Which two are true about backup encryption?

Question

Options

• AThe Transparent Data Encryption (TDE) keystore is backed up using RMAN.
• BVendor-specific media management software can be used for making encrypted RMAN
• CThe BACKUP BACKUPSET command can encrypt and decrypt backup sets.
• DImage copies can be encrypted.
• EKeystore-based encryption is the default mode for RMAN backup encryption.
• FBackup encryption can be enabled selectively for specific tablespaces.

• A
  6% (4)
• B
  2% (1)
• C
  79% (52)
• D
  3% (2)
• F
  11% (7)

Explanation

C is correct because BACKUP BACKUPSET is unique among RMAN commands in that it can re-encrypt an existing backup set (or strip encryption from it), giving you the ability to change encryption status on already-created backup sets - a capability not available with standard BACKUP commands.

E is correct because when RMAN backup encryption is enabled without explicitly specifying a mode, it defaults to transparent (keystore/wallet-based) encryption - the other two modes (password and dual) must be explicitly configured.

The distractors fail for these reasons:

• A is wrong - the TDE keystore/wallet must be backed up outside RMAN using OS-level commands; RMAN cannot back it up.
• B is wrong - vendor media management software is used for transporting backups to tape, not for performing RMAN-level encryption.
• D is wrong - only backup sets can be encrypted; image copies are direct block-for-block copies of datafiles and cannot be encrypted by RMAN.
• F is wrong - RMAN backup encryption applies to the backup set as a whole, not selectively to individual tablespaces within it.

Memory tip: Think "Copy Encrypts" - the BACKUP BACKUPSET Command re-Encrypts, and the Encryption default is Encryption via the wallet (keystore). Image copies are plain "photocopies" - they can't wear a disguise (encryption).

No community discussion yet for this question.