Which three statements are true about the keystore storage framework for transparent data encryption?

Question

Options

• AIt facilitates and helps to enforce keystore backup requirements.
• BIt handles encrypted data without modifying applications.
• CIt enables a keystore to be stored only in a file on a file system.
• DIt enables separation of duties between the database administrator and the security
• EIt transparently decrypts data for the database users and applications that access this data.
• FIt helps to track encryption keys and implement requirements such as keystore password

• A
  80% (20)
• B
  4% (1)
• C
  4% (1)
• E
  12% (3)

Explanation

Oracle's keystore storage framework is specifically a key management layer within TDE - it governs how encryption keys are stored, tracked, backed up, and who controls them. Options A, D, and F are correct because the framework explicitly handles keystore backup enforcement (A), separates the security administrator's role from the DBA's role so no single person controls both data and keys (D), and tracks encryption keys while implementing operational requirements like password management policies (F).

Why the distractors are wrong:

• B describes TDE as a whole - transparent handling of encrypted data without app changes is what TDE does, not a function of the keystore storage framework specifically.
• C is wrong because of the word "only" - Oracle keystores can be stored in multiple locations, including Oracle Key Vault, not just a file on a file system.
• E again describes TDE's core encryption/decryption behavior, not the keystore framework; the framework manages keys, not the decrypt-on-access operation.

Memory tip: Think of the keystore storage framework as the "key custodian" - its job is administrative (backup, tracking, access control, password requirements). If an answer describes the actual encrypt/decrypt process (B, E), that's TDE itself - not the framework.

No community discussion yet for this question.