nerdexam
Oracle

1Z0-052 · Question #8

View the Exhibit and examine the privileges granted to the MGR_ROLE role. The user SKD has been granted the CONNECT and RESOURCE roles only. The database administrator (DBA) grants MGR_ROLE to the…

The correct answer is A. The user SKD can grant only the MGR_ROLE role to other users, but not the privileges in it. GRANT ROLE WITH ADMIN OPTION lets the grantee re-grant that role to others, but does not transfer the ability to independently grant the individual system privileges contained inside the role.

Administering User Security

Question

View the Exhibit and examine the privileges granted to the MGR_ROLE role. The user SKD has been granted the CONNECT and RESOURCE roles only. The database administrator (DBA) grants MGR_ROLE to the user SKD by executing the command:

SQL> GRANT MGR_ROLE TO SKD WITH ADMIN OPTION; Which statement is true about the user SKD after he/she is granted this role?

Exhibit

1Z0-052 question #8 exhibit

Options

  • AThe user SKD can grant only the MGR_ROLE role to other users, but not the privileges in it
  • BThe user SKD can revoke the MGR_ROLE only from the users for whom he/she is the grantor
  • CThe user SKD can grant the privileges in the MGR_ROLE role to other users but not with ADMIN OPTION
  • DThe user SKD can grant the privileges in the MGR_ROLE role to other users, but cannot revoke privileges

How the community answered

(60 responses)
  • A
    73% (44)
  • B
    17% (10)
  • C
    7% (4)
  • D
    3% (2)

Why each option

GRANT ROLE WITH ADMIN OPTION lets the grantee re-grant that role to others, but does not transfer the ability to independently grant the individual system privileges contained inside the role.

AThe user SKD can grant only the MGR_ROLE role to other users, but not the privileges in itCorrect

WITH ADMIN OPTION on a role grant authorizes SKD to grant MGR_ROLE itself to other users or roles, but the underlying system privileges packaged inside MGR_ROLE can only be granted by users who hold those privileges directly - SKD does not inherit that ability simply by receiving the role with admin option.

BThe user SKD can revoke the MGR_ROLE only from the users for whom he/she is the grantor

WITH ADMIN OPTION allows the holder to revoke that role from any user in the database, not only from users to whom the holder personally granted it - there is no such grantor restriction for roles.

CThe user SKD can grant the privileges in the MGR_ROLE role to other users but not with ADMIN OPTION

SKD cannot separately grant the individual privileges that exist inside MGR_ROLE because those privileges are part of the role definition, and SKD does not hold them as direct system privileges.

DThe user SKD can grant the privileges in the MGR_ROLE role to other users, but cannot revoke privileges

SKD can revoke MGR_ROLE from other users because WITH ADMIN OPTION explicitly includes the right to both grant and revoke the role from any grantee in the database.

Concept tested: Oracle GRANT role WITH ADMIN OPTION behavior and limitations

Source: https://docs.oracle.com/en/database/oracle/oracle-database/19/sqlrf/GRANT.html

Topics

#role management#ADMIN OPTION#privilege propagation#GRANT

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 1Z0-052 Practice