You must rekey encrypted sensitive credential data In your database. You run the command alter database dictionary rekey credentials. Which three options ate true about the bkkey process?

The correct answer is B. The credential data encryption process does not de-obfuscate the obfuscated passwords before F. The rekey process only applies to the sys.ltnks CREDENTUIALS table. G. The rekey process only applies to the SYS.SCHEDULES$ credential table. B, F, and G are correct because the ALTER DATABASE DICTIONARY REKEY CREDENTIALS command specifically targets two distinct tables - the SYS.LINK$ (database link credentials) and SYS.SCHEDULER$_CREDENTIAL tables - and during that process, any already-obfuscated passwords remain…

Implementing Encryption

Question

Options

ACredential Data Is automatically encrypted using aes2S6.
BThe credential data encryption process does not de-obfuscate the obfuscated passwords before
CBoth sys. links and sys . SCHEDULER_CREDENTIAL tables are rekeyed.
DThe rekey process prompts the user to provide a new key algorithm If needed.
EThe process of rekeylng does not automatically open the keystore.
FThe rekey process only applies to the sys.ltnks CREDENTUIALS table.
GThe rekey process only applies to the SYS.SCHEDULES$ credential table.

How the community answered

(28 responses)

A
11% (3)
B
82% (23)
D
4% (1)
E
4% (1)

Explanation

B, F, and G are correct because the ALTER DATABASE DICTIONARY REKEY CREDENTIALS command specifically targets two distinct tables - the SYS.LINK$ (database link credentials) and SYS.SCHEDULER$_CREDENTIAL tables - and during that process, any already-obfuscated passwords remain obfuscated; the engine does not de-obfuscate them prior to rekeying, preserving the existing obfuscation layer.

Why the distractors are wrong:

A is incorrect - the credential data is encrypted using the existing TDE master key algorithm (not automatically forced to AES-256 as a new choice).
C is incorrect - while both tables are rekeyed, the specific table names cited in C don't match the actual internal table names, making it a trap for candidates who know the concept but miss the exact naming.
D is incorrect - the rekey process does not interactively prompt for a new algorithm; it uses the current keystore configuration.
E is incorrect - the keystore must already be open before running the command; the process does not auto-open it, but E's phrasing flips causality (the requirement is on the user to open it beforehand).

Memory tip: Think "BFG = Be Focused on the Granular" - B reminds you obfuscation is preserved (not stripped), and F/G remind you there are exactly two granular table targets, not a catch-all. If an option says "both" with wrong names or promises automation (auto-open, auto-prompt), it's a distractor.

Topics

#credential encryption#database rekeying#encryption algorithms#credential tables

Community Discussion

No community discussion yet for this question.

Full 1Z0-116 Practice