1Z0-052 · Question #138
The user HR owns the EMP table. The user HR grants privileges to the user SCOTT by using this command: Which statement is true after HR issues the REVOKE command?
The correct answer is C. The command fails because HR cannot revoke the privileges from JIM. In Oracle, a grantor can only revoke privileges they directly granted. HR cannot revoke a privilege from JIM if JIM received that privilege from SCOTT, not from HR.
Question
The user HR owns the EMP table. The user HR grants privileges to the user SCOTT by using this command:
Which statement is true after HR issues the REVOKE command?
Exhibit
Options
- AThe command fails because SCOTT still has privileges.
- BThe command succeeds and privileges are revoked from JIM.
- CThe command fails because HR cannot revoke the privileges from JIM.
- DThe command succeeds and only HR has the privilege to perform the SELECT, INSERT, and
How the community answered
(43 responses)- A12% (5)
- B5% (2)
- C81% (35)
- D2% (1)
Why each option
In Oracle, a grantor can only revoke privileges they directly granted. HR cannot revoke a privilege from JIM if JIM received that privilege from SCOTT, not from HR.
The command does not fail because SCOTT still holds privileges; whether SCOTT retains a privilege is unrelated to whether HR can revoke it from a third party like JIM.
The command does not succeed because HR lacks the authority to revoke a privilege it did not directly grant to JIM; Oracle does not allow indirect revocation.
Oracle enforces that a privilege can only be revoked by the user who directly granted it. If HR granted privileges to SCOTT WITH GRANT OPTION, and SCOTT subsequently granted those privileges to JIM, then only SCOTT can revoke from JIM. HR's REVOKE command targeting JIM fails because HR was not the direct grantor to JIM.
The command does not succeed at all, so the outcome of only HR retaining the privilege is impossible; the revoke fails before any privilege change occurs.
Concept tested: Oracle privilege revocation and grantor restriction
Source: https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/configuring-privilege-and-role-authorization.html
Topics
Community Discussion
No community discussion yet for this question.
