Database Vault Is configured and enabled In the Oracle database. Three users are granted the dba, dv_omneb, and dv_acctmgb roles. There is a requirement to create a user who can: 1. Connect to the…

Question

Options

• Ausers granted DV_ACCTMGR and DV_OWNER roles
• Busers granted DV_OWNER role
• Cusers granted DBA and DV_OWNER roles
• Dusers granted DV_ACCTMGR and DBA roles

• A
  13% (7)
• B
  4% (2)
• C
  5% (3)
• D
  78% (43)

Explanation

D is correct because Oracle Database Vault strips the CREATE USER privilege from the DBA role and reassigns it exclusively to DV_ACCTMGR - so DV_ACCTMGR is required to create the account. However, DV_ACCTMGR alone cannot grant the new user CREATE SESSION or dictionary view access (SELECT_CATALOG_ROLE / SELECT ANY DICTIONARY); those grants require DBA. Together, DV_ACCTMGR + DBA cover the full provisioning task.

Why the distractors fail:

• A (DV_ACCTMGR + DV_OWNER): DV_OWNER governs Vault realm/policy management, not the granting of system privileges like CREATE SESSION or dictionary access - DBA is still needed for that.
• B (DV_OWNER only): DV_OWNER can neither create user accounts nor grant standard database privileges; it is scoped to Database Vault administration only.
• C (DBA + DV_OWNER): DBA no longer has CREATE USER once Vault is enabled, and DV_OWNER doesn't restore it - without DV_ACCTMGR, no one in this pair can create the account.

Memory tip: Think of it as a two-key safe - DV_ACCTMGR is the account creation key (Vault took it from DBA), and DBA is the privilege grant key. You need both keys to fully provision a user when Database Vault is active.

No community discussion yet for this question.