Which two are true about Database Privilege Analysis?

Question

Options

• AIt can be used after you install the Oracle Database without any additional database configuration
• BIt must have the Database Vault option enabled.
• CPrivilege analysis data for dropped objects are kept.
• DIf a privilege is captured during run time, it is saved under the run-time capture name.
• EIt shows the grant paths to the privileges and suggests which grant path to keep.
• FIt cannot be used to capture the privileges that have been exercised on precompiled database

• A
  71% (17)
• B
  8% (2)
• C
  4% (1)
• D
  17% (4)

Explanation

Oracle Database Privilege Analysis is a built-in Enterprise Edition feature that records which privileges are actually used at runtime, helping DBAs enforce least privilege.

Why A is correct: Privilege Analysis requires no extra configuration or additional licensed options after a standard Oracle Database installation - it is ready to use via the DBMS_PRIVILEGE_CAPTURE package immediately.

Why E is correct: Privilege Analysis reporting views (e.g., DBA_USED_PRIVS, DBA_UNUSED_PRIVS) reveal the full grant path through which a privilege was granted, helping DBAs identify which grants are exercised and which are superfluous candidates for revocation.

Why the distractors are wrong:

• B - Database Vault is a separate, optional security component; Privilege Analysis does not depend on it.
• C - Captured data for dropped objects is not retained; dropping an object removes its associated capture data.
• D - Privileges are stored under the capture policy name you define when calling CREATE_CAPTURE, not a generic "run-time capture name."
• F - Privilege Analysis can capture privileges exercised by precompiled database objects (e.g., compiled PL/SQL stored procedures).

Memory tip: Think "A-E = Analysis is Easy" - Available out-of-the-box, and Exposes grant paths. The remaining options all describe things Privilege Analysis either doesn't need (Vault), doesn't do (retain dropped-object data), or actually can do (capture precompiled object privileges).

No community discussion yet for this question.