Which three are true about Transparent Data Encryption (TDE)?

Question

Options

• AIt uses a single master key for a database.
• BIt replaces secure application roles.
• CIt encrypts only data on the client.
• DIt stores the current and all past master keys in the keystore.
• EMaster encryption keys are managed by Oracle Database Vault.
• FIt can encrypt data at the column level.

• A
  5% (1)
• B
  5% (1)
• C
  14% (3)
• D
  77% (17)

Explanation

D is correct because Oracle TDE maintains a keystore (Oracle Wallet or Oracle Key Vault) that retains not just the current master encryption key but also all historical keys - this ensures previously encrypted data remains decryptable after key rotation.

E is correct because Oracle Database Vault provides privileged-user access controls and can manage TDE master encryption keys as part of its separation-of-duties model, preventing even DBAs from bypassing encryption controls without proper authorization.

F is correct because TDE supports two granularities: tablespace-level encryption (encrypts the entire tablespace) and column-level encryption (encrypts individual sensitive columns like SSN or credit card numbers).

A is wrong because a database can have multiple master keys across its lifecycle (key rotation creates new ones, while old keys are retained in the keystore - directly contradicting A's "single master key" claim). B is wrong because TDE is encryption-at-rest, not an access control mechanism; it has nothing to do with application roles. C is wrong because TDE encrypts data server-side on disk/storage, not on the client.

Memory tip: Think of TDE as a storage-level vault - it locks data on disk (not the client), keeps all copies of the keys in the keystore, and works at either the column or tablespace level. Database Vault is the gatekeeper for those keys.

No community discussion yet for this question.