Fast review map for this domain:
| Exam signal | First object to inspect | Correct-answer pattern |
|---|---|---|
| Same behavior affects several items in one workspace | Workspace settings | Change Spark, OneLake, domain, or Dataflows Gen2 workspace configuration before editing individual artifacts |
| Team needs reviewed changes and controlled promotion | Git integration, database project, deployment pipeline | Separate source review, schema lifecycle, and stage promotion |
| User can access an item but should not see all data | Fine-grained security control | Use row, column, object, file, folder, or masking control instead of broad workspace role changes |
| Process must run automatically with runtime values | Pipeline trigger, parameters, dynamic expressions | Use pipeline orchestration for schedules, event starts, dependency paths, and parameter passing |
flowchart LR
A[Workspace defaults] --> B[Item configuration]
B --> C[Security and governance layer]
C --> D[Orchestration runtime]
D --> E[Run history and validation evidence]
Practice Question: A Fabric data engineering team uses several notebooks in one workspace. Each notebook should use the same Spark runtime and capacity-related defaults, but engineers keep editing session settings manually. What should the data engineer configure first?
A. Modify every notebook cell that creates a Spark session.
B. Configure the Spark workspace settings for the Fabric workspace.
C. Create a deployment pipeline and promote the notebooks.
D. Apply a sensitivity label to the lakehouse.
Correct Answer: B.
Explanation: B is correct because the repeated runtime behavior is owned by the workspace Spark settings. A is fragile and item-by-item. C manages lifecycle movement but does not set runtime defaults. D governs classification and protection, not Spark execution. Exam Takeaway: When the symptom repeats across items, choose the shared workspace control; the distractor pattern is an item-level fix for a workspace-level dependency.
Fabric workspace settings act as the control-plane starting point for data engineering work. Spark settings determine runtime defaults that affect notebook and Spark job execution. OneLake settings affect how storage and shortcuts behave inside the workspace boundary. Domain settings connect workspace content to enterprise data-domain organization. Dataflows Gen2 settings affect data preparation behavior and refresh handling.
The operational rule is to identify ownership of the behavior. A Spark runtime mismatch is not fixed by changing a SQL warehouse. A domain governance issue is not fixed by optimizing a Delta table. A OneLake shortcut problem is not solved by changing a pipeline retry count. Each setting satisfies a different dependency: execution runtime, storage namespace, governance classification, or data-preparation behavior.
Skipping workspace configuration creates downstream noise. Notebooks may run with unexpected defaults, artifacts may be organized outside the intended domain, and refresh settings may vary by author. The exam rewards the candidate who checks the controlling workspace object before tuning a downstream artifact.
| Object | Attribute | Value Range | Default State | Dependency | Failure State |
|---|---|---|---|---|---|
| Fabric workspace | Spark settings | Runtime, environment, capacity behavior supported by Fabric | Workspace default | Workspace admin rights and Fabric tenant enablement | Notebooks run with inconsistent runtime behavior |
| Fabric workspace | Domain assignment | Available Fabric domains | Unassigned or tenant default | Domain governance configuration | Items are not organized under the expected data domain |
| OneLake workspace configuration | Storage and shortcut behavior | Supported OneLake options | Workspace inherited behavior | OneLake availability and workspace permissions | Shortcut resolution or storage access errors persist |
| Dataflows Gen2 workspace setting | Refresh and staging behavior | Supported Dataflows Gen2 options | Service defaults | Data Factory workload availability | Dataflow refresh behavior does not match workspace standards |
Verification evidence can include official Fabric portal evidence, workspace setting screenshots, item execution status, or supported management API evidence when available for the relevant Fabric version.
The workspace setting is stored as control-plane metadata. When a notebook, dataflow, pipeline, or lakehouse operation starts, Fabric resolves workspace context before the item operation executes. If the workspace default supplies the runtime or governance property, the item receives that behavior without every artifact restating it. If the default is wrong, each downstream artifact can appear broken even though the item definition is valid. Correcting the workspace metadata changes the dependency that the item resolves at execution or organization time.
| Task | Precise Command or Path | Verification Standard |
|---|---|---|
| Validate workspace-level ownership | Fabric portal > Workspaces > target workspace > Workspace settings | Setting category matches the repeated symptom across items |
| Confirm Spark default behavior | Fabric portal > Workspace settings > Spark settings, then run representative notebook | Notebook starts with the expected Spark configuration |
| Confirm domain assignment | Fabric portal > Workspace settings > Domain | Workspace appears under the intended domain context |
| Confirm Dataflows Gen2 behavior | Fabric portal > workspace Dataflow Gen2 item > refresh history | Refresh uses the expected workspace-supported behavior |
Practice Question: A team needs developers to review notebook and pipeline changes before those changes are promoted to a production workspace. What combination best supports this requirement?
A. Workspace viewer permissions and manual item export.
B. Git integration for review plus deployment pipelines for stage promotion.
C. Dynamic data masking and audit logs.
D. A OneLake shortcut from production to development.
Correct Answer: B.
Explanation: B is correct because Git supports reviewable source changes and deployment pipelines promote content across stages. A lacks controlled release movement. C supports security and audit evidence, not lifecycle promotion. D creates storage linkage and can increase risk. Exam Takeaway: Match review to version control and promotion to deployment pipelines; distractors usually solve security or storage instead of release control.
Lifecycle management starts by separating authoring, review, and release. Git integration records item definitions and enables review workflows outside the live production workspace. Deployment pipelines provide a Fabric-native promotion path between stages. Database projects let warehouse or SQL database schema work be treated as a source-managed engineering asset rather than an undocumented production edit.
The why-layer is control of state. A production workspace should not be the first place a change exists. A Git branch or database project captures the intended definition. A deployment pipeline moves a tested definition into a higher stage. Without this sequence, production may contain a mixture of manual changes, stale dependencies, and untraceable object versions.
| Object | Attribute | Value Range | Default State | Dependency | Failure State |
|---|---|---|---|---|---|
| Git integration | Connected branch and folder | Supported provider and branch path | Not connected | Repository access and workspace permissions | Changes cannot be reviewed or traced |
| Deployment pipeline | Stage mapping | Development, test, production-style stages | No pipeline | Supported item types and stage workspace access | Wrong artifact version is promoted |
| Database project | Schema object definition | Tables, views, procedures, security objects supported by project tooling | External to Fabric item until configured | SQL development workflow and source repository | Schema drift or missing dependency appears during deployment |
| Fabric item | Deployment status | Same, different, missing, unsupported | Uncompared | Pipeline comparison metadata | Promotion skips required dependency or overwrites unexpected changes |
Supported verification should come from Fabric portal Git status, deployment pipeline comparison, deployment history, source-control review records, and database project build or validation output for the active tooling version.
A developer changes an item definition in the development workspace. Git integration serializes supported item metadata to a repository branch, where review and history occur. When approved, the Fabric deployment pipeline compares the source stage and target stage. The pipeline then applies supported item changes into the target workspace. If a database object is managed through a project, the schema definition is validated before it becomes target state. Incorrect lifecycle selection breaks the chain: Git alone does not promote stages, and a deployment pipeline alone does not provide branch review semantics.
| Task | Precise Command or Path | Verification Standard |
|---|---|---|
| Validate Git connection | Fabric portal > Workspace settings > Git integration | Repository, branch, and sync status are visible |
| Validate stage differences | Fabric portal > Deployment pipelines > Compare | Expected changed, new, or missing items are listed |
| Validate promotion history | Fabric portal > Deployment pipelines > Deployment history | Target stage shows successful deployment for expected items |
| Validate database project readiness | Supported database project build or validation output | Schema objects compile and dependency errors are absent |
Practice Question: Analysts can query a warehouse table but must not see full values in a sensitive column. They should still be able to run aggregate reports. Which control is most directly aligned?
A. Dynamic data masking or column-level protection supported by the warehouse scenario.
B. Workspace Admin role removal for every analyst.
C. Endorse the item as certified.
D. Create a deployment pipeline.
Correct Answer: A.
Explanation: A is correct because the requirement targets sensitive column visibility while preserving analytical access. B is overbroad and may remove required access. C signals trust but does not mask values. D controls release movement, not query-time data exposure. Exam Takeaway: Choose query-result controls for visible data shape; the distractor pattern is governance metadata used as if it were enforcement.
Fabric security decisions begin with scope. Workspace roles define broad authoring and consumption boundaries. Item-level access grants access to a specific lakehouse, warehouse, semantic model, notebook, pipeline, or other item. Row-level, column-level, object-level, and folder/file-level controls narrow what an authorized user can see or query. Dynamic data masking changes visible values for supported objects without redesigning the table. Sensitivity labels apply classification and protection metadata. Endorsement tells users which items are promoted or certified. Audit logs provide evidence of access and administrative activity.
The dependency is identity-to-object evaluation. A user first needs an identity and a permission path. Then the query or item operation evaluates fine-grained rules. Labels and endorsement add governance signals, while audit logs record activity. If the wrong layer is chosen, the user either receives too much access, no access, or only a label with no enforcement.
| Object | Attribute | Value Range | Default State | Dependency | Failure State |
|---|---|---|---|---|---|
| Workspace role | Member capability | Admin, Member, Contributor, Viewer-style roles | No role unless assigned | Microsoft Entra identity and workspace permission | User cannot access workspace or receives excessive authoring rights |
| Item permission | Artifact access | Read, build, share, edit-style permissions by item | Not shared | Item owner or workspace role | User can access workspace but not target item |
| Row-level security | Predicate logic | User or group filtered rows | Not applied | Supported engine and identity mapping | User sees rows outside allowed segment |
| Dynamic data masking | Masking rule | Supported mask formats by data store | Unmasked | Supported warehouse or SQL object feature | Sensitive values appear in query output |
| Audit log | Activity event | User, operation, item, timestamp | Captured when auditing is enabled and available | Microsoft Purview audit capability and permissions | Investigation lacks authoritative event evidence |
Evidence should come from Fabric permission dialogs, supported SQL security definitions, item access views, Microsoft Purview sensitivity label state, endorsement badge state, and Microsoft Purview audit search results.
When a user opens or queries a Fabric item, Fabric evaluates workspace membership and item permission before the engine returns data. If the engine supports row, column, object, masking, folder, or file controls, those rules shape the returned result or accessible object set. Sensitivity labels and endorsement are evaluated as governance metadata and user signals, not as substitutes for permission checks. Audit events are emitted from the service activity path so an investigator can reconstruct who performed the operation and when.
| Task | Precise Command or Path | Verification Standard |
|---|---|---|
| Validate workspace role | Fabric portal > Workspace > Manage access | User or group has the intended role only |
| Validate item access | Fabric portal > Item > Manage permissions | Target identity has only required item permission |
| Validate row or column behavior | Run supported query as test identity | Result contains only allowed rows or protected columns |
| Validate audit evidence | Microsoft Purview audit search for Fabric activity | Event includes user, item, operation, and timestamp |
Practice Question: A lakehouse load must run every night, pass the processing date into a notebook, and stop if the validation activity fails. Which Fabric object is the best orchestrator?
A. Dataflow Gen2 only.
B. A pipeline with a schedule trigger, notebook activity parameter, and dependency conditions.
C. A sensitivity label on the lakehouse.
D. A OneLake shortcut to the source.
Correct Answer: B.
Explanation: B is correct because the pipeline owns scheduling, parameter passing, and activity dependency flow. A can transform data but does not model the full dependency chain as directly. C is governance metadata. D affects storage reference, not orchestration. Exam Takeaway: When the scenario includes multiple activities and control flow, choose a pipeline; distractors usually focus on one data object instead of the process chain.
A Fabric orchestration design has three decisions: execution vehicle, trigger, and runtime parameterization. Dataflows Gen2 handles many low-code ingestion and shaping tasks. Pipelines coordinate activities, dependencies, triggers, and failure paths. Notebooks handle programmable Spark logic, libraries, and custom validation. Parameters remove hardcoded environment and date values; dynamic expressions bind runtime values to activity inputs.
The why-layer is repeatability. A process that depends on manual date edits or manual notebook execution is not operationally stable. A schedule or event trigger starts the process. A pipeline passes parameter values. Dependency conditions prevent downstream writes after validation failure. Without these controls, a technically correct transformation can run at the wrong time, against the wrong partition, or after a failed upstream step.
| Object | Attribute | Value Range | Default State | Dependency | Failure State |
|---|---|---|---|---|---|
| Pipeline | Activity graph | Copy, notebook, dataflow, script, validation-style activities | Empty until authored | Data Factory workload and item permissions | Activities run out of order or not at all |
| Trigger | Schedule or event condition | Time-based or supported event-based trigger | Disabled or not configured | Workspace and trigger permissions | Process requires manual start |
| Notebook activity | Parameter binding | Name-value parameter map | No runtime value | Notebook parameter handling | Notebook runs with wrong date, path, or environment |
| Dynamic expression | Runtime value resolution | Supported expression language | Literal value | Activity metadata and parameter scope | Hardcoded or invalid expression breaks run |
| Dependency condition | Success, failure, completion, skipped paths | Activity outcome states | No explicit branch | Upstream activity output | Invalid data is written after failed validation |
Use Fabric pipeline run history, activity input/output panes, notebook run status, Dataflow Gen2 refresh history, and trigger state as evidence.
A trigger creates a pipeline run. The pipeline runtime resolves parameters and dynamic expressions, then schedules activities according to dependency conditions. When the notebook activity starts, it receives runtime values instead of hardcoded constants. Validation output determines whether downstream activities execute. A wrong parameter binding breaks the chain at activity start; a missing dependency condition lets downstream writes run even when upstream validation failed.
| Task | Precise Command or Path | Verification Standard |
|---|---|---|
| Validate trigger state | Fabric portal > Pipeline > Triggers | Trigger is enabled and matches required schedule or event |
| Validate parameter binding | Fabric portal > Pipeline activity > Settings > Parameters | Parameter names match the called item requirements |
| Validate dependency path | Fabric portal > Pipeline canvas dependency conditions | Downstream activity runs only on intended status |
| Validate execution evidence | Fabric portal > Pipeline > Run history > Activity output | Each activity shows expected input, output, and status |
When several Fabric notebooks in the same workspace keep using inconsistent Spark runtime settings, what should be checked first?
Check and configure the Spark workspace settings before editing each notebook.
Workspace-level Spark settings define shared runtime defaults for notebooks and Spark workloads in that workspace. If the same behavior affects multiple items, the controlling object is usually the workspace setting, not repeated item-level code changes. This is a common DP-700 scenario because it tests whether the data engineer can identify the lowest shared configuration scope.
Demand Score: 91
Exam Relevance Score: 96
How should a team support reviewed changes and controlled promotion from development to production in Microsoft Fabric?
Use Git integration for reviewable source changes and deployment pipelines for stage promotion.
Git integration provides history, branch-based review, and traceability for supported Fabric items. Deployment pipelines move tested content between stages such as development, test, and production. The two features solve different parts of lifecycle management, so using only one of them does not fully satisfy a controlled release requirement.
Demand Score: 90
Exam Relevance Score: 97
What is the safest access-control approach when users need to query a Fabric item but must not see every row or sensitive column?
Keep the required item access and apply fine-grained controls such as row-level security, column-level security, object-level security, folder or file permissions, or dynamic data masking.
Workspace roles and item permissions decide whether users can reach a workspace or artifact, but fine-grained controls shape what authorized users can see inside the data. Removing broad workspace access may break legitimate work, while labels or endorsement do not enforce query-time filtering. DP-700 frequently tests this distinction between access, data shaping, classification, trust, and audit evidence.
Demand Score: 93
Exam Relevance Score: 98
When should sensitivity labels be used instead of workspace roles or row-level security?
Use sensitivity labels when the requirement is classification, protection metadata, or compliance marking rather than direct access enforcement.
Sensitivity labels help identify and govern protected data, but they are not a replacement for granting or restricting workspace, item, row, column, or object access. In exam scenarios, labels are correct when the stem asks for classification or compliance visibility. If the stem asks who can access data or what values they can see, an access or data-protection control is usually required.
Demand Score: 84
Exam Relevance Score: 93
How should a data engineer choose between Dataflows Gen2, a pipeline, and a notebook for orchestration?
Use Dataflows Gen2 for low-code data preparation, pipelines for scheduled or dependency-based orchestration, and notebooks for code-driven transformations or custom logic.
Each Fabric workload owns a different part of the orchestration decision. Dataflows Gen2 are suitable when the main task is visual data transformation. Pipelines are better when the process needs dependencies, schedules, event-based triggers, parameters, and dynamic expressions. Notebooks are appropriate when the transformation requires Spark code, reusable functions, or custom processing.
Demand Score: 92
Exam Relevance Score: 96
Why are audit logs important in a Fabric governance scenario?
Audit logs provide evidence of user, item, administrative, and access-related activity for investigation and compliance.
Audit logs answer questions about what happened, who performed an action, and when the activity occurred. They do not replace permission controls, masking, labels, or endorsement, but they are the correct tool when the requirement is investigation or evidence. DP-700 exam stems often separate enforcement requirements from proof and monitoring requirements.
Demand Score: 87
Exam Relevance Score: 94