Grant analysts gold-layer access by sharing the lakehouse with Read all SQL Endpoint data

Configure security and governance
Answer Correct answer: C - Sharing the gold lakehouse with Read all SQL Endpoint data grants T-SQL read access to its Delta tables only, keeping bronze and silver hidden.

Case Study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview. Company Overview - Contoso, Ltd. is an online retail company that wants to modernize its analytics platform by moving to Fabric. The company plans to begin using Fabric for marketing analytics. Overview. IT Structure - The company’s IT department has a team of data analysts and a team of data engineers that use analytics systems. The data engineers perform the ingestion, transformation, and loading of data. They prefer to use Python or SQL to transform the data. The data analysts query data and create semantic models and reports. They are qualified to write queries in Power Query and T-SQL. Existing Environment. Fabric - Contoso has an F64 capacity named Cap1. All Fabric users are allowed to create items. Contoso has two workspaces named WorkspaceA and WorkspaceB that currently use Pro license mode. Existing Environment. Source Systems Contoso has a point of sale (POS) system named POS1 that uses an instance of SQL Server on Azure Virtual Machines in the same Microsoft Entra tenant as Fabric. The host virtual machine is on a private virtual network that has public access blocked. POS1 contains all the sales transactions that were processed on the company’s website. The company has a software as a service (SaaS) online marketing app named MAR1. MAR1 has seven entities. The entities contain data that relates to email open rates and interaction rates, as well as website interactions. The data can be exported from MAR1 by calling REST APIs. Each entity has a different endpoint. Contoso has been using MAR1 for one year. Data from prior years is stored in Parquet files in an Amazon Simple Storage Service (Amazon S3) bucket. There are 12 files that range in size from 300 MB to 900 MB and relate to email interactions. Existing Environment. Product Data POS1 contains a product list and related data. The data comes from the following three tables: Products - ProductCategories - ProductSubcategories - In the data, products are related to product subcategories, and subcategories are related to product categories. Existing Environment. Azure - Contoso has a Microsoft Entra tenant that has the following mail-enabled security groups: DataAnalysts: Contains the data analysts DataEngineers: Contains the data engineers Contoso has an Azure subscription. The company has an existing Azure DevOps organization and creates a new project for repositories that relate to Fabric. Existing Environment. User Problems The VP of marketing at Contoso requires analysis on the effectiveness of different types of email content. It typically takes a week to manually compile and analyze the data. Contoso wants to reduce the time to less than one day by using Fabric. The data engineering team has successfully exported data from MAR1. The team experiences transient connectivity errors, which causes the data exports to fail. Requirements. Planned Changes - Contoso plans to create the following two lakehouses: Lakehouse1: Will store both raw and cleansed data from the sources Lakehouse2: Will serve data in a dimensional model to users for analytical queries Additional items will be added to facilitate data ingestion and transformation. Contoso plans to use Azure Repos for source control in Fabric. Requirements. Technical Requirements The new lakehouses must follow a medallion architecture by using the following three layers: bronze, silver, and gold. There will be extensive data cleansing required to populate the MAR1 data in the silver layer, including deduplication, the handling of missing values, and the standardizing of capitalization. Each layer must be fully populated before moving on to the next layer. If any step in populating the lakehouses fails, an email must be sent to the data engineers. Data imports must run simultaneously, when possible. The use of email data from the Amazon S3 bucket must meet the following requirements: Minimize egress costs associated with cross-cloud data access. Prevent saving a copy of the raw data in the lakehouses. Items that relate to data ingestion must meet the following requirements: The items must be source controlled alongside other workspace items. Ingested data must land in the bronze layer of Lakehouse1 in the Delta format. No changes other than changes to the file formats must be implemented before the data lands in the bronze layer. Development effort must be minimized and a built-in connection must be used to import the source data. In the event of a connectivity error, the ingestion processes must attempt the connection again. Lakehouses, data pipelines, and notebooks must be stored in WorkspaceA. Semantic models, reports, and dataflows must be stored in WorkspaceB. Once a week, old files that are no longer referenced by a Delta table log must be removed. Requirements. Data Transformation In the POS1 product data, ProductID values are unique. The product dimension in the gold layer must include only active products from product list. Active products are identified by an IsActive value of 1. Some product categories and subcategories are NOT assigned to any product. They are NOT analytically relevant and must be omitted from the product dimension in the gold layer. Requirements. Data Security - Security in Fabric must meet the following requirements: The data engineers must have read and write access to all the lakehouses, including the underlying files. The data analysts must only have read access to the Delta tables in the gold layer. The data analysts must NOT have access to the data in the bronze and silver layers. The data engineers must be able to commit changes to source control in WorkspaceA. You need to ensure that the data analysts can access the gold layer lakehouse. What should you do?

  1. Add the DataAnalyst group to the Viewer role for WorkspaceA.
  2. Share the lakehouse with the DataAnalysts group and grant the Build reports on the default semantic model permission.
  3. Share the lakehouse with the DataAnalysts group and grant the Read all SQL Endpoint data permission. Correct Answer
  4. Share the lakehouse with the DataAnalysts group and grant the Read all Apache Spark permission.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Lakehouse sharing grants access to a single item without workspace membership; Read all SQL Endpoint data provides read-only T-SQL access to the Delta tables, matching least privilege for the analysts.

Sharing the gold-layer lakehouse with the DataAnalysts group and granting Read all SQL Endpoint data gives T-SQL read access to its Delta tables without exposing the bronze and silver layers or the rest of WorkspaceA.

Adding the group to the workspace Viewer role, which also exposes the bronze and silver lakehouses in WorkspaceA, violating the restriction that analysts only access the gold layer.

Community Discussion (4 comments)

QAZdbarhate12345678 👍 6 Selected: C
By granting Read all SQL Endpoint data permission, the analysts get the necessary and sufficient access to query the gold layer data while adhering to the principle of least privilege.
Nityaanantha_Raman 👍 1 Selected: C
By granting Read all SQL Endpoint data permission, the analysts get the necessary and sufficient access to query the gold layer data while adhering to the principle of least privilege. https://docs.google.com/document/d/1oNH9i2ssNi9gISG3JGuxUoUhmAA4xCaGahEKv2dRN6Y/edit?usp=sharing
LasAnsias 👍 2 Selected: C
Sharing the lakehouse with the DataAnalysts group and granting the Read all SQL Endpoint data permission would allow them to query the Delta tables in the gold layer using the SQL endpoint. This aligns with the requirement that they only have read access to the gold layer.
mixonfreddy 👍 2 Selected: C
Answer is C

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The analysts need read access only to the Delta tables in the gold-layer lakehouse and must not see bronze or silver. Sharing the gold lakehouse with the DataAnalysts group and granting Read all SQL Endpoint data provides read-only T-SQL access to that lakehouse's Delta tables through its SQL analytics endpoint, without granting any access to the other lakehouses or items in WorkspaceA.

Why the Other Options Are Wrong

Option A (Viewer on WorkspaceA) grants access to every item in the workspace, including the bronze and silver lakehouses, violating the security requirement. Option B (Build reports on the default semantic model) lets analysts author Power BI reports but does not provide direct SQL query access to the gold tables. Option D (Read all Apache Spark) grants access to the underlying files via Spark and OneLake APIs, which is broader than needed and contrary to the analysts' T-SQL profile.

Community Comment Notes

The community is unanimous (C 100). QAZdbarhate12345678 (6 likes) notes Read all SQL Endpoint data is the necessary and sufficient permission under least privilege, and LasAnsias adds it lets analysts query the gold Delta tables via the SQL endpoint.

Official Reference

Related Analysis

← Back to DP-700 Study Guide