Which two are true about Lockdown profiles in a container database (CDB) and its pluggable databases (PDBs)?

Question

Options

• AA Lockdown profile created from a base Lockdown profile is always automatically modified if
• BA PDB Lockdown profile can be created in an application root.
• CA Lockdown profile created from a base Lockdown profile is never automatically modified if the
• DA PDB Lockdown profile can be created in a regular PDB.
• EA PDB Lockdown profile can be created in CDB$ROOT .

• A
  16% (7)
• B
  70% (30)
• C
  9% (4)
• D
  5% (2)

Explanation

Options B and E are correct because Lockdown profiles in a multitenant architecture can only be created at a "root" container level - specifically in CDB$ROOT (E) or in an Application Root (B), since an Application Root acts as a mini-CDB governing its own set of application PDBs.

Option D is wrong because a regular PDB has no authority to create Lockdown profiles - it can only have a profile applied to it, not create one. Profile creation is a privileged operation reserved for root containers.

Options A and C are both truncated in this question, but both address the behavior of derived Lockdown profiles (created using the INCLUDING base_profile clause). Oracle documentation is clear: changes made to a base profile after derivation are not automatically propagated to the derived profile - they are independent after creation. Whichever of A/C claims automatic propagation occurs is false, and the other likely contains a subtle condition that makes it equally incorrect.

Memory tip: Think "Roots create, PDBs consume." Only the two types of "root" containers (CDB$ROOT and Application Root) can create Lockdown profiles - regular PDBs only receive them. This maps directly to the CDB privilege model where roots control security policy for their children.

No community discussion yet for this question.