Free 1Z0-116 Practice Test

The goal is to redact the entire salary value and display only the number 0. The DBMSREDACT.FULL function type performs full redaction. For columns with a NUMBER data type, the default redacted value is 0. Although the code snippet includes the functionparameters argument, it is ignored when functiontype is set to DBMSREDACT.FULL. This function type directly achieves the stated requirement.

A. DBMSREDACT.NONE is not a valid function type for redaction; it is a constant used for other parameters like policyexpression.
B. DBMSREDACT.PARTIAL is used to mask only a portion of the data, not the entire value, which contradicts the requirement.
D. DBMSREDACT.REGEXP uses regular expressions for complex redaction patterns, which is overly complex for simply replacing a value with 0.
E. DBMSREDACT.RANDOM replaces the data with random values, not a fixed value of 0 as required.

- Oracle Database PL/SQL Packages and Types Reference, 19c, "DBMSREDACT Constants". In Table 133-5, the constant FULLREDACTION (DBMSREDACT.FULL) is described as performing full redaction, with the default for NUMBER types being 0.

- Oracle Database Security Guide, 19c, Chapter 10 "Using Oracle Data Redaction", section "Full Redaction". This section states, "Full redaction redacts all of the data in the column... For numeric data types, the redacted value is 0 (zero)."

:

The client identifier, when set using DBMSSESSION.SETIDENTIFIER, is automatically captured in audit trail records. This allows DBAs to track database activities by actual application users rather than just database usernames. The client identifier is not automatically set by SQLNet - it must be explicitly set by the application. A session can have only one client identifier value at a time, and it can be changed multiple times during a session using DBMSSESSION procedures.

B. SQLNet does not automatically set client identifier; applications must explicitly set it using DBMSSESSION.SETIDENTIFIER.
C. Only one client identifier value can be active per session at any given time.
D. Client identifier can be changed during a session using DBMSSESSION.SETIDENTIFIER or CLEARIDENTIFIER procedures.

1. Oracle Database Security Guide 19c, Chapter 23 "Managing Security for Application Developers", Section "Using Application Context", Doc ID E96279-05

2. Oracle Database PL/SQL Packages and Types Reference 19c, "DBMSSESSION" package documentation, procedures SETIDENTIFIER and CLEARIDENTIFIER

3. Oracle Database Administrator's Guide 19c, Chapter 28 "Monitoring Database Activity with Auditing", Section "Audit Trail Contents"

Network Access Control Lists (ACLs) are a security feature for controlling outbound network traffic initiated from the database via PL/SQL packages like UTLTCP and UTLHTTP. Their primary purpose is to provide fine-grained access control, specifying which database users (principals) can connect to which external network hosts and ports (A). For secure connections like HTTPS, an Oracle Wallet containing certificates is required. While the ACL does not control access to the wallet itself, it is a mandatory prerequisite for enabling the HTTP request that uses the wallet. Therefore, defining an ACL is a necessary step in the configuration process for such requests (B).

C. Auditing is a separate function. While you can audit network access, ACLs are the control mechanism, not the audit policy itself.
D. ACLs control outbound connections initiated from the database, not inbound attacks directed at the database, which is the role of a firewall.
E. ACLs are a security feature that adds a permission check; they do not inherently improve the performance of network operations.

- Oracle Database Security Guide 21c, Chapter 10, "Configuring Fine-Grained Access to External Network Services". It states, "You can use access control lists (ACLs) to provide fine-grained control over access by database users to external network services."

- Oracle Database PL/SQL Packages and Types Reference 21c, "UTLHTTP". The documentation specifies that before using the package, "an entry must be created in the database's network access control list (ACL)." It also notes for HTTPS, a wallet is required.

A Virtual Private Database (VPD) policy predicate function is invoked by the Oracle server whenever a user accesses the associated table. The server automatically passes two arguments to this function: the schema name of the object being accessed and the name of the object itself (e.g., the table or view name). The function uses these arguments, along with session context information (like SYSCONTEXT), to dynamically generate a WHERE clause predicate. This predicate is then appended to the user's SQL statement to enforce row-level security.

C. The policy type (e.g., DYNAMIC, STATIC) is part of the policy definition, not an argument passed to the predicate function at runtime.
D. The policy name is used to identify the policy but is not passed as an argument to its associated function during execution.
E. The policy group is an organizational container for policies and is not passed as a runtime argument to the predicate function.

- Oracle Database Security Guide 21c, Chapter 8, "Using Oracle Virtual Private Database to Control Data Access". The section "Step 2: Create the Policy Function" explicitly shows the required signature: FUNCTION policyfunctionname (schemaname IN VARCHAR2, objectname IN VARCHAR2) RETURN VARCHAR2;.

- Oracle Database PL/SQL Packages and Types Reference 21c, "DBMSRLS". The documentation for ADDPOLICY shows the functionschema and policyfunction parameters, and the standard signature for the policy function confirms the two arguments.

Oracle Database searches for the TDE keystore in a specific order. For backward compatibility, it may first check for the deprecated ENCRYPTIONWALLETLOCATION parameter (1) in sqlnet.ora. If not found, it checks the default location, which is $ORACLEBASE/admin/DBUNIQUENAME/wallet (2). If the ORACLEBASE environment variable is not set, it then checks the fallback default location at $ORACLEHOME/admin/DBUNIQUENAME/wallet (5). The TDECONFIGURATION parameter (4) specifies the keystore type (e.g., FILE, OKV) rather than its location.

A. This option incorrectly places the fallback default location ($ORACLEHOME) before the primary default location ($ORACLEBASE).
B. This option omits the primary default location ($ORACLEBASE) from the main search path, which is incorrect.
D. This option incorrectly suggests that the current WALLETLOCATION parameter is checked after the default location, which is illogical.

- Oracle Database Advanced Security Guide 19c, Chapter 4, "Configuring Transparent Data Encryption". Section: "About the Keystore Location". The guide specifies the current parameter is WALLETLOCATION and the default is $ORACLEBASE/.... The question's options imply a search order that includes the deprecated ENCRYPTIONWALLETLOCATION for backward compatibility, followed by the default locations.

:

Transparent Data Encryption (TDE) uses a two-tiered, key-based architecture. A central master encryption key is stored in an external security module (a keystore like a wallet or Oracle Key Vault). This master key does not encrypt user data directly. Instead, it is used to encrypt the data encryption keys, which are the TDE tablespace keys and the TDE table keys (used for column encryption). These data encryption keys are stored within the database and are used to encrypt and decrypt the actual data in tablespaces and columns.

A. Encrypted columns are encrypted by column keys (or tablespace keys), which are themselves encrypted by the master key.
B. The master key is stored in the encryption wallet; it does not encrypt the wallet file itself. The wallet is protected by a password.
C. Temporary segments, if in an encrypted temporary tablespace, are encrypted by a tablespace key, not directly by the master key.
E. Encrypted tablespaces are encrypted by their specific tablespace keys, not directly by the master key.

1. Oracle Database Advanced Security Guide 19c, "2 Introduction to Transparent Data Encryption", Section 2.1.1 "How Transparent Data Encryption Works". It states: "The TDE master encryption key is used to encrypt the TDE tablespace keys and the table keys."

2. Oracle Database Advanced Security Guide 19c, "2 Introduction to Transparent Data Encryption", Figure 2-1 "TDE Two-Tiered Key Architecture". The diagram clearly shows the Master Encryption Key encrypting the Data Encryption Keys (Tablespace Key, Table Key).

The user JOHN has been granted the SYSDBA and SYSBACKUP administrative privileges. The SYSDBA privilege is the most powerful and includes the SELECT ANY DICTIONARY and SELECT ANY TABLE privileges. This allows JOHN to query any data dictionary view (DBA tables) and data in any user's schema. The SYSBACKUP privilege (which is also a subset of SYSDBA) provides the necessary permissions to perform backup and recovery operations, which are primarily accomplished using the Recovery Manager (RMAN) utility. John would connect using CONNECT / AS SYSBACKUP or CONNECT / AS SYSDBA in RMAN.

A. John connects as himself with administrative privileges (e.g., CONNECT JOHN/... AS SYSBACKUP), not as the `SYSTEM

1. Oracle Database Security Guide 19c, Table 2-4 “Administrative Privileges”

(SYSBACKUP capabilities include backup/restore, dictionary query).

2. Oracle Database Backup & Recovery User’s Guide 19c, Sec. 2.3 “Connecting

with the SYSBACKUP Privilege” (use with SQLPlus and RMAN).

3. Oracle Net Services Reference 19c, Appendix A, “RMAN Authorization”.

An Oracle Label Security (OLS) label is composed of three components: a level, zero or more compartments, and zero or more groups. Among these, only the level is mandatory. The level indicates the sensitivity of the data (e.g., PUBLIC, CONFIDENTIAL, SECRET). Compartments and groups are optional and are used to provide more granular access control by representing areas or projects to which the data belongs. Therefore, when creating any label, a level must always be specified.

A. level and group: The group component is optional, not required.
B. level, compartment, and group: Both compartment and group components are optional.
C. compartment: The compartment component is optional.
D. group: The group component is optional.
F. compartment and group: Both compartment and group components are optional.
G. level and compartment: The compartment component is optional.

1. Oracle Database Vault and Oracle Label Security Guide, 21c. Chapter 8, "Defining Oracle Label Security Policies and Labels". Section: "Components of an Oracle Label Security Label". It states, "A label has three components: A single level... Zero or more compartments... Zero or more groups."