For which two are Oracle Label Security policies not applied?

The correct answer is A. partitioned tables D. objects in the SYS schema. Oracle Label Security (OLS) has two hard-coded exceptions: it cannot be applied to objects owned by SYS (D) because SYS owns the core data dictionary, and applying label filters there would risk corrupting internal database operations; and it cannot be applied to partitioned…

Implementing Data Protection

Question

Options

Apartitioned tables
Bdirect path exports
Cusers with the SYSDA privilege other than sys
Dobjects in the SYS schema
Econventional path exports

How the community answered

(20 responses)

A
90% (18)
B
5% (1)
C
5% (1)

Explanation

Oracle Label Security (OLS) has two hard-coded exceptions: it cannot be applied to objects owned by SYS (D) because SYS owns the core data dictionary, and applying label filters there would risk corrupting internal database operations; and it cannot be applied to partitioned tables (A) due to the way OLS enforces row-level access via a hidden label column - partition exchange and direct-loading operations can bypass this mechanism, so Oracle excludes partitioned objects from OLS coverage.

The distractors are wrong for these reasons: direct path exports (B) still respect OLS label filters - only rows within the exporter's clearance are extracted; users with SYSDBA other than SYS (C) are still subject to OLS unless explicitly granted the EXEMPT ACCESS POLICY privilege (SYSDBA alone is not a bypass); and conventional path exports (E) route through the standard SQL layer, so OLS row filters apply just as they do for any SELECT query.

Memory tip: Think "SYS and Segments get a skip" - the SYS schema (D) and physically segmented/partitioned tables (A) are the two structures OLS leaves untouched.

Topics

#Oracle Label Security#OLS policy scope#SYS schema#partitioned tables

Community Discussion

No community discussion yet for this question.

Full 1Z0-116 Practice