1Z0-006 Security Management 4 — Questions and Answers
Question 1: Which Oracle feature encrypts entire tablespaces transparently without requiring application changes?
- Oracle Advanced Security TDE (Transparent Data Encryption) (Correct answer)
- Virtual Private Database
- Oracle Database Vault
- Label Security
Correct answer: Oracle Advanced Security TDE (Transparent Data Encryption)
Transparent Data Encryption (TDE) encrypts data at rest at the tablespace or column level without requiring any modifications to existing applications.
Question 2: A DBA wants to prevent the SYS user from accessing sensitive payroll data in a specific schema. Which Oracle feature can enforce this restriction?
- Row-Level Security (VPD)
- Oracle Database Vault (Correct answer)
- Fine-Grained Auditing
- Password Policies
Correct answer: Oracle Database Vault
Oracle Database Vault creates realms that restrict even highly privileged users like SYS from accessing protected application data.
Question 3: What is the minimum number of characters Oracle enforces for passwords when using the default password complexity function?
- 4
- 6
- 8 (Correct answer)
- 12
Correct answer: 8
Oracle's default password verification function (ora12c_strong_password_verify_function) requires a minimum of 8 characters.
Question 4: Which audit trail type stores Oracle audit records in database tables within the AUDSYS schema?
- OS Audit Trail
- Unified Auditing Trail (Correct answer)
- XML Audit Trail
- Standard DB Audit Trail
Correct answer: Unified Auditing Trail
Unified Auditing, introduced in Oracle 12c, writes all audit records to the UNIFIED_AUDIT_TRAIL view stored in the AUDSYS schema.
Question 5: Which type of Oracle role is automatically enabled when a user logs in, without needing SET ROLE?
- Secure application role
- Default role (Correct answer)
- Restricted role
- Session-only role
Correct answer: Default role
Default roles are automatically activated at login, while non-default roles must be explicitly enabled during the session with SET ROLE.
Question 6: What does the CONNECT role provide in modern Oracle Database versions?
- Full DBA-level access to all objects
- Only the CREATE SESSION privilege (Correct answer)
- SELECT access to all tables in the database
- SYSDBA and SYSOPER combined
Correct answer: Only the CREATE SESSION privilege
In Oracle 10g and later, the CONNECT role was reduced to only the CREATE SESSION privilege, removing the many object privileges it previously held.
Question 7: An application schema owner should not log in directly. Which account status best enforces this policy?
- EXPIRED
- LOCKED
- OPEN with limited privileges
- EXPIRED & LOCKED (Correct answer)
Correct answer: EXPIRED & LOCKED
Setting an account to EXPIRED & LOCKED prevents direct logins while still allowing the schema to exist and be accessed by other authorized application accounts.
1Z0-006 Security Management 4
Which Oracle feature encrypts entire tablespaces transparently without requiring application changes?