OCP 1Z0 052 V8 02 154题

分享一下我老师大神的人工智能教程！零基础，通俗易懂！http://blog.csdn.net/jiangjunshow

也欢迎大家转载本篇文章。分享知识，造福人民，实现我们中华民族伟大复兴！

               

154. View the Exhibit and examine the privileges granted to the MGR_ROLE role.

The user SKD has been granted the CONNECT and RESOURCE roles only. The database administrator

(DBA) grants MGR_ROLE to the user SKD by executing the command:

SQL> GRANT MGR_ROLE TO SKD WITH ADMIN OPTION;

Which statement is true about the user SKD after he/she is granted this role?

A.The user SKD can grant only the MGR_ROLE role to other users, but not the privileges in it.

B.The user SKD can revoke the MGR_ROLE only from the users for whom he/she is the grantor.

C.The user SKD can grant the privileges in the MGR_ROLE role to other users, but not with ADMIN

OPTION.

D.The user SKD can grant the privileges in the MGR_ROLE role to other users, but cannot revoke

privileges from them.

Answer: A  

答案解析：

实验验证：

sys@TEST0924> create user SKD identified by SKD;

User created.

sys@TEST0924> grant connect,resource to SKD;

Grant succeeded.

sys@TEST0924> create role MGR_ROLE;

Role created.

sys@TEST0924> grant create role to MGR_ROLE;

Grant succeeded.

sys@TEST0924> grant create user to MGR_ROLE;

Grant succeeded.

sys@TEST0924> grant select any table to MGR_ROLE;

Grant succeeded.

查dba_sys_privs、dba_role_privs,dba_tab_privs三个视图看用户到底有哪些权限

sys@TEST0924>select * from dba_role_privs where  grantee='MGR_ROLE';

no rows selected

sys@TEST0924> select * from role_sys_privs where role='MGR_ROLE'; 

ROLE                           PRIVILEGE                                ADM

------------------------------ ---------------------------------------- ---

MGR_ROLE                       SELECT ANY TABLE                         NO

MGR_ROLE                       CREATE ROLE                              NO

MGR_ROLE                       CREATE USER                              NO

sys@TEST0924> select * from role_tab_privs where role='MGR_ROLE'; 

no rows selected

WITH ADMIN OPTION的意思是被授予该权限的用户有权将某个权限(如MGR_ROLE)授予其他用户或角色，取消是不级联的。

sys@TEST0924> GRANT MGR_ROLE TO SKD WITH ADMIN OPTION;

Grant succeeded.

sys@TEST0924> create user user1 identified by test1;

User created.

sys@TEST0924> grant create session to user1;

Grant succeeded.

skd@TEST0924> grant MGR_ROLE to user1;

Grant succeeded.

skd@TEST0924> grant create user to user1;

grant create user to user1

*

ERROR at line 1:

ORA-01031: insufficient privileges

A正确，可以授权给MGR_ROLE给别的用户，但不能把MGR_ROLE里面的权限如create user授权给别的用户。

B错误，可以级联回收，可以回收不是SKD自己授予的。
C错，错误。The user SKD can grant the privileges in the MGR_ROLE role to other users。根据A答案，SKD不能将MGR_ROLE角色里的权限给别的用户。

D,也可以回收权限。

skd@TEST0924> revoke MGR_ROLE from user1;

Revoke succeeded.

           

给我老师的人工智能教程打call！http://blog.csdn.net/jiangjunshow