Which two does the master key encrypt with Transparent Data Encryption?

Transparent Data Encryption (TDE) uses a two-tiered, key-based architecture. A central master encryption key is stored in an external security module (a keystore like a wallet or Oracle Key Vault). This master key does not encrypt user data directly. Instead, it is used to encrypt the data encryption keys, which are the TDE tablespace keys and the TDE table keys (used for column encryption). These data encryption keys are stored within the database and are used to encrypt and decrypt the actual data in tablespaces and columns.

A. Encrypted columns are encrypted by column keys (or tablespace keys), which are themselves encrypted by the master key.
B. The master key is stored in the encryption wallet; it does not encrypt the wallet file itself. The wallet is protected by a password.
C. Temporary segments, if in an encrypted temporary tablespace, are encrypted by a tablespace key, not directly by the master key.
E. Encrypted tablespaces are encrypted by their specific tablespace keys, not directly by the master key.

1. Oracle Database Advanced Security Guide 19c, "2 Introduction to Transparent Data Encryption", Section 2.1.1 "How Transparent Data Encryption Works". It states: "The TDE master encryption key is used to encrypt the TDE tablespace keys and the table keys."

2. Oracle Database Advanced Security Guide 19c, "2 Introduction to Transparent Data Encryption", Figure 2-1 "TDE Two-Tiered Key Architecture". The diagram clearly shows the Master Encryption Key encrypting the Data Encryption Keys (Tablespace Key, Table Key).