Oracle Database Security Administration (1Z0-116) Practice Exam
Prepare for the 1Z0-116 exam with scenario questions across every objective — authentication and roles, Database Vault access control, Transparent Data Encryption, Unified Auditing, data masking and redaction, and cloud security — each explanation linked to the exact Oracle documentation page, with full timed simulation in Exam mode.
Start 24-hour free trial →1Z0-116 exam at a glance
- Vendor
- Oracle
- Exam code
- 1Z0-116
- Exam name
- Oracle Database Security Administration
- Certification earned
- Oracle Certified Professional, Oracle Database Security Expert
- Format
- Multiple choice
- Questions
- 72
- Duration
- 120 minutes
- Passing score
- 59%
- Validated against
- Oracle Database 12c and 19c
- Delivery
- Oracle | Pearson VUE, test center or online proctored
Sources: Oracle University — 1Z0-116 exam page. Verify current question count, duration, and passing score with Oracle before scheduling.
About the Oracle Database Security Administration (1Z0-116) exam
The 1Z0-116 exam is written for DBAs and security engineers who lock down Oracle Database. It leads to the Oracle Certified Professional, Oracle Database Security Expert credential, and validates that you can assess a database’s security needs and then implement the full defensive stack: strong authentication, least-privilege authorization and secure application roles, Database Vault access control, Transparent Data Encryption and network encryption, Unified Auditing, data masking and redaction, the Database Security Assessment Tool, and database security in the cloud.
The exam is scenario-driven rather than definition-driven — questions describe a security requirement and ask for the Oracle feature that fits, with distractors that are wrong for specific, learnable reasons (for example, redaction masks at display time while TDE encrypts at rest). Database Vault is a high-leverage topic: expect to read a realm with command rules and factors and predict which administrative action is blocked. Know TDE at both the tablespace and column level and the key-rotation sequence for the wallet or Oracle Key Vault, and rehearse which Unified Auditing condition fires for a given action.
PowerKram’s 1Z0-116 practice questions mirror that scenario format and link each explanation to the exact Oracle documentation page it derives from, so a wrong answer becomes a specific page to read. For the broader security concepts this exam tests, see our enterprise security practices guide.
What the 1Z0-116 exam covers
Oracle organizes the 1Z0-116 exam as a flat list of objective topics rather than percentage-weighted domains. We therefore group the topics into the areas below without inventing weightings — treat every area as testable and study by task. For the authoritative, current objective list, always check Oracle’s exam page.
Assess security needs for risk reduction and regulatory compliance, identify typical database attack points, and deploy the Maximum Security Architecture.
Manage database users; administer OS, Kerberos, and PKI-certificate authentication; Enterprise User Security and Centrally Managed Users; identify inactive accounts; secure and manage passwords (password files, external password store, secure password changes).
Use application contexts, USERENV, and client identifiers; administer system and object privileges and administrative privileges; configure secure application roles and global roles (EUS/CMU); perform privilege analysis for least privilege.
Apply the default separation of duties; configure realms, factors, rules and rule sets, command rules, and mandatory/optional realm protections to control even privileged users.
Encrypt data in motion (Native Network Encryption, TLS) and at rest (TDE at column and tablespace level, encrypting the data dictionary, migrating unencrypted data); manage encryption keys with the SYSKM privilege, wallets, and Oracle Key Vault.
Configure Unified Auditing and Fine-Grained Auditing policies; apply Oracle Data Redaction at query time; use Oracle Data Masking and Subsetting for de-identified non-production copies.
Run the Database Security Assessment Tool to evaluate a database’s configuration, users, and sensitive-data footprint against security best practices.
Assess the shared-responsibility model, manage hybrid-cloud scenarios, and understand how Autonomous Database self-secures — an objective area the exam explicitly includes.
These are objective areas, not weighted percentages — Oracle does not publish a percentage weighting for 1Z0-116. For the current, authoritative objective breakdown, see the official Oracle exam page.
Who the 1Z0-116 exam is for
This is a specialist credential for people responsible for securing Oracle databases. Oracle expects hands-on experience across authentication, access control, encryption, and auditing:
- Database administrators who harden and secure production Oracle databases and need to prove security depth beyond core DBA skills.
- Database security engineers designing least-privilege models, Database Vault realms, and encryption and key-management strategies.
- Security and compliance specialists implementing auditing, masking, and redaction to meet regulatory requirements.
- Cloud and platform engineers applying the shared-responsibility model and securing Oracle databases in hybrid and Autonomous environments.
Core DBA fundamentals help before you attempt this security exam, so the Database Administration I (1Z0-082) and Database Administration II (1Z0-083) exams are natural neighbors, and the OCI Security Professional (1Z0-1104) extends security into Oracle Cloud. For the roles this credential supports — with salary ranges and progression — see the cybersecurity specialist career path in our Career Hub.
What this 1Z0-116 practice exam delivers
Learn mode
Get the correct answer, the reasoning, and why the other options fail — immediately after each question. Ideal for Database Vault and encryption, where the “which control fits” decision is the main testing pattern.
Exam mode
A timed run in the real 1Z0-116 format — 72 questions, 120 minutes. Build the pacing and scenario-reading speed the actual exam demands.
Source-linked explanations
Every answer cites the exact Oracle documentation page it was built from — so you learn from Oracle’s own docs on Database Vault, TDE, auditing, and redaction, not just a memorized letter.
Study by objective
Practice by area — authentication, access control, encryption, auditing, cloud — so you can drill your weakest topics and confirm readiness before exam day.
Sample 1Z0-116 practice questions
Ten free scenario questions across the exam’s objective areas, each with a full explanation and a source link to the Oracle documentation it derives from. The complete bank is available with the 24-hour trial.
A DBA at a bank needs a role that grants privileges only when the application connects from a particular program, and no direct user should be able to enable the role outside the application. Which feature fits?
- A secure application role enabled by a PL/SQL procedure that verifies the client’s program and context at runtime
- A password-protected role with the password published in the application config file
- A default role granted to every user
- The DBA role granted broadly
Show answer & explanation
Correct: A — A secure application role enabled by a verifying PL/SQL procedure. Secure application roles are enabled only by a procedure that checks context (program, IP, and so on) at runtime, so the role can’t be enabled outside the application.
Why not the others: A published password (B) exposes the role to anyone. A default role for all (C) over-grants. The DBA role (D) grants far too much.
Source: Oracle Docs — Configuring privilege and role authorization → Further reading: PowerKram — Enterprise security practices →A security architect wants to prevent even the DBA from SELECTing from a sensitive HR schema while still allowing the HR application service account to do so. Which feature enforces this separation of duties?
- Requiring a password on every query the DBA runs
- A Database Vault realm protecting the HR schema, with authorized grantees limited to the HR application role
- Relying on the DBA’s integrity not to look
- Dropping the DBA’s privileges entirely
Show answer & explanation
Correct: B — A Database Vault realm with limited authorized grantees. Realms protect schemas from unauthorized access regardless of normal system privileges, which is exactly how you keep a privileged DBA out of sensitive data while allowing the application account.
Why not the others: Per-query passwords (A) are not how SQL access works. Relying on integrity (C) is not a control. Dropping DBA privileges (D) makes administration impossible.
Source: Oracle Docs — Introduction to Oracle Database Vault → Further reading: PowerKram — Enterprise security practices →A compliance auditor wants to block the DROP TABLE command on any object inside the sensitive HR realm unless a separate security officer approves. Which Database Vault feature enforces this?
- A note asking users not to drop tables
- Revoking DROP ANY TABLE from everyone, including SYS
- A command rule that restricts DROP TABLE within the HR realm to authorized grantees
- A before-statement trigger on every table in the database
Show answer & explanation
Correct: C — A Database Vault command rule. Command rules restrict specific SQL commands based on conditions such as realm membership and grantee — the designed control for gating DROP TABLE inside a realm.
Why not the others: A note (A) is no control. Revoking DROP ANY TABLE broadly (B) affects the whole database, not just the realm. A trigger on every table (D) is fragile and high-overhead.
Source: Oracle Docs — Configuring command rules →A DBA must encrypt the entire TBS_HR tablespace so all data at rest is encrypted, and wants to manage the key centrally in Oracle Key Vault for rotation. Which configuration fits?
- Disabling encryption and relying on disk-level encryption only
- TDE column encryption on every column of every table
- A manual hex dump of each datafile
- TDE tablespace encryption with the master key stored in Oracle Key Vault
Show answer & explanation
Correct: D — TDE tablespace encryption with the master key in Oracle Key Vault. Tablespace encryption transparently encrypts all data in the tablespace, and keeping the master key in Oracle Key Vault gives centralized rotation and HSM-backed control.
Why not the others: Disk-only encryption (A) leaves database-level requirements unmet. Column encryption everywhere (B) is heavier and piecemeal. A manual hex dump (C) is not encryption.
Source: Oracle Docs — Introduction to Transparent Data Encryption → Further reading: PowerKram — Enterprise security practices →A DBA must enforce a password policy: minimum length and complexity, 90-day expiration, and account lock after 5 failed logins. Which Oracle mechanism enforces these rules?
- A user profile with PASSWORD_VERIFY_FUNCTION, PASSWORD_LIFE_TIME, and FAILED_LOGIN_ATTEMPTS
- A system trigger on LOGON
- A policy email sent to all users
- Disabling password controls and relying on SSO only
Show answer & explanation
Correct: A — A user profile with the password parameters. Profiles carry password complexity (via PASSWORD_VERIFY_FUNCTION), lifetime, and lockout parameters — the standard, enforced mechanism for password policy.
Why not the others: A LOGON trigger (B) runs too late to enforce complexity at set time. An email (C) is guidance, not enforcement. Disabling controls (D) ignores the requirement.
Source: Oracle Docs — Configuring authentication →A security officer wants to audit every SELECT on the PATIENT_RECORDS table by any user, with audit records stored centrally and protected from tampering. Which feature fits?
- Storing audit records in a user-accessible table
- Unified Auditing with a policy on SELECT of PATIENT_RECORDS, writing to the secure audit trail
- A periodic manual review of application logs
- Disabling auditing and relying on the DBA to remember accesses
Show answer & explanation
Correct: B — A Unified Auditing policy on SELECT, in the secure trail. A Unified Auditing policy on the target action captures every access and stores records in the tamper-evident audit trail — the designed mechanism for this requirement.
Why not the others: A user-accessible table (A), manual log review (C), and relying on memory (D) each fail the integrity and completeness requirements.
Source: Oracle Docs — Configuring audit policies → Further reading: PowerKram — Enterprise security practices →A developer needs a development clone of a production database, but the business forbids real customer PII in non-production environments. Which capability produces a de-identified clone?
- A screenshot of selected tables emailed to developers
- Granting developers direct access to production
- Oracle Data Masking and Subsetting (via Data Safe) generating a masked clone
- A direct RMAN clone with no masking
Show answer & explanation
Correct: C — Oracle Data Masking and Subsetting. Masking replaces sensitive values in non-production copies while preserving structure and referential integrity — the designed way to give developers realistic but PII-free data.
Why not the others: A screenshot (A) isn’t realistic data. Direct production access (B) is a direct policy violation. An unmasked RMAN clone (D) exposes the PII the business forbade.
Source: Oracle Docs — Data Masking (Oracle Data Safe) →Developers must query a production-like copy without seeing real SSN values; the SSN column should appear as a fixed pattern like XXX-XX-1234 in query results. Which feature masks SSN at query time?
- A full database clone stored encrypted
- A view that drops the SSN column entirely
- Transparent Data Encryption on the column
- Oracle Data Redaction policies on the SSN column
Show answer & explanation
Correct: D — Oracle Data Redaction. Redaction alters sensitive values at query time according to a policy, showing a pattern such as XXX-XX-1234 rather than the stored value, while the underlying data is unchanged.
Why not the others: TDE (C) encrypts on disk, not at display. Dropping the column with a view (B) removes it entirely rather than masking it. An encrypted clone (A) doesn’t redact at display time.
Source: Oracle Docs — Introduction to Oracle Data Redaction →A security engineer wants network-level encryption between the application server and the Oracle Database so SQL traffic is encrypted in flight, without managing TLS/SSL certificates. Which feature fits?
- Oracle Native Network Encryption configured in sqlnet.ora on client and server
- Disabling network access to the database
- Relying on the data center’s physical security
- Encrypting only the TDE wallet on disk
Show answer & explanation
Correct: A — Native Network Encryption via sqlnet.ora. Native Network Encryption encrypts Oracle Net traffic in flight without TLS certificate management, configured with encryption parameters in sqlnet.ora on both client and server.
Why not the others: Disabling network access (B) breaks applications. Physical security (C) is not encryption in flight. Encrypting the TDE wallet (D) protects a key at rest, not the network traffic.
Source: Oracle Docs — Configuring network data encryption and integrity →An application connects as a single APP_USER account, but the business wants the database to know the real end-user identity for auditing and row-level security. Which feature surfaces the end-user identity through a shared connection?
- Sharing the APP_USER password with every end user
- Making each end user a DBA
- Proxy authentication (CONNECT THROUGH), so the end user’s identity passes through the APP_USER connection
- Logging only the APP_USER identity for all actions
Show answer & explanation
Correct: C — Proxy authentication. Proxy authentication lets sessions be established on behalf of a real user through a proxy account, preserving the end-user identity for auditing and Virtual Private Database policies.
Why not the others: Sharing the password (A) is a security violation and loses identity. Making everyone a DBA (B) is grossly over-privileged. Logging only APP_USER (D) is the very problem to solve.
Source: Oracle Docs — Configuring authentication (proxy) →Keep going: Learning & Career resources
Database security is a specialized, well-paid corner of the security field, and Oracle security skills stay in demand at enterprises running Oracle estates. Two PowerKram hubs back this exam.
Deep dive: exam format, objective areas, and study path
Format and scoring
The 1Z0-116 exam is 72 multiple-choice questions in 120 minutes, with a 59% passing score, validated against Oracle Database 12c and 19c. Passing earns the Oracle Certified Professional, Oracle Database Security Expert credential. Because the questions are scenario-based — “which control fits this requirement” — hands-on lab practice matters more than memorizing definitions. Always confirm the current question count and passing score on Oracle’s exam page before you schedule. Read the enterprise security practices guide →
Objective areas, without invented weights
Oracle publishes the 1Z0-116 objectives as a flat topic list, not as percentage-weighted domains, so treat every area as testable: security needs assessment; authentication and user management (OS, Kerberos, PKI, EUS/CMU, passwords); contexts, authorization, and roles; Database Vault; encryption and key management (Native Network Encryption, TLS, TDE, Oracle Key Vault); auditing, masking, and redaction; the Database Security Assessment Tool; and database security in the cloud. Study by task and lean into the areas you use least at work. See the OCI Security Professional exam →
High-leverage topics
Database Vault, TDE, and Unified Auditing reward focused study. For Database Vault, practice reading a realm with command rules and factors and predicting which administrative action is blocked. For TDE, know both the tablespace and column level and the key-rotation sequence for the wallet or Oracle Key Vault. For auditing, rehearse which Unified Auditing condition fires for a schema-level action versus a fine-grained predicate. Password profiles and proxy authentication are smaller topics but appear frequently — do not skip them. See the Database Administration II exam →
Realistic study path
Work in a lab 19c (or 23ai) database: enable Database Vault and protect an HR realm, turn on TDE for a tablespace, author a Unified Auditing policy that captures DDL on sensitive schemas, configure a password profile, and set up Native Network Encryption in sqlnet.ora. Then apply the skills on real work — register a dev database with Data Safe, rotate a TDE key on staging, or refactor a role hierarchy for least privilege. Master one objective at a time, and finish with timed practice runs until you clear the pass mark consistently. Start from the Database Administration I exam →
Frequently asked questions about the 1Z0-116 exam
How many questions are on the 1Z0-116 exam and what is the passing score?
What certification does passing 1Z0-116 earn?
What topics does the 1Z0-116 exam cover?
Does Oracle publish percentage weightings for the 1Z0-116 objectives?
Which Oracle Database version does the exam target?
Start your free 24-hour 1Z0-116 practice trial
Full access to 700+ questions across every objective area, both study modes, and source-linked explanations. No credit card required.
Start free trial →