DP-700 implement and manage explained
Implement and manage an analytics solution is worth 30–35% of DP-700. It covers four areas: workspace settings, lifecycle management, security and governance, and orchestration. The questions are rarely about code. They ask which setting, role or item type solves a described requirement, so the skill is matching the requirement to the right Fabric feature.
Configure Fabric workspace settings
The outline names Spark, domain, OneLake and Apache Airflow workspace settings.
- Spark settings control the pool that notebooks and Spark job definitions use, the runtime version and session behaviour. An Environment item bundles libraries, Spark properties and compute settings so that many notebooks share the same configuration.
- Domains group workspaces by business area so governance can be delegated.
- OneLake settings include whether external apps can read OneLake data and how OneLake security is used.
- Apache Airflow settings apply to Apache Airflow jobs, which run Python DAGs for orchestration.
Lifecycle management
| Capability | What it does |
|---|---|
| Git integration | Connects a workspace to a repository (Azure DevOps or GitHub) so items are version controlled, with branches and commits |
| Database projects | Keep a warehouse schema as code so it can be built and deployed from source |
| Deployment pipelines | Move content through development, test and production stages |
| Deployment rules | Override settings per stage, such as data source, parameters or a notebook’s default lakehouse |
A typical question describes three stages and asks how to stop test items pointing at development data. That is a deployment rule, not a manual edit.
Security and governance
Fabric security is layered. Work from broad to narrow:
- Workspace roles (Admin, Member, Contributor, Viewer) give access to everything in a workspace.
- Item permissions share a single item, without a workspace role.
- Data-level controls narrow what a user sees inside a warehouse or SQL analytics endpoint: row-level security through a security policy and predicate function, column-level security through GRANT and DENY on columns, and object-level permissions on tables and views.
- Dynamic data masking hides column values such as emails from users who lack the UNMASK permission. The data is not changed.
- OneLake security defines roles that grant access to specific folders or tables in a lakehouse, which workspace roles alone cannot do.
- Sensitivity labels classify items, and endorsement (Promoted, Certified, Master data) signals trust. Certified is set by reviewers the Fabric admin has authorised.
- Audit logs record activity and are searched in the Microsoft Purview portal.
The common trap: a user with a Viewer or higher workspace role may already see more than your folder-level design intends. Check the workspace role before you design the narrow control.
Orchestrate processes
| Tool | Choose it when |
|---|---|
| Dataflow Gen2 | Low-code Power Query transformations, often by analysts, for moderate data volumes |
| Pipeline | Orchestrating steps, copying data, calling notebooks and dataflows, branching and error handling |
| Notebook | Code-first transformation in PySpark or SQL at scale, or logic that needs libraries |
Pipelines run on a schedule or from an event-based trigger, such as a file arriving. Use an event when freshness matters or arrival is irregular; use a schedule for fixed cadences. Parameters and dynamic expressions pass values between steps, for example a pipeline parameter feeding a notebook’s parameter cell through the Notebook activity.
Example questions
Question 1. Sales managers must see only rows for their own region in a warehouse table, while the central finance team sees every row. All users query the same table through T-SQL. What should you implement?
- A. Dynamic data masking on the region column
- B. A row-level security policy with a predicate on the region column
- C. A copy of the table for each region
- D. A sensitivity label on the warehouse
Show answer
Answer: B
Row-level security with a security policy and an inline predicate function filters rows per user in the warehouse. Dynamic data masking hides values in columns but still returns every row. A separate table per region multiplies maintenance and does not apply to a single shared table. A sensitivity label classifies the item and does not filter rows.
Want more questions like this? Full DP-700 practice tests →
Question 2. Analysts must query a Customers table but should see the Email column only as a masked value such as [email protected]. Account managers must see real emails. Which feature fits?
- A. Row-level security on the Email column
- B. Certified endorsement of the table
- C. Column-level security that denies SELECT on Email
- D. Dynamic data masking on Email, with UNMASK granted to account managers
Show answer
Answer: D
Dynamic data masking with the email function returns masked values to users without the UNMASK permission, and granting UNMASK to account managers shows real values. Column-level security with DENY would make the column unreadable instead of masked. Row-level security filters rows, not values. Endorsement is a trust label and has no effect on what data is returned.
Want more questions like this? Full DP-700 practice tests →
Question 3. A lakehouse has a Files area with folders for each department. The HR group must read only the hr folder, and no one in HR should be a workspace member. What is the best way to grant this?
- A. Create a OneLake security role that grants read on the hr folder and add the HR group
- B. Add the HR group as workspace Viewers
- C. Share the lakehouse with the HR group and grant ReadAll
- D. Apply a Highly Confidential sensitivity label to the hr folder
Show answer
Answer: A
OneLake security roles grant read access to specific folders, and users can be added to the role without a workspace role. Giving HR the Viewer workspace role exposes more than the hr folder. Sharing the lakehouse with ReadAll exposes all data in it. A sensitivity label classifies content but does not restrict folder access.
Want more questions like this? Full DP-700 practice tests →
How this domain is tested
Expect scenario questions that list roles and requirements and ask for the least-privilege option. Learn the layers in order, learn which tool covers which layer, and try each in a trial workspace once. The cheat sheet has a requirement-to-answer table. Next, ingest and transform data.