Microsoft Fabric Data Engineer Associate DP-700 Practice Question

In Microsoft Fabric, each Lakehouse is stored in OneLake, which is backed by Azure Data Lake Storage Gen2. You can protect individual folders or files by setting POSIX-style access control lists (ACLs) on the underlying ADLS Gen2 path. Removing (or denying) the Read and Execute permissions for the data-engineering group on the /finance folder prevents the users from listing or opening anything under that path, while their Member role on the workspace continues to let them work in other parts of the Lakehouse.

Denying the Build permission applies at the item level and would block all interaction with the Lakehouse. Dynamic data masking and row-level security apply only to tables exposed through the SQL endpoint and do not restrict file access. Creating a separate Lakehouse and moving data there would change the workspace structure rather than directly enforcing folder-level permissions, and it would still require ACLs or item-level security for isolation.