Which two commands can a user with the syskm privilege execute?

Question

Options

• AALTER DATABASE DICTIONARY REKEY CREDENTIALS;
• BSELECT * FROM DBA_OBJECTS;
• CSELECT * FROM DBA_TABLESPACES WHERE ENCRYPTED = 'YES*;
• DADMINISTER KEY MANAGEMENT SET KFYSTOBF OPEN IDENTIFIED BY password:
• EALTER SYSTEM FLUSH PASSWORDFILE_METADATA_CACHE;
• FALTER TABLESPACE APPDATA ENCRYPTION OFFLINE ENCRYPT;

• A
  2% (1)
• B
  82% (51)
• D
  10% (6)
• E
  2% (1)
• F
  5% (3)

Explanation

There appears to be an error in the provided answer key. Based on Oracle Database documentation, B and C are not the correct answers for a user with the SYSKM privilege. The correct answers should be A and F.

Why A and F are correct: The SYSKM administrative privilege (introduced in Oracle 12.2) is a least-privilege role purpose-built for Transparent Data Encryption (TDE) administration. It grants only encryption-related operations: ALTER DATABASE DICTIONARY REKEY CREDENTIALS (option A) and ALTER TABLESPACE ... ENCRYPTION OFFLINE ENCRYPT (option F) are both valid TDE operations within its scope.

Why the others are wrong:

• B (SELECT * FROM DBA_OBJECTS) and C (SELECT * FROM DBA_TABLESPACES) require DBA or an explicit SELECT grant - SYSKM does not grant general data dictionary access.
• D contains a deliberate typo (KFYSTOBF instead of KEYSTORE), making it syntactically invalid - even though ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN is exactly the kind of command SYSKM is meant for.
• E (ALTER SYSTEM FLUSH PASSWORDFILE_METADATA_CACHE) requires SYSDBA or SYSOPER, not SYSKM.

Memory tip: Think of SYSKM = Key Management only. It can touch encryption (tablespaces, credentials, keystores) but cannot read general DBA views or touch the system layer. If the command isn't about encrypting or managing keys, SYSKM can't do it.

No community discussion yet for this question.