DP-600 maintain a solution explained
Maintain a data analytics solution is worth 25–30% of DP-600. It has two halves: security and governance (who can see what, and how items are labelled and endorsed) and the analytics development lifecycle (how changes move from a developer’s machine to production). The questions are short and factual, and they reward knowing which control works at which level.
Implement security and governance
Layers of access
Fabric security is layered. A request has to pass each layer that applies, and you pick the layer that matches the requirement.
| Layer | Examples | Typical use |
|---|---|---|
| Workspace | Admin, Member, Contributor, Viewer roles | Team collaboration across all items |
| Item | Sharing an item, permissions on a lakehouse, warehouse or semantic model | Give one person access to one item |
| Object, column, row | T-SQL GRANT/DENY, column-level security, row-level security | Restrict tables, columns and rows inside a warehouse or SQL endpoint |
| File and folder | OneLake security roles on folders and tables | Control access to files in a lakehouse |
Workspace roles are the broadest tool. A Viewer can read items, a Contributor can create and edit content, a Member adds sharing rights, and an Admin manages the workspace. If a requirement says “only this one item”, use item-level sharing rather than a role.
Row-level, column-level and object-level security
- Row-level security (RLS) in a warehouse is a security policy with a predicate function, so a filter is applied transparently to every query. In a semantic model, RLS is a role with a DAX filter expression, and users are assigned to the role in the service. Remember the DAX filter flows through relationships from dimension to fact.
- Column-level security restricts which columns a principal can select, using
GRANT SELECTon specific columns orDENY. - Object-level security in a semantic model hides tables or columns from a role. It is set with external tooling such as Tabular Editor.
- Dynamic data masking hides values in a warehouse column from users without the unmask permission. It obscures the output, it does not deny access.
A common trap: workspace Contributors and above can bypass many data-level controls, because they hold broad rights on the items. If row-level security must apply to a person, make them a Viewer or share at item level.
Sensitivity labels and endorsement
Sensitivity labels come from Microsoft Purview Information Protection. You apply them to Fabric items, and they follow the data when it is exported, subject to tenant settings. Labels classify; they do not by themselves grant or block access to items.
Endorsement signals trust. Promoted can be applied by item owners and contributors. Certified requires the person to be authorised by a Fabric administrator, usually through a designated group. Master data endorsement marks items as a core source of an entity. Endorsement helps people find reliable items; it does not change permissions.
Maintain the analytics development lifecycle
Version control
A Fabric workspace can connect to a Git repository. You choose the repository, the branch and the folder, and the workspace syncs in both directions: commit changes from the workspace, update the workspace from the branch. Work in a feature branch, then merge by pull request. A Power BI Desktop project (.pbip) saves the report and the semantic model as a folder of text-based files, which makes diffs and merges readable, and which you can commit to the same repository.
Deployment pipelines
A deployment pipeline gives you stages, usually development, test and production, each tied to a workspace. You deploy content from one stage to the next. Deployment rules change settings per stage, such as a data source or a parameter value, so the same model can point at test data in test and at production data in production. Know that rules apply to the target stage, and that the pipeline compares stages to show what differs.
Impact analysis and the XMLA endpoint
Impact analysis shows the downstream items that depend on a lakehouse, warehouse, dataflow or semantic model, so you can see which reports break before you change a column. The XMLA endpoint lets external tools such as Tabular Editor and SQL Server Management Studio connect to a semantic model, and when it is enabled for read and write you can deploy model changes and run scripts against it. If a tool cannot write to a model, check whether the capacity’s XMLA setting is read only.
Reusable assets
- A
.pbittemplate contains the report and model structure without data, so others can start from the same design. - A
.pbidsfile stores data source connection details so users open the right source quickly. - A shared semantic model lets several reports use one governed model, instead of each report holding its own copy.
Example questions
Question 1. A deployment pipeline moves a semantic model from test to production. In production the model must read from the production warehouse rather than the test warehouse. What should you configure?
- A. A sensitivity label on the production workspace
- B. A deployment rule on the production stage
- C. Certified endorsement on the model
- D. A new semantic model built manually in production
Show answer
Answer: B
A deployment rule on the production stage changes the data source or parameter value when content is deployed to that stage. Re-creating the model by hand loses the benefit of the pipeline, a sensitivity label does not change a connection, and endorsement only marks trust and has no effect on data sources.
Want more questions like this? Full DP-600 practice tests →
Question 2. Your organisation wants only a selected group of data stewards to be able to mark datasets as Certified. What is required?
- A. A Fabric administrator authorises that group to certify items
- B. Make the stewards workspace Admins
- C. Apply a Confidential sensitivity label to the datasets
- D. Ask the stewards to apply the Promoted badge
Show answer
Answer: A
Certification is restricted to users authorised by a Fabric administrator, typically through a designated security group set in the tenant settings. Workspace Admin rights do not grant certification by themselves, a sensitivity label does not mark trust, and Promoted is a separate level that item owners can apply.
Want more questions like this? Full DP-600 practice tests →
Question 3. Developers want to use Tabular Editor to deploy changes directly to a semantic model in a Fabric workspace, but the deployment is refused with a write error. What is the most likely cause?
- A. The model has no row-level security role
- B. The workspace is not connected to Git
- C. The model is not in a deployment pipeline
- D. The XMLA endpoint is set to read only
Show answer
Answer: D
External tools connect through the XMLA endpoint, and write operations require it to be enabled for read and write on the capacity. Row-level security roles do not block developers deploying schema changes, Git integration is unrelated to the tool’s connection, and a missing deployment pipeline does not stop XMLA writes.
Want more questions like this? Full DP-600 practice tests →
Next, read prepare data explained, the largest domain.