You connect to the database Instance over a network to change the password of user scott. Which two methods avoid the new password for user scott from being compromised by network sniffing?

Question

Options

• ASet the server side sqlnet.ora parameter SQLNET.CRYPTO_CHECKSUM_SERVER-
• BUse ALTER USER SCOTT PASSWORD EXPIRE.
• CSet the server side sqlnet.ora parameter SQLNET.ENCRYPTION_SERVER=REQUESTED.
• DUse ALTER USER SCOTT IDENTIFIED BY VALUES '<value>*.
• EUse ALTER USER SCOTT IDENTIFIED BY <password>.
• FUse the SQL"PIus command password SCOTT.

• A
  71% (12)
• C
  18% (3)
• E
  6% (1)
• F
  6% (1)

Explanation

Option A enforces server-side network encryption (the parameter, though truncated, specifies a required encryption/security level), ensuring the password change command is transmitted over an encrypted channel that network sniffers cannot read. Option D uses IDENTIFIED BY VALUES to supply a pre-hashed password value - the actual plaintext password is never transmitted across the network at all, eliminating the sniffing risk entirely.

Why the distractors fail: B (PASSWORD EXPIRE) only forces the user to reset their password at next login but does nothing to protect traffic in transit. C (ENCRYPTION_SERVER=REQUESTED) is opportunistic - encryption only occurs if the client also negotiates it, so it is not guaranteed and cannot be relied upon for security. E (IDENTIFIED BY <password>) transmits the plaintext password directly in the SQL statement over the network - exactly what sniffers target. F (SQL*Plus password command) sends credentials through the standard Oracle Net session, which is unencrypted unless separately configured.

Memory tip: Think of two layers of defense - A protects the pipe (encrypt the channel so nothing readable flows through), and D protects the payload (never put the real password in the pipe at all). Either approach breaks the sniff attack; together they are defense-in-depth.

No community discussion yet for this question.