nerdexam
Oracle

1Z0-052 · Question #190

Some non-DBA users in your database have been granted ANY TABLE system privileges and they are able to access data dictionary base tables. You decide to restrict their access to data dictionary…

The correct answer is E. Set the value of the O7_DICTIONARY_ACCESSIBILITY parameter to FALSE. The O7_DICTIONARY_ACCESSIBILITY initialization parameter controls whether ANY TABLE system privileges extend to SYS-owned data dictionary base tables. Setting it to FALSE blocks that access.

Administering User Security

Question

Some non-DBA users in your database have been granted ANY TABLE system privileges and they are able to access data dictionary base tables. You decide to restrict their access to data dictionary objects. Which method would you adopt to achieve this objective?

Options

  • ARevoke the RESOURCE role from the users.
  • BSet the value of the OS_ROLES parameter to TRUE.
  • CUse Database Resource Manager to restrict user access to objects.
  • DGrant ANY TABLE system privileges again without ADMIN OPTION.
  • ESet the value of the O7_DICTIONARY_ACCESSIBILITY parameter to FALSE.

How the community answered

(50 responses)
  • A
    14% (7)
  • B
    8% (4)
  • C
    4% (2)
  • D
    2% (1)
  • E
    72% (36)

Why each option

The O7_DICTIONARY_ACCESSIBILITY initialization parameter controls whether ANY TABLE system privileges extend to SYS-owned data dictionary base tables. Setting it to FALSE blocks that access.

ARevoke the RESOURCE role from the users.

Revoking the RESOURCE role removes object-creation privileges; it has no bearing on whether ANY TABLE system privileges reach dictionary tables.

BSet the value of the OS_ROLES parameter to TRUE.

OS_ROLES determines whether Oracle retrieves role information from the operating system, which is unrelated to data dictionary access control.

CUse Database Resource Manager to restrict user access to objects.

Database Resource Manager manages CPU, I/O, and session resources; it cannot restrict access to specific schema objects or dictionary tables.

DGrant ANY TABLE system privileges again without ADMIN OPTION.

Re-granting ANY TABLE without ADMIN OPTION only prevents the grantee from further granting the privilege; it does not remove or limit the grantee's own access to dictionary objects.

ESet the value of the O7_DICTIONARY_ACCESSIBILITY parameter to FALSE.Correct

When O7_DICTIONARY_ACCESSIBILITY is set to FALSE (the default in Oracle 10g and later), any privilege granted with the ANY TABLE clause is prevented from applying to data dictionary objects owned by SYS, effectively restricting non-DBA users from querying base tables such as TAB$ or OBJ$ even if they hold, for example, SELECT ANY TABLE.

Concept tested: O7_DICTIONARY_ACCESSIBILITY parameter and data dictionary security

Source: https://docs.oracle.com/en/database/oracle/oracle-database/19/refrn/O7_DICTIONARY_ACCESSIBILITY.html

Topics

#O7_DICTIONARY_ACCESSIBILITY#data dictionary access#ANY TABLE privilege#dictionary security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 1Z0-052 Practice