1Z0-028 · Question #64
Which two roles should be revoked from self-service portal user roles to confine them to the self- portal pages in Enterprise Manager Cloud Control 12c?
The correct answer is A. EM_USER D. PUBLIC. Revoke PUBLIC and EM_USER roles from SSA users to confine them to the SSA Portal pages.
Question
Which two roles should be revoked from self-service portal user roles to confine them to the self- portal pages in Enterprise Manager Cloud Control 12c?
Options
- AEM_USER
- BEM_SSA_USER
- CDBAAS_USER
- DPUBLIC
- EMWAAS_USER
- FIAAS_USER
How the community answered
(32 responses)- A75% (24)
- B16% (5)
- C6% (2)
- E3% (1)
Explanation
Revoke PUBLIC and EM_USER roles from SSA users to confine them to the SSA Portal pages.
Topics
Community Discussion
5
Ingrid P.Jun 27, 2026The correct answers are A and D. Revoking EM_USER removes the general Enterprise Manager console access that would let users roam outside the portal, and revoking PUBLIC cuts the default Oracle grant that otherwise gives broad visibility into the environment. Card this as a two-part fact: confine SSA users equals strip EM_USER plus PUBLIC, because those two together are what open the door to the full console.
Samuel O.Jun 19, 2026Yeah, A and D is right, and it makes sense once you think about it from an access control standpoint. EM_USER gives access to the full Cloud Control console beyond the SSA portal, and PUBLIC is a catch-all Oracle role that opens doors you definitely do not want a self-service tenant walking through.
Ola B.Jun 21, 2026Spot on about PUBLIC, and if anyone wants to see exactly how wide that door swings, spin up an Oracle 19c sandbox, grant a test privilege to PUBLIC, then log in with a freshly created account that has zero explicit grants and watch it just work, which usually settles the debate fast.
Ola B.Jun 27, 2026Yep, A and D are the ones to pull, because EM_USER grants broad Cloud Control console access and PUBLIC carries default system-wide privileges, so leaving either in place lets SSA users wander well outside the self-service portal. Spin up a 12c lab, assign those roles, and watch the nav menu explode with tabs that SSA users have no business seeing.
Lena V.Jun 27, 2026Thought EM_SSA_USER first, but EM_USER and PUBLIC grant console access outside the portal.