Question 160
A Fabric security team designs access for cross-domain collaborations. The current environment exhibits the following problem: team owners expect domain assignment to block users from unrelated departments. Which step preserves the intended data behavior?
Explanation
Correct Answer
Enforce actual workspace/item/data security instead of relying on domain grouping. Domain catalog organization is not an access-deny boundary.
Incorrect Answers
A Lakehouse folder needs shared read access but an adjacent restricted directory must remain private. Folder permissions inherit within the approved subtree, not every sibling.
A SQL reader with one schema grant can access a table unexpectedly through another role. Authorization is cumulative across multiple principals.
A finance team is granted full workspace Contributor merely to read one table. Least privilege avoids exposing unrelated items and write operations.