How about alter database read only, or startup restrict.

Why does exp '/ as sysdba' doesnt ask passowrd? while
sqlplus '/ as sysdba' asked one?