Correct Answer: A,E
User authentication in Oracle 23ai determines how users (especially administrative ones) connect to the database. Let's analyze each option with extensive detail:
A . Operating System authentication may be used for system-privileged administrative users.
True. OS authentication allows users mapped to OS accounts (e.g., ops$oracle) to connect without a password, often used for administrative users like SYS or SYSTEM. This is configured by creating an externally authenticated user (e.g., CREATE USER "OPS$ORACLE" IDENTIFIED EXTERNALLY) and relies on the OS to verify identity.
Mechanics:When a user logs in via sqlplus / as sysdba, Oracle checks the OS user against the dba group (Unix) or ORA_DBA (Windows). If matched, no password is needed, leveraging OS security.
Practical Use:Common for DBAs managing local instances, reducing password management overhead.
Edge Case:Requires REMOTE_LOGIN_PASSWORDFILE=NONE for exclusive OS auth, but this isn't mandatory if a password file exists alongside.
Historical Note:Introduced in early Oracle versions, this remains a robust option in 23ai for local admin access.
B . Password authentication must be used for system-privileged administrative users.
False. "Must" is incorrect; password authentication (e.g., sqlplus sys/password) is an option, not a requirement. OS authentication or password file authentication can also be used for users like SYS. This option overstates the necessity of password-based login.
Why Incorrect:Oracle's flexibility allows multiple methods, contradicting the absolute phrasing here.
C . Password File authentication is supported for any type of database user.
False. Password file authentication is restricted to users with SYSDBA, SYSOPER, or similar system privileges (e.g., SYSBACKUP). Regular users (e.g., HR) can't use the password file (orapw<sid>); they rely on database authentication (passwords stored in the DB) or external methods.
Mechanics:The password file stores hashed credentials for privileged users, checked during remote AS SYSDBA logins.
Why Incorrect:Extending this to "any user" ignores Oracle's security model limiting password file usage.
D . REMOTE_LOGIN_PASSWORDFILE must be set to EXCLUSIVE to permit password changes for system-privileged administrative users.
False. REMOTE_LOGIN_PASSWORDFILE=EXCLUSIVE allows a dedicated password file for one instance, enabling password changes via ALTER USER SYS IDENTIFIED BY newpass. However, SHARED mode also permits changes for SYS, though not for other users added to the file. The "must" overstates the requirement; it's sufficient, not necessary.
Mechanics:EXCLUSIVE locks the file to one DB, while SHARED allows multiple DBs to use it, with restrictions on non-SYS users.
E . Password File authentication must be used for system-privileged administrative users.
True. For remote administrative access (e.g., sqlplus sys/password@orcl as sysdba), a password file is mandatory when REMOTE_LOGIN_PASSWORDFILE is EXCLUSIVE or SHARED. Local OS authentication is an alternative, but for network-based admin tasks, the password file is required, making this statement true in that context.
Mechanics:Set via orapwd (e.g., orapwd file=orapworcl password=oracle entries=10), enabling remote SYSDBA logins.
Edge Case:If REMOTE_LOGIN_PASSWORDFILE=NONE, only OS auth works locally, but this isn't the default or typical setup.
