Which two statements are true about the working of system privileges in a multitenant control database (CDB) that has pluggable databases (PDBs)?

Common system privileges granted with CONTAINER=ALL propagate to all PDBs in the CDB, not just the local PDB where the grant was issued.

Local users can exercise locally granted system privileges on objects within their own PDB, including schemas owned by common users that reside in that same PDB.

To grant system privileges with CONTAINER=ALL (scoped to the root and all PDBs), the grantor must hold the SET CONTAINER privilege, which is a hard prerequisite for performing any common grant across the multitenant architecture.

Common users cannot exercise privileges from one PDB against objects in a different PDB without explicitly using SET CONTAINER to switch containers first; cross-PDB privilege exercise is not automatic.

The CONTAINER=ALL clause is restricted exclusively to grants targeting common users - it cannot be applied to local users - ensuring that privileges spanning all containers are only assigned to identities that exist CDB-wide.