Microsoft Fabric Data Engineer Associate DP-700 Practice Question

Folder- and file-level permissions in OneLake are enforced through Access Control Lists (ACLs). Because the Sales-Analysts group already has Contributor rights at the workspace level, they inherit read/write access to every object in the Lakehouse. You can override this inheritance by opening the Access pane for the /HR folder and removing the group's default Lakehouse permissions (or explicitly denying Read and Execute). This prevents the users from opening or querying anything in /HR while leaving their existing rights on /Sales unchanged. Changing the workspace role would reduce their ability to manage objects in /Sales. Row-level security and dynamic data masking operate at the table level after data is loaded and do not prevent users from listing or downloading the underlying files. Moving the folder to a separate Lakehouse is unnecessary because fine-grained ACLs already provide the required isolation.