Which Three Statements About Oracle Privileges and Roles Are True?
Short answer
ADE System privileges apply database-wide, a user holds all object privileges on objects in their own schema, and a role is owned by the user who created it.
Question
Key Takeaways
The exam tests the boundary between database-wide system privileges, schema-scoped object privileges, and who owns a role — the trap is assuming all roles belong to SYS or that PUBLIC membership can be revoked.
Oracle privileges and roles questions test whether you can separate system privileges (database-wide rights) from object privileges and role ownership rules. This page confirms that the three true statements are A, D and E, and shows why the source key's single-letter answer of D is incomplete.
Common mistake: The most common wrong answer is picking only D (or adding C). Learners assume every role is created in the SYS schema, when in fact only Oracle-supplied roles such as DBA, CONNECT and RESOURCE are owned by SYS; a user-created role belongs to its creator.
Expert Analysis
Why the Answer Is Correct
Option A is true because Oracle system privileges are rights that apply across the whole database rather than to one schema — CREATE SESSION, CREATE TABLE and CREATE ANY TABLE are granted globally, unlike object privileges which are tied to a specific table or view. Option D matches Oracle's documented rule that "a user automatically has all object privileges" over schema objects contained in that user's own schema, so no explicit grant is required to query or modify your own tables, and the owner can pass those privileges on with GRANT OPTION. Option E is true because a role created with CREATE ROLE is owned by the user who created it; that owner can add or remove privileges from the role and grant the role to other users or roles. Together these cover the three dimensions the question probes: scope of system privileges, implicit object privileges in your own schema, and role ownership.
Why the Other Options Are Wrong
Option B is false because PUBLIC is not a role you can revoke from a user — every user in the database is implicitly a member of PUBLIC, and while you can revoke an individual privilege that was granted to PUBLIC, you can never remove PUBLIC membership itself. Option C is the classic distractor: only Oracle-supplied predefined roles (DBA, CONNECT, RESOURCE, SELECT_CATALOG_ROLE and similar) are created in the SYS schema, whereas any role a DBA or developer creates belongs to the creator — which is exactly what option E states, so C and E cannot both be true. Note that the source answer key lists only D; that is one correct statement out of three, and the question explicitly requires three choices.
Community Comment Notes
One commenter, billysunday1, quotes Oracle's own documentation stating that "A user automatically has all object privileges" for objects in their schema, which is direct textual support for option D. The same commenter labels option A "Partially True" because certain system privileges are more granular, but under exam doctrine system privileges are still described as database-wide, so A remains correct. bca123 asks why C is incorrect — the answer is that only predefined roles live in the SYS schema, not all roles. Another commenter notes that PUBLIC is "automatically granted to all users", which reinforces that PUBLIC cannot be revoked from a user under option B. Some comments list letters such as F and G (for example, a reply beginning "Answers are DFG"), which shows the same question circulating with a longer option list; with the five options given here, A, D and E are the true statements.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
For privilege and role questions, immediately classify each statement as system privilege, object privilege, or role ownership, then reject anything containing absolutes like "all roles" or "always revoked". Remember that a user never needs a grant for objects in their own schema, and that only predefined roles come from SYS.
Frequently Asked Questions
Why is option C (all roles owned by SYS) false in Oracle?
Why can't PUBLIC be revoked from a user in option B?
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
billysunday1 👍 3 Answered DPlease ignore my previous answer. D:Who Can Grant Schema Object Privileges? A user automatically has all object privileges for schema objects contained in his or her schema. A user can grant any object privilege on any schema object he or she owns to any other user or role. If the grant includes the GRANT OPTION (of the GRANT command), the grantee can further grant the object privilege to other users; otherwise, the grantee can use the privilege but cannot grant it to other users. https://docs.oracle.com/cd/A58617_01/server.804/a58227/ch18.htm F: https://docs.oracle.com/cd/A97630_01/server.920/a96521/privs.htm#:~:text=A%20role%20groups%20several%20privileges,to%20help%20in%20database%20administration. G: https://docs.oracle.com/cd/A97630_01/server.920/a96521/privs.htm#:~:text=Because%20PUBLIC%20is%20accessible%20to,requires%20the%20privilege%20or%20role.
-
billysunday1 👍 1A. System privileges always set privileges for an entire database. Partially True: System privileges are designed to grant a user abilities that are applicable across the database, such as creating tables or executing any procedure. However, the scope of "entire database" can vary depending on the specific system privilege. Some system privileges are more granular and allow actions on specific types of objects across the database. D. A user has all object privileges for every object in their schema by default. True: In Oracle, users inherently have all privileges on objects they own, which includes the ability to select, insert, update, delete, and execute (for procedures and functions), among other actions on those objects. F. A role can contain a combination of several privileges and roles. True: This is one of the primary purposes of roles in Oracle Database. They can group together various system and object privileges as well as other roles for easier and more efficient privilege management. From GPT4
-
bfb7c7d 👍 1Answers are DFG in terms of G option ... The PUBLIC role is automatically granted to all users, providing a set of default privileges that every user in the database has.
-
bca123 👍 1 Answered DWHY C IS INCORRECT?
-
ShahedOdeh 👍 1A , D and F
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.