OCP 1Z0 052 154

154. View the Exhibit and examine the privileges granted to the MGR_ROLE role.



The user SKD has been granted the CONNECT and RESOURCE roles only. The database administrator

(DBA) grants MGR_ROLE to the user SKD by executing the command:

SQL> GRANT MGR_ROLE TO SKD WITH ADMIN OPTION;

Which statement is true about the user SKD after he/she is granted this role?

A.The user SKD can grant only the MGR_ROLE role to other users, but not the privileges in it.

B.The user SKD can revoke the MGR_ROLE only from the users for whom he/she is the grantor.

C.The user SKD can grant the privileges in the MGR_ROLE role to other users, but not with ADMIN

OPTION.

D.The user SKD can grant the privileges in the MGR_ROLE role to other users, but cannot revoke

privileges from them.

Answer: A

http://docs.oracle.com/cd/E11882_01/server.112/e41084/statements_9013.htm#SQLRF55031

WITH ADMIN OPTION

Specify

WITH

ADMIN

OPTION

to enable the grantee to:

Grant the privilege or role to another user or role, unless the role is a

GLOBAL

role

Revoke the privilege or role from another user or role

Alter the privilege or role to change the authorization needed to access it

Drop the privilege or role

If you grant a system privilege or role to a user without specifying

WITH

ADMIN

OPTION

, and then subsequently grant the privilege or role to the user

WITH

ADMIN

OPTION

,
then the user has the

ADMIN

OPTION

on the privilege or role.

To revoke the

ADMIN

OPTION

on a system privilege or role from a user, you must revoke the privilege or role from the user altogether and then grant the privilege or role to the user without
the

ADMIN

OPTION

.

http://docs.oracle.com/cd/E11882_01/server.112/e41084/statements_9020.htm#SQLRF55181

To revoke a system privilege, you must have been granted the privilege with the

ADMIN

OPTION

. You can revoke any privilege if you have
the

GRANT

ANY

PRIVILEGE

system privilege.

To revoke a role, you must have been granted the role with the

ADMIN

OPTION

. You can revoke any role if you have the

GRANT

ANY

ROLE

system
privilege.

To revoke an object privilege, one of the following conditions must be met:

You must previously have granted the object privilege to the user or role.

You must have the

GRANT

ANY

OBJECT

PRIVILEGE

system privilege. In this case, you can revoke
any object privilege that was granted by the object owner or on behalf of the owner by a user with the

GRANT

ANY

OBJECT

PRIVILEGE

.
However, you cannot revoke an object privilege that was granted by way of a

WITH

GRANT

OPTION

grant.

See Also:
"Revoke Operations that Use GRANT ANY OBJECT PRIVILEGE: Example"

The

REVOKE

statement can revoke only privileges and roles that were previously granted directly with a

GRANT

statement. You cannot use this statement to revoke:

Privileges or roles not granted to the revokee

Roles or object privileges granted through the operating system

Privileges or roles granted to the revokee through roles