154. View the Exhibit and examine the privileges granted to the MGR_ROLE role.
The user SKD has been granted the CONNECT and RESOURCE roles only. The database administrator
(DBA) grants MGR_ROLE to the user SKD by executing the command:
SQL> GRANT MGR_ROLE TO SKD WITH ADMIN OPTION;
Which statement is true about the user SKD after he/she is granted this role?
A.The user SKD can grant only the MGR_ROLE role to other users, but not the privileges in it.
B.The user SKD can revoke the MGR_ROLE only from the users for whom he/she is the grantor.
C.The user SKD can grant the privileges in the MGR_ROLE role to other users, but not with ADMIN
OPTION.
D.The user SKD can grant the privileges in the MGR_ROLE role to other users, but cannot revoke
privileges from them.
Answer: A
答案解析：
实验验证：
sys@TEST0924> create user SKD identified by SKD;
User created.
sys@TEST0924> grant connect,resource to SKD;
Grant succeeded.
sys@TEST0924> create role MGR_ROLE;
Role created.
sys@TEST0924> grant create role to MGR_ROLE;
Grant succeeded.
sys@TEST0924> grant create user to MGR_ROLE;
Grant succeeded.
sys@TEST0924> grant select any table to MGR_ROLE;
Grant succeeded.
查dba_sys_privs、dba_role_privs,dba_tab_privs三个视图看用户到底有哪些权限
sys@TEST0924>select * from dba_role_privs where grantee='MGR_ROLE';
no rows selected
sys@TEST0924> select * from role_sys_privs where role='MGR_ROLE';
ROLE PRIVILEGE ADM
------------------------------ ---------------------------------------- ---
MGR_ROLE SELECT ANY TABLE NO
MGR_ROLE CREATE ROLE NO
MGR_ROLE CREATE USER NO
sys@TEST0924> select * from role_tab_privs where role='MGR_ROLE';
no rows selected
WITH ADMIN OPTION的意思是被授予该权限的用户有权将某个权限(如MGR_ROLE)授予其他用户或角色，取消是不级联的。
sys@TEST0924> GRANT MGR_ROLE TO SKD WITH ADMIN OPTION;
Grant succeeded.
sys@TEST0924> create user user1 identified by test1;
User created.
sys@TEST0924> grant create session to user1;
Grant succeeded.
skd@TEST0924> grant MGR_ROLE to user1;
Grant succeeded.
skd@TEST0924> grant create user to user1;
grant create user to user1
*
ERROR at line 1:
ORA-01031: insufficient privileges
A正确，可以授权给MGR_ROLE给别的用户，但不能把MGR_ROLE里面的权限如create user授权给别的用户。
B错误，可以级联回收，可以回收不是SKD自己授予的。
C错，错误。The user SKD can grant the privileges in the MGR_ROLE role to other users。根据A答案，SKD不能将MGR_ROLE角色里的权限给别的用户。
D,也可以回收权限。
skd@TEST0924> revoke MGR_ROLE from user1;
Revoke succeeded.