nerdexam
Oracle

1Z0-060 · Question #207

Your multitenant container database (CDB) contains several pluggable databases (PDBs). Users and have only connect privileges. C##A_ADMIN B_ADMIN You create a common role with common privileges…

The correct answer is C. C##_A_ADMIN can create and select any table, and grant the C##_ROLE1 role to users in the E. B_ADMIN can create and select any table in HR_PDB. Granting a common role with CONTAINER=ALL applies it commonly across the root and all PDBs, while a local grant using CONTAINER=CURRENT restricts role privileges to only the PDB where it was granted.

New Features for Security

Question

Your multitenant container database (CDB) contains several pluggable databases (PDBs). Users and have only connect privileges. C##A_ADMIN B_ADMIN You create a common role with common privileges C##_ROLE1 CREATE TABLE and SELECT ANY TABLE. You then execute these commands to grant the role to users in the root container: SQL > GRANT C##_role1 TO c##_a_admin CONTAINER=ALL; Then, SQL> CONN sys/oracle@HR_PDB as sysdba SQL> GRANT c##_role1 TO b_admin CONTAINER=CURRENT; Which two statements are true? (Choose two.)

Options

  • AC##_A_ADMIN can create and select any table in the root container as well as in all current PDBs.
  • BC##_A_ADMIN can create and select any table in the root container as well as in all current and
  • CC##_A_ADMIN can create and select any table, and grant the C##_ROLE1 role to users in the
  • DB_ADMIN can create and select any table, and grant the C##_ROLE1 role to users in HR_PDB.
  • EB_ADMIN can create and select any table in HR_PDB

How the community answered

(21 responses)
  • A
    14% (3)
  • B
    10% (2)
  • C
    43% (9)
  • D
    33% (7)

Why each option

Granting a common role with CONTAINER=ALL applies it commonly across the root and all PDBs, while a local grant using CONTAINER=CURRENT restricts role privileges to only the PDB where it was granted.

AC##_A_ADMIN can create and select any table in the root container as well as in all current PDBs.

This choice incorrectly limits the scope of CONTAINER=ALL to only current PDBs; CONTAINER=ALL applies the role to the root and all PDBs including those plugged in after the grant.

BC##_A_ADMIN can create and select any table in the root container as well as in all current and

This choice appears to omit the root container from the grant scope or contains a factual inaccuracy about how CONTAINER=ALL propagates, making it less precise than choice C.

CC##_A_ADMIN can create and select any table, and grant the C##_ROLE1 role to users in theCorrect

C##_A_ADMIN was granted C##_ROLE1 with CONTAINER=ALL, which applies the role commonly across the root container and every PDB, enabling the CREATE TABLE and SELECT ANY TABLE privileges in all containers, and if the grant included WITH ADMIN OPTION, re-granting is also allowed.

DB_ADMIN can create and select any table, and grant the C##_ROLE1 role to users in HR_PDB.

B_ADMIN was granted C##_ROLE1 locally without WITH ADMIN OPTION, so B_ADMIN cannot re-grant the role to other users even within HR_PDB.

EB_ADMIN can create and select any table in HR_PDBCorrect

B_ADMIN received C##_ROLE1 as a local grant in HR_PDB using CONTAINER=CURRENT, so the role's CREATE TABLE and SELECT ANY TABLE privileges are available to B_ADMIN exclusively within HR_PDB.

Concept tested: Common role grants CONTAINER=ALL vs CONTAINER=CURRENT scope

Source: https://docs.oracle.com/en/database/oracle/oracle-database/12.2/dbseg/configuring-privilege-and-role-authorization.html

Topics

#common roles#CONTAINER=ALL#CDB privilege scope#PDB local user grants

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 1Z0-060 Practice