nerdexam
Oracle

1Z0-052 · Question #138

The user HR owns the EMP table. The user HR grants privileges to the user SCOTT by using this command: Which statement is true after HR issues the REVOKE command?

The correct answer is C. The command fails because HR cannot revoke the privileges from JIM. In Oracle, a grantor can only revoke privileges they directly granted. HR cannot revoke a privilege from JIM if JIM received that privilege from SCOTT, not from HR.

Administering User Security

Question

The user HR owns the EMP table. The user HR grants privileges to the user SCOTT by using this command:

Which statement is true after HR issues the REVOKE command?

Exhibit

1Z0-052 question #138 exhibit

Options

  • AThe command fails because SCOTT still has privileges.
  • BThe command succeeds and privileges are revoked from JIM.
  • CThe command fails because HR cannot revoke the privileges from JIM.
  • DThe command succeeds and only HR has the privilege to perform the SELECT, INSERT, and

How the community answered

(43 responses)
  • A
    12% (5)
  • B
    5% (2)
  • C
    81% (35)
  • D
    2% (1)

Why each option

In Oracle, a grantor can only revoke privileges they directly granted. HR cannot revoke a privilege from JIM if JIM received that privilege from SCOTT, not from HR.

AThe command fails because SCOTT still has privileges.

The command does not fail because SCOTT still holds privileges; whether SCOTT retains a privilege is unrelated to whether HR can revoke it from a third party like JIM.

BThe command succeeds and privileges are revoked from JIM.

The command does not succeed because HR lacks the authority to revoke a privilege it did not directly grant to JIM; Oracle does not allow indirect revocation.

CThe command fails because HR cannot revoke the privileges from JIM.Correct

Oracle enforces that a privilege can only be revoked by the user who directly granted it. If HR granted privileges to SCOTT WITH GRANT OPTION, and SCOTT subsequently granted those privileges to JIM, then only SCOTT can revoke from JIM. HR's REVOKE command targeting JIM fails because HR was not the direct grantor to JIM.

DThe command succeeds and only HR has the privilege to perform the SELECT, INSERT, and

The command does not succeed at all, so the outcome of only HR retaining the privilege is impossible; the revoke fails before any privilege change occurs.

Concept tested: Oracle privilege revocation and grantor restriction

Source: https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/configuring-privilege-and-role-authorization.html

Topics

#REVOKE#WITH GRANT OPTION#privilege chain#object privileges

Community Discussion

No community discussion yet for this question.

Full 1Z0-052 Practice