1Z0-060 · Question #105
You created an encrypted tablespace: You then closed the encryption wallet because you were advised that this is secure. Later in the day, you attempt to create the EMPLOYEES table in the…
The correct answer is B. It generates an error when creating the table because the wallet is closed. This question tests understanding that Oracle TDE requires an open encryption wallet (keystore) before any encryption-related DDL operations can succeed.
Question
You created an encrypted tablespace:
You then closed the encryption wallet because you were advised that this is secure. Later in the day, you attempt to create the EMPLOYEES table in the SECURESPACE tablespace with the SALT option on the EMPLOYEE column. Which is true about the result?
Exhibit
Options
- AIt creates the table successfully but does not encrypt any inserted data in the EMPNAME column
- BIt generates an error when creating the table because the wallet is closed.
- CIt creates the table successfully, and encrypts any inserted data in the EMPNAME column because
- DIt generates error when creating the table, because the salt option cannot be used with encrypted
How the community answered
(27 responses)- A4% (1)
- B78% (21)
- C15% (4)
- D4% (1)
Why each option
This question tests understanding that Oracle TDE requires an open encryption wallet (keystore) before any encryption-related DDL operations can succeed.
Oracle does not silently bypass encryption when the wallet is closed - it raises a hard error because the master key required to protect the data is unavailable.
When the Oracle TDE software keystore is closed, the master encryption key is inaccessible, so the database cannot process any encryption operations including creating tables with encrypted columns in an encrypted tablespace. Oracle raises an ORA-28365 'wallet is not open' error at the time of the CREATE TABLE statement, because the key needed to initialize column-level encryption with SALT cannot be retrieved.
The table cannot be created successfully when the wallet is closed regardless of the tablespace's encryption settings, since key access is required at DDL time.
The SALT option is a valid and fully supported modifier for column-level TDE encryption in Oracle; it adds a random value before hashing to prevent dictionary attacks and is not the source of any error.
Concept tested: Oracle TDE keystore open requirement for encrypted DDL
Source: https://docs.oracle.com/database/121/ASOAG/asopart1.htm
Topics
Community Discussion
No community discussion yet for this question.