nerdexam
Oracle

1Z0-060 · Question #209

While investigating a possible security breach, you realized that some audit records were not retrieved when the UNIFIED_AUDIT_TRAIL view was queried. How can you ensure that all available audit…

The correct answer is D. Execute the DBMS_AUDIT_MGMT.FLUSH_INIFIED_AUDIT_TRAIL procedure before querying. Oracle Unified Auditing buffers some audit records in a system global area before writing them to the audit trail table, so querying the view without flushing may miss recently generated records.

New Features for Security

Question

While investigating a possible security breach, you realized that some audit records were not retrieved when the UNIFIED_AUDIT_TRAIL view was queried. How can you ensure that all available audit records are returned when the audit trail is queried?

Options

  • AQuery the v$UNIFIED_AUDIT_TRAIL view rather than the UNIFIED_AUDIT_TRAIL view.
  • BEnable the OS auditing option in the database before querying the view.
  • CConfigure the IMMEDIATE write mode using the DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL view.
  • DExecute the DBMS_AUDIT_MGMT.FLUSH_INIFIED_AUDIT_TRAIL procedure before querying

How the community answered

(24 responses)
  • A
    4% (1)
  • B
    4% (1)
  • C
    13% (3)
  • D
    79% (19)

Why each option

Oracle Unified Auditing buffers some audit records in a system global area before writing them to the audit trail table, so querying the view without flushing may miss recently generated records.

AQuery the v$UNIFIED_AUDIT_TRAIL view rather than the UNIFIED_AUDIT_TRAIL view.

No v$UNIFIED_AUDIT_TRAIL dynamic performance view exists in Oracle; the unified audit trail is accessed through the UNIFIED_AUDIT_TRAIL view, and querying a non-existent view does not resolve the in-memory buffering issue.

BEnable the OS auditing option in the database before querying the view.

Enabling OS auditing directs audit output to operating system audit files rather than the UNIFIED_AUDIT_TRAIL table, and has no effect on flushing or retrieving buffered unified audit records.

CConfigure the IMMEDIATE write mode using the DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL view.

Configuring IMMEDIATE write mode through DBMS_AUDIT_MGMT only affects how future audit records are written and does not retroactively flush audit records that are already buffered in memory but not yet persisted.

DExecute the DBMS_AUDIT_MGMT.FLUSH_INIFIED_AUDIT_TRAIL procedure before queryingCorrect

Executing DBMS_AUDIT_MGMT.FLUSH_UNIFIED_AUDIT_TRAIL forces Oracle to immediately write all in-memory buffered audit records to the UNIFIED_AUDIT_TRAIL table, ensuring that every audit event captured since the last automatic flush is visible when the view is queried.

Concept tested: Flushing in-memory unified audit trail buffer with DBMS_AUDIT_MGMT

Source: https://docs.oracle.com/en/database/oracle/oracle-database/12.2/dbseg/administering-the-audit-trail.html

Topics

#unified audit trail#DBMS_AUDIT_MGMT#audit flush#in-memory audit buffer

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 1Z0-060 Practice