Topic 1 Question #1
Case Study -This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.To start the case study -To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions.Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.Overview. Company Overview -Contoso, Ltd. is an online retail company that wants to modernize its analytics platform by moving to Fabric. The company plans to begin using Fabric for marketing analytics.Overview. IT Structure -The company’s IT department has a team of data analysts and a team of data engineers that use analytics systems.The data engineers perform the ingestion, transformation, and loading of data. They prefer to use Python or SQL to transform the data.The data analysts query data and create semantic models and reports. They are qualified to write queries in Power Query and T-SQL.Existing Environment. Fabric -Contoso has an F64 capacity named Cap1. All Fabric users are allowed to create items.Contoso has two workspaces named WorkspaceA and WorkspaceB that currently use Pro license mode.Existing Environment. Source SystemsContoso has a point of sale (POS) system named POS1 that uses an instance of SQL Server on Azure Virtual Machines in the same Microsoft Entra tenant as Fabric. The host virtual machine is on a private virtual network that has public access blocked. POS1 contains all the sales transactions that were processed on the company’s website.The company has a software as a service (SaaS) online marketing app named MAR1. MAR1 has seven entities. The entities contain data that relates to email open rates and interaction rates, as well as website interactions. The data can be exported from MAR1 by calling REST APIs. Each entity has a different endpoint.Contoso has been using MAR1 for one year. Data from prior years is stored in Parquet files in an Amazon Simple Storage Service (Amazon S3) bucket. There are 12 files that range in size from 300 MB to 900 MB and relate to email interactions.Existing Environment. Product DataPOS1 contains a product list and related data. The data comes from the following three tables:Products -ProductCategories -ProductSubcategories -In the data, products are related to product subcategories, and subcategories are related to product categories.Existing Environment. Azure -Contoso has a Microsoft Entra tenant that has the following mail-enabled security groups:DataAnalysts: Contains the data analystsDataEngineers: Contains the data engineersContoso has an Azure subscription.The company has an existing Azure DevOps organization and creates a new project for repositories that relate to Fabric.Existing Environment. User ProblemsThe VP of marketing at Contoso requires analysis on the effectiveness of different types of email content. It typically takes a week to manually compile and analyze the data. Contoso wants to reduce the time to less than one day by using Fabric.The data engineering team has successfully exported data from MAR1. The team experiences transient connectivity errors, which causes the data exports to fail.Requirements. Planned Changes -Contoso plans to create the following two lakehouses:Lakehouse1: Will store both raw and cleansed data from the sourcesLakehouse2: Will serve data in a dimensional model to users for analytical queriesAdditional items will be added to facilitate data ingestion and transformation.Contoso plans to use Azure Repos for source control in Fabric.Requirements. Technical RequirementsThe new lakehouses must follow a medallion architecture by using the following three layers: bronze, silver, and gold. There will be extensive data cleansing required to populate the MAR1 data in the silver layer, including deduplication, the handling of missing values, and the standardizing of capitalization.Each layer must be fully populated before moving on to the next layer. If any step in populating the lakehouses fails, an email must be sent to the data engineers.Data imports must run simultaneously, when possible.The use of email data from the Amazon S3 bucket must meet the following requirements:Minimize egress costs associated with cross-cloud data access.Prevent saving a copy of the raw data in the lakehouses.Items that relate to data ingestion must meet the following requirements:The items must be source controlled alongside other workspace items.Ingested data must land in the bronze layer of Lakehouse1 in the Delta format.No changes other than changes to the file formats must be implemented before the data lands in the bronze layer.Development effort must be minimized and a built-in connection must be used to import the source data.In the event of a connectivity error, the ingestion processes must attempt the connection again.Lakehouses, data pipelines, and notebooks must be stored in WorkspaceA. Semantic models, reports, and dataflows must be stored in WorkspaceB.Once a week, old files that are no longer referenced by a Delta table log must be removed.Requirements. Data TransformationIn the POS1 product data, ProductID values are unique. The product dimension in the gold layer must include only active products from product list. Active products are identified by an IsActive value of 1.Some product categories and subcategories are NOT assigned to any product. They are NOT analytically relevant and must be omitted from the product dimension in the gold layer.Requirements. Data Security -Security in Fabric must meet the following requirements:The data engineers must have read and write access to all the lakehouses, including the underlying files.The data analysts must only have read access to the Delta tables in the gold layer.The data analysts must NOT have access to the data in the bronze and silver layers.The data engineers must be able to commit changes to source control in WorkspaceA.You need to ensure that the data analysts can access the gold layer lakehouse.What should you do?
Answer: C
This question aligns with the DP-700 core objective of implementing security for Microsoft Fabric analytics solutions. The scenario specifies data analysts require only read access to Delta tables in the gold lakehouse layer, no access to bronze or silver layer data, and support for their existing T-SQL and Power Query skill sets. The suggested answer C meets all these requirements by granting targeted, read-only access to the lakehouse's built-in SQL analytics endpoint, which exposes Delta tables for querying without providing access to underlying storage or restricted non-gold layer data. This approach follows the least privilege principle, granting only the exact access required for data analysts to complete their work without exposing sensitive raw or transformed intermediate data. Option Analysis:
A. Incorrect. Assigning the Viewer role for WorkspaceA grants read access to all items stored in the workspace, including bronze and silver layer data in the lakehouses, which directly violates the requirement that data analysts cannot access bronze and silver layer data. Workspace roles apply broadly to all items in the workspace, making this permission level far too permissive for the stated requirements.
B. Incorrect. The Build reports on the default semantic model permission only grants the ability to create reports and other content on the automatically generated semantic model for the lakehouse, not direct read access to the underlying Delta tables. This does not support the data analysts' need to run ad-hoc T-SQL or Power Query queries directly against the gold layer tables, so it fails to meet the access requirements.
C. Correct. The Read all SQL Endpoint data permission grants read-only access to all Delta tables exposed via the lakehouse's SQL analytics endpoint, which supports the T-SQL and Power Query tools the data analysts are trained to use. This permission does not grant access to underlying lakehouse storage files or restricted bronze and silver layer data, adhering to the least privilege principle and the stated security requirements.
D. Incorrect. The Read all Apache Spark permission grants access to lakehouse data via Spark compute, which requires users to write Spark syntax to query data, a skill set the data analysts in the scenario do not hold. This permission also exposes access to underlying storage files, creating a risk of unauthorized access to bronze and silver layer data, so it does not meet the scenario requirements. Key Concepts:
1. Fabric Lakehouse Permission Model: Microsoft Fabric provides granular, item-level permissions for lakehouses, including separate permissions for SQL endpoint access, Spark access, and semantic model build access, allowing administrators to assign only the access required for specific user roles.
2. Least Privilege Access for Fabric Workspaces: Workspace roles grant broad access to all items in a workspace, so item-level sharing with targeted permissions is preferred when users only need access to specific items or specific functionality for an item, to avoid exposing restricted data.
3. Fabric Lakehouse SQL Endpoint: Every Fabric lakehouse includes a built-in serverless SQL analytics endpoint that exposes Delta tables as relational tables queryable via T-SQL, making it compatible with common analytics tools and SQL skill sets. References:
Control access to lakehouses in Microsoft Fabric, Roles in Microsoft Fabric workspaces, https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces