Is it necessary to set ORACLE_SID when creating a database?

If there are no other Oracle databases on the server, then it is not necessary to set the SID as this will be your default SID in the registry, although I usually set it anyway mostly out of habit. If you are creating another database manually via the command prompt then, yes, it is necessary to set the ORACLE_SID. If you have two or more databases running from multiple ORACLE_HOMEs, this complicates matters a bit more. In this case, you will want to set the ORACLE_SID and also modify your path (or use the Home Selector depending on the version) so that the ORACLE_HOME corresponding to that SID is placed first in your PATH. It is not recommended that you set ORACLE_HOME as an environment variable. For more information, see Chapter 6 of the Oracle9i Database Getting Started Release 2 (9.2) for Windows available on Oracle's Technology Network Web site.

Using a password file is basically one method of authenticating administrators to the database. When the initialization parameter REMOTE_LOGIN_PASSWORDFILE is set to EXCLUSIVE, and a password file has been created, users connecting to the database as SYSOPER or SYSDBA will be prompted for a password. Note that operating system authentication takes precedence over password file authentication. If you belong to the OSDBA or OSOPER group and connect as SYSDBA or SYSOPER, you will be connected with associated administrative privileges regardless of the username/password that you specify. If your userid is not in the OSDBA or OSOPER groups, and you are not in the password file, then the connection will fail.