Which two statements are true about column-level transparent data encryption?

Question

Options

• AIt can bo used for tables in encrypted tablcspaces.
• Bencrypted columns cannot have an Index.
• CAll encrypted columns of a table use the same encryption key.
• DColumn level encrypted data remains encrypted in the buffer cache.
• EColumn-level encryption keys are not encrypted by the master key.

• A
  13% (5)
• B
  8% (3)
• C
  28% (11)
• D
  51% (20)

Explanation

D is correct because column-level TDE encrypts and decrypts data at the SQL layer, meaning the data stays encrypted while residing in the buffer cache - unlike tablespace-level TDE, where decryption happens at the I/O layer and the buffer cache holds plaintext.

E is correct because column-level encryption keys have their own protection model: they are stored in the encrypted data dictionary using a key derived independently from the standard tablespace master key hierarchy. This is a key architectural difference from tablespace TDE, which uses a direct master key → data key chain.

Why the distractors are wrong:

• A - Column-level encryption and tablespace-level encryption are mutually exclusive; you cannot apply column encryption to tables already residing in an encrypted tablespace.
• B - Indexes are permitted on TDE-encrypted columns; Oracle supports equality-based lookups on them (range scans are limited, but indexes themselves are allowed).
• C - Each column gets its own independent encryption key; columns within the same table can even use different algorithms and keys.

Memory tip: Think of column-level TDE as "encryption that never lets its guard down" - the data stays encrypted all the way up to the buffer cache (D), and the keys are self-managed rather than handed off to the master key (E).

No community discussion yet for this question.