Which Three Statements About Oracle Privileges and Roles Are True?
Which three are true about privileges and roles? (Choose three.)
Community Insight
The exam tests the boundary between database-wide system privileges, schema-scoped object privileges, and who owns a role — the trap is assuming all roles belong to SYS or that PUBLIC membership can be revoked.
Oracle privileges and roles questions test whether you can separate system privileges (database-wide rights) from object privileges and role ownership rules. This page confirms that the three true statements are A, D and E, and shows why the source key's single-letter answer of D is incomplete.
The most common wrong answer is picking only D (or adding C). Learners assume every role is created in the SYS schema, when in fact only Oracle-supplied roles such as DBA, CONNECT and RESOURCE are owned by SYS; a user-created role belongs to its creator.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A is true because Oracle system privileges are rights that apply across the whole database rather than to one schema — CREATE SESSION, CREATE TABLE and CREATE ANY TABLE are granted globally, unlike object privileges which are tied to a specific table or view. Option D matches Oracle's documented rule that "a user automatically has all object privileges" over schema objects contained in that user's own schema, so no explicit grant is required to query or modify your own tables, and the owner can pass those privileges on with GRANT OPTION. Option E is true because a role created with CREATE ROLE is owned by the user who created it; that owner can add or remove privileges from the role and grant the role to other users or roles. Together these cover the three dimensions the question probes: scope of system privileges, implicit object privileges in your own schema, and role ownership.Why the Other Options Are Wrong
Option B is false because PUBLIC is not a role you can revoke from a user — every user in the database is implicitly a member of PUBLIC, and while you can revoke an individual privilege that was granted to PUBLIC, you can never remove PUBLIC membership itself. Option C is the classic distractor: only Oracle-supplied predefined roles (DBA, CONNECT, RESOURCE, SELECT_CATALOG_ROLE and similar) are created in the SYS schema, whereas any role a DBA or developer creates belongs to the creator — which is exactly what option E states, so C and E cannot both be true. Note that the source answer key lists only D; that is one correct statement out of three, and the question explicitly requires three choices.Community Comment Notes
One commenter, billysunday1, quotes Oracle's own documentation stating that "A user automatically has all object privileges" for objects in their schema, which is direct textual support for option D. The same commenter labels option A "Partially True" because certain system privileges are more granular, but under exam doctrine system privileges are still described as database-wide, so A remains correct. bca123 asks why C is incorrect — the answer is that only predefined roles live in the SYS schema, not all roles. Another commenter notes that PUBLIC is "automatically granted to all users", which reinforces that PUBLIC cannot be revoked from a user under option B. Some comments list letters such as F and G (for example, a reply beginning "Answers are DFG"), which shows the same question circulating with a longer option list; with the five options given here, A, D and E are the true statements.Official Reference
Exam Strategy
For privilege and role questions, immediately classify each statement as system privilege, object privilege, or role ownership, then reject anything containing absolutes like "all roles" or "always revoked". Remember that a user never needs a grant for objects in their own schema, and that only predefined roles come from SYS.
Frequently Asked Questions
Why is option C (all roles owned by SYS) false in Oracle?
Only Oracle-supplied predefined roles such as DBA, CONNECT and RESOURCE are created in the SYS schema; a role you create with CREATE ROLE is owned by you, as option E states.
Why can't PUBLIC be revoked from a user in option B?
PUBLIC is a built-in group that every database user belongs to implicitly. You can revoke a privilege granted to PUBLIC, but you cannot revoke PUBLIC membership itself.