1Z0-006 Security Management 3 — Questions and Answers
Question 1: Which profile parameter limits the number of consecutive failed login attempts before an account is automatically locked?
- PASSWORD_REUSE_TIME
- FAILED_LOGIN_ATTEMPTS (Correct answer)
- PASSWORD_LOCK_TIME
- LOGIN_RETRIES
Correct answer: FAILED_LOGIN_ATTEMPTS
FAILED_LOGIN_ATTEMPTS in a profile defines how many consecutive incorrect passwords are allowed before Oracle locks the account.
Question 2: What is the role of the SYSDBA privilege in Oracle Database?
- It allows read-only access to all tables in all schemas
- It grants the highest administrative power, including starting and stopping the database (Correct answer)
- It permits the user to create other DBAs only
- It restricts the user to data dictionary views only
Correct answer: It grants the highest administrative power, including starting and stopping the database
SYSDBA is the most powerful Oracle privilege, enabling operations such as STARTUP, SHUTDOWN, and RECOVER DATABASE that go beyond normal DBA capabilities.
Question 3: Which view would a DBA query to see privileges that have been granted directly to a specific user?
- DBA_ROLE_PRIVS
- DBA_SYS_PRIVS (Correct answer)
- USER_TABLES
- V$PWFILE_USERS
Correct answer: DBA_SYS_PRIVS
DBA_SYS_PRIVS lists system privileges granted to users and roles, showing the grantee, privilege name, and whether it was granted WITH ADMIN OPTION.
Question 4: What does granting a privilege WITH GRANT OPTION allow the recipient to do?
- Use the privilege indefinitely without expiration
- Grant the same object privilege to other users (Correct answer)
- Bypass all audit policies related to that privilege
- Perform the action without generating redo logs
Correct answer: Grant the same object privilege to other users
WITH GRANT OPTION lets the grantee pass the same object privilege on to additional users, creating a chain of privilege delegation.
Question 5: A user requires temporary elevated access to run a monthly report. Which Oracle feature best supports granting time-limited access without changing the user's default privileges?
- Assigning a new profile
- Enabling a role within the session (Correct answer)
- Granting SYSDBA temporarily
- Adding the user to the DBA group
Correct answer: Enabling a role within the session
A role can be enabled or disabled within a session using SET ROLE, allowing users to activate extra privileges only when needed.
Question 6: Which Oracle tool or feature provides centralized management of database security policies across multiple databases?
- SQL*Plus
- Oracle Enterprise Manager (OEM) (Correct answer)
- SQL Developer Data Modeler
- Oracle APEX
Correct answer: Oracle Enterprise Manager (OEM)
Oracle Enterprise Manager provides a centralized console for monitoring, managing, and enforcing security policies across multiple Oracle database targets.
Question 7: What is the effect of revoking a system privilege that was granted WITH ADMIN OPTION from a user?
- All users who received the privilege from that user also lose it
- Only the original grantee loses the privilege; downstream grants remain (Correct answer)
- The privilege is immediately disabled database-wide
- All roles associated with the privilege are dropped
Correct answer: Only the original grantee loses the privilege; downstream grants remain
Unlike object privilege revocation cascades, revoking a system privilege does not cascade — users who received it from the revoked grantee keep their privilege.
1Z0-006 Security Management 3
Which profile parameter limits the number of consecutive failed login attempts before an account is automatically locked?