it said something like, The user will see data for all State Provinces where the Calendar Year is 2020, with Kentucky related data being unafflicted by Calendar Year filter that's too wordy though.

Chaka_MahloOption: A

https://learn.microsoft.com/en-us/power-bi/guidance/rls-guidance