The syllabus is unusually broad and deep, spanning twelve topic areas from user authentication through Database Vault, encryption, auditing, and data redaction. There are no published percentage weightings, so no area can be safely skipped. This guide groups those twelve topics into coherent themes and sets out a plan to work through the full security surface of the database.
Table of Contents
- What Does the Oracle 1Z0-116 Exam Cover?
- Who Should Take the Database Security Administration Certification?
- How Does the Exam Approach Users and Authentication?
- What Authorization and Access Control Must You Master?
- What Is Oracle Database Vault and Why Does It Matter?
- How Does the Exam Test Auditing?
- What Encryption and Network Security Does It Require?
- How Are Data Masking and Redaction Tested?
- What Careers Does the Certification Support?
- How Should You Structure a 1Z0-116 Study Plan?
- Frequently Asked Questions
- Conclusion
What Does the Oracle 1Z0-116 Exam Cover?
The Oracle 1Z0-116 (Oracle Database Security Administration) is a 120-minute exam of 72 multiple-choice questions with a passing score of 59 percent and a fee of $245 USD. It validates the ability to secure an Oracle database across authentication, authorization, encryption, auditing, and the specialised security options that protect sensitive data.
How Is the Exam Structured?
The exam is defined by twelve topic areas rather than a few weighted domains, and Oracle does not publish percentage weightings. That breadth is the challenge, because questions range across the entire security feature set, from password management to Oracle Database Vault. Grouping the topics into themes, as below, makes the syllabus far easier to plan around.
Topic Areas at a Glance
| Theme | Topic Areas |
|---|---|
| Authentication | Manage database users, secure passwords, contexts and client identifiers |
| Authorization | Privileges, roles, fine grained access control, Real Application Security, Label Security |
| Preventive Controls | Oracle Database Vault, separation of duties, realms and command rules |
| Detective Controls | Unified auditing, fine-grained auditing, privileged user audit |
| Encryption and Network | Transparent Data Encryption, TLS, network ACLs, wallet management |
| Data Protection | Data redaction, data masking, sensitive data discovery, assessment tools |
Read the full topic list on the exam datacard before studying, because its granularity signals what the exam rewards: broad, practical familiarity with Oracle’s entire security toolkit rather than deep theory in one area.
Who Should Take the Database Security Administration Certification?
The 1Z0-116 is aimed at database administrators, security administrators, and DBAs who are responsible for securing Oracle databases. It suits professionals moving from general database administration into a security-focused role, and it is a strong credential for anyone accountable for protecting sensitive data in an Oracle environment.
What Background Helps
Solid Oracle database administration experience is close to essential. The exam assumes you understand how the database works before it asks how to secure it, so comfort with SQL, users, and the general architecture is prerequisite. A grounding in core database skills such as those in the Oracle Database SQL fundamentals makes the security material much easier to absorb.
Where It Fits
The certification sits alongside Oracle’s cloud and platform security credentials, and professionals often combine on-premises and cloud security expertise. This look at how the OCI security certification shapes careers shows how database security skills extend into Oracle’s cloud, where many of the same principles apply to managed and Autonomous databases.
How Does the Exam Approach Users and Authentication?
Authentication is the first line of database defence, and the exam covers it thoroughly. It spans managing database users across authentication methods, securing passwords, and using application contexts and client identifiers to establish and control identity within the database session.
User and Password Management
The exam expects command of the full range of authentication: operating system, Kerberos, PKI certificate, and enterprise user authentication, along with centrally managed users. Password security is examined in detail, from securing passwords in scripts and applications to administering the external password store and managing the password file. Identifying and handling inactive accounts is a recurring practical concern.
Contexts and Client Identifiers
Application contexts are a distinctive Oracle security feature. Understand USERENV attributes, how client identifiers propagate identity, and how contexts support secure application roles and unified auditing. These mechanisms let the database make security decisions based on who is really behind a connection, which is central to fine-grained control.
What Is Oracle Database Vault and Why Does It Matter?
Oracle Database Vault addresses one of the hardest problems in database security: restricting even the powerful database administrator. It enforces separation of duties so that a DBA can manage the database without necessarily being able to read the sensitive data inside it, which is a common compliance and insider-threat requirement.
Realms, Rules, and Command Rules
The exam expects you to configure Database Vault properly. Understand realms that protect schemas and objects, factors and rule sets that make access decisions based on context, and command rules that control administrative operations. Trusted path access ties these together, ensuring that access is granted only under the right conditions.
Why Separation of Duties Is Tested
Database Vault features prominently because separation of duties is a genuine security control rather than a theoretical one. Questions describe a scenario, such as protecting sensitive data from a privileged administrator, and ask which Database Vault mechanism enforces it. This is where the exam moves from configuration into security design thinking.
“Oracle Database Security helps reduce the risk of data breaches and simplify compliance by enforcing controls at the data layer.”
How Does the Exam Test Auditing?
Auditing is the detective control that makes everything else accountable, and the exam covers Oracle’s auditing capabilities in depth. It spans auditing privileged users, standard auditing, fine-grained auditing, and configuring unified auditing, which consolidates audit data into a single secure trail.
Unified and Fine-Grained Auditing
Unified auditing is the modern approach, and the exam expects you to configure it, understand its policies, and know how it improves on legacy auditing. Fine-grained auditing adds precision, letting you audit specific conditions such as access to particular columns or rows. Together they let you record exactly what matters without drowning in noise.
Auditing the Powerful
A recurring theme is auditing privileged users, because the accounts with the most power pose the most risk. The exam expects you to understand how to hold administrators accountable through audit, complementing the preventive controls of Database Vault with a detective record of what was actually done.
What Encryption and Network Security Does It Require?
Encryption protects data when other controls are bypassed, and the exam treats it as essential. It covers encrypting data in motion and at rest, Transparent Data Encryption, key and wallet management, and securing the network layer through access control lists and listener configuration.
Transparent Data Encryption
Transparent Data Encryption is central to the encryption topics. Understand column-level and tablespace-level encryption, how the master key and wallet are managed, and the role of the SYSKM administrative privilege. The Transparent Data Encryption documentation is the authoritative reference for how key management and wallet administration work.
Network Security
The exam also covers securing the network path to the database: network access control lists, wallet access for microservice deployments, listener valid-node checking, and the SEC parameters that harden network behaviour. Data encrypted at rest still needs protection in transit, and TLS configuration is examined alongside it. Broader context is available in the Oracle Database security guide.
How Are Data Masking and Redaction Tested?
The final theme protects sensitive data from those who should not see it, even when they have legitimate access to the system. The exam covers data redaction, the Enterprise Manager data masking pack, sensitive data discovery, and the additional assessment tools that evaluate a database’s security posture.
Redaction Versus Masking
The exam expects you to distinguish two related capabilities. Data redaction alters what is displayed at query time without changing the stored data, protecting sensitive values in production. Data masking, by contrast, permanently replaces sensitive data, typically for non-production environments. Knowing which fits a use case is a common question pattern.
Assessment and Additional Topics
The syllabus closes with practical security tooling: the Database Security Assessment Tool for evaluating posture, evaluating vulnerabilities through CVE and CVSS, and security considerations for cloud and Autonomous databases. Familiarity with the CVSS scoring system helps with the vulnerability-evaluation topics, which connect database security to the wider vulnerability-management discipline.
“Oracle Database Vault provides fine-grained access control to sensitive data, including protecting data from privileged users.”
What Careers Does the Certification Support?
The 1Z0-116 maps most directly to database security administrator, database administrator, and security engineer roles in organisations running Oracle databases. It signals specialised, in-demand expertise, because securing a database well is a distinct skill that general administration does not guarantee.
A Specialist, Valuable Skill
Database security expertise is scarce relative to demand, particularly as data protection regulations tighten. The certification validates that you can implement encryption, access control, and auditing correctly, which is exactly the competence compliance-driven organisations need. The skills also transfer conceptually to other database platforms and to cloud data security.
Registration
The exam is scheduled through Pearson VUE’s Oracle programme, at a test centre or online with a proctor. Confirm current requirements when you book, since Oracle periodically updates its certification portfolio and exam versions.
How Should You Structure a 1Z0-116 Study Plan?
Eight to ten weeks at eight to ten hours per week suits most candidates with Oracle database administration experience, and longer for those newer to the platform. Because the exam is broad and hands-on, practising each security feature in a test database matters far more than reading, and your plan should cover the full topic list rather than favouring familiar areas.
A Ten-Week Sequence
- Weeks one to two – authentication. Work through user management, password security, and application contexts in a test database.
- Weeks three to four – authorization. Practise privileges, roles, and the fine grained access control options, including VPD and Label Security.
- Weeks five to six – Database Vault and auditing. Configure realms and command rules, then set up unified and fine-grained auditing.
- Weeks seven to eight – encryption and network. Implement Transparent Data Encryption, wallet management, and network access controls.
- Weeks nine to ten – data protection and review. Cover redaction, masking, and assessment tools, then move to timed practice.
The Habit That Separates Passes From Retakes
Configure every feature at least once. A candidate who has actually set up Database Vault, enabled Transparent Data Encryption, and created an audit policy answers the practical questions with confidence, while one who has only read struggles with the breadth. Working through a full 1Z0-116 practice exam under timed conditions also reveals which of the twelve topic areas you have under-covered.
Frequently Asked Questions
How many questions are on the 1Z0-116 exam?
The exam contains 72 multiple-choice questions to be completed in 120 minutes. That leaves comfortable time per question, though the breadth of topics means preparation must be wide.
What is the passing score for the Oracle 1Z0-116 exam?
The passing score is 59 percent. Because the questions sample across twelve topic areas, consistent coverage of the whole syllabus matters more than depth in a few.
How much does the 1Z0-116 exam cost?
The exam fee is $245 USD, though the price varies by country and currency. It is booked through Pearson VUE as part of Oracle’s certification programme.
Are there prerequisites for the 1Z0-116?
There are no formal prerequisites, but the exam assumes solid Oracle database administration experience. Understanding how the database works is effectively required before securing it.
What is Oracle Database Vault?
Oracle Database Vault enforces separation of duties, allowing a DBA to administer a database without necessarily accessing the sensitive data inside it. It uses realms, factors, rule sets, and command rules to control access.
How much encryption knowledge does the exam require?
A significant amount. The exam covers Transparent Data Encryption at column and tablespace level, key and wallet management, and TLS for data in transit, so encryption is a major topic area.
What is the difference between data redaction and data masking?
Data redaction alters displayed values at query time without changing stored data, protecting production. Data masking permanently replaces sensitive data, typically for non-production environments.
Do I need hands-on access to an Oracle database?
Effectively yes. The exam is practical, and configuring users, Database Vault, encryption, and auditing in a real database translates far better than reading documentation alone.
What jobs can the certification support?
It maps to database security administrator, database administrator, and security engineer roles, particularly in organisations running Oracle databases where data protection is a priority.
How long does it take to prepare for the 1Z0-116?
Eight to ten weeks at eight to ten hours per week is realistic for candidates with Oracle database administration experience. Those newer to Oracle should plan for longer and prioritise hands-on practice.
Conclusion
The Oracle 1Z0-116 is a genuine security certification for the Oracle database, and its twelve topic areas cover the full defensive surface: authentication, authorization, preventive controls, auditing, encryption, and data protection. The absence of weightings means breadth is everything, and consistent coverage of the whole syllabus decides the outcome.
Ground your preparation in a live database, because the exam rewards configuration experience over memorised features. Pay particular attention to Database Vault, Transparent Data Encryption, and unified auditing, since these represent Oracle’s most powerful and most examined security capabilities.
Plan eight to ten weeks, work through every topic area rather than skimming, and configure each feature at least once. The 1Z0-116 validates a scarce and valuable skill, securing the data attackers most want, and it opens the database security roles where that skill protects an organisation’s most sensitive asset.
