Which three are true concerning command rules?

Question

Options

• ASystem privileges override command rules.
• BIf a command rule's associated rule set evaluation results In an error, the command is not allowed
• CA command can have only one command rule that applies to it.
• DFor DML statement command rules, you can specify a wildcard for the object owner.
• EIf a command rule's associated rule set Is disabled, then the rule set evaluates to true.
• FFor DML statement command rules, you can specify a wildcard for the object name.
• GObject privileges override command rules.

• A
  75% (21)
• B
  14% (4)
• E
  7% (2)
• G
  4% (1)

Explanation

A is correct because system-level privileges (e.g., SYSDBA, DBA role) sit above the command rule layer in Oracle Database Vault's enforcement hierarchy - privileged accounts bypass command rule restrictions. D and F are correct because DML command rules support wildcards (%) for both the object owner and the object name, letting a single rule cover DML operations across all schemas or all tables without creating individual rules for each.

The distractors fail as follows: B is wrong - a rule set evaluation error causes the command to be allowed (fail-open), not blocked. C is wrong - multiple command rules can apply to the same command simultaneously. E is wrong - a disabled rule set evaluates to false, blocking the command, not true. G is wrong - object-level privileges (SELECT, INSERT, etc.) do not override command rules; only system privileges do (the distinction tested by A vs. G).

Memory tip: For DML rules, "both the Owner and the Name take wildcards" (D and F). For privileges, remember the hierarchy: System beats command rules, Object does not - system is top-tier, object is not.

No community discussion yet for this question.