Exam DEA-C02 Topic 1 Question 170 Discussion

Option B implements both policies correctly. The row access policy correctly checks if the 'EMPLOYEE ID matches the 'CURRENT_USER()'. Although the use of is not correct in this situation, it is being used with 'employee_id' so can only see his own record in the 'EMPLOYEE table. The masking policy uses 'CURRENT correctly to check if the role in the session is 'HR_ADMIN'. If it is, the original salary value is returned; otherwise, it masks it to Other masking policy options will return a string representation ("MASKED") or return a hash of the value, which is not a valid 'NUMBER. Option A uses IS ROLE IN SESSION rather than CURRENT_ROLE. 'CURRENT_ROLE only returns the primary role used to initialize the session whereas will return TRUE if the role is the primary role or any of the active secondary roles in the current session.