I85PREP
⌘ K
IBM Db2 13 z/OS DBA Professional study materials
IBM Db2 13 z/OS DBA Professional study resources

IBM Db2 13 z/OS DBA Professional: Security and Utilities: Authority, Roles, and Utility Execution

IBM Db2 13 z/OS DBA Professional · Work through your exam, one topic at a time.

All guide sections

Security and Utilities: Authority, Roles, and Utility Execution

What this domain tests

This domain tests how Db2 13 for z/OS controls access to data and utilities. Expect questions on authorization IDs, roles, row and column access control, trusted contexts, utility authorization, and the utility control statements that a DBA must get right.

Core rules and concepts

  • Authentication is external, typically RACF; authorization is enforced by Db2 using authorization IDs, roles, and privileges stored in the catalog.
  • Administrative authorities include SYSADM, SYSOPR, SYSCTRL, SYSMAINT, and DBADM. Grant them narrowly; DBADM is database-scoped, not subsystem-wide.
  • Roles group privileges and can be granted to users or other roles. Prefer roles over direct grants for batch and application IDs.
  • Row and column access control uses CREATE PERMISSION and CREATE MASK, then ACTIVATE on the table. Column masks can hide salary data without granting a view.
  • Utility execution needs authority to run the utility and access to the underlying data sets. DSNUTILB runs batch utilities; TEMPLATE and LISTDEF reduce repeated JCL. Utility statements are recorded in SYSIBM.SYSUTILX.

Worked example

An application ID needs to read an employee table but must not see salary. Create a mask on the salary column that returns NULL unless the authorization ID is in a privileged role, activate column access control, and grant SELECT on the table to the application role. Reasoning: the mask applies to all access paths and avoids maintaining a separate view; the role keeps the privilege grant manageable. Test with a non-privileged ID and with the privileged role.

Traps that cost marks

Granting DBADM when a role would do; assuming a column mask applies to the table owner; forgetting that utility jobs also need data-set access; and using SHRLEVEL CHANGE without checking log and concurrency requirements.

Key points

  • RACF authenticates; Db2 authorizes.
  • Roles simplify privilege management.
  • Masks and permissions require activation.
  • Utilities need both Db2 and data-set authority.
  • DSNUTILB, TEMPLATE, and LISTDEF are core utility skills.