1Z0-062 · Question #296
Unified auditing is enabled in your database. The HR_ADMIN and OE_ADMIN roles exist and are granted system privileges. You execute the command: SQL>CREATE AUDIT POLICY tab1e_aud PRIVILEGES CREATE…
The correct answer is C. It succeeds and starts capturing only successful SQL statements for all users who have either the. This question asks about the outcome of creating a unified audit policy in an Oracle database that includes both specific system privileges and roles.
Question
Unified auditing is enabled in your database. The HR_ADMIN and OE_ADMIN roles exist and are granted system privileges. You execute the command:
SQL>CREATE AUDIT POLICY tab1e_aud PRIVILEGES CREATE ANY TABLE, DROP ANY TABLE ROLES hr_admin, oe_admin; Which statement is true?
Options
- AIt succeeds and needs to be enabled to capture all SQL statements that require either the specified
- BIt fails because system privileges cannot be granted with roles in the same audit policy.
- CIt succeeds and starts capturing only successful SQL statements for all users who have either the
- DIt fails because the command does not specify when the unified audit policy should be enforced.
How the community answered
(61 responses)- A5% (3)
- B10% (6)
- C82% (50)
- D3% (2)
Why each option
This question asks about the outcome of creating a unified audit policy in an Oracle database that includes both specific system privileges and roles.
While the command succeeds, unified audit policies need to be explicitly enabled using the `AUDIT policy_name` statement after creation, so they do not immediately start capturing. Furthermore, the phrasing 'capture all SQL statements that require' is less precise than auditing actual privilege or role usage.
Unified audit policies are designed to consolidate various audit conditions, including system privileges and roles, into a single policy; therefore, the command does not fail for this reason.
The `CREATE AUDIT POLICY` command successfully defines a unified audit policy that can include both privileges and roles. Once enabled, this policy will capture only successful SQL statements by default for any user who possesses or utilizes the specified `CREATE ANY TABLE`, `DROP ANY TABLE` privileges, or the `HR_ADMIN`, `OE_ADMIN` roles.
Unified audit policies are created and then enabled; they do not require a `WHEN` clause to specify when they should be enforced, as enforcement is managed through the `AUDIT` statement.
Concept tested: Oracle Unified Auditing policy creation
Source: https://docs.oracle.com/en/database/oracle/oracle-database/19/sqlrf/CREATE-AUDIT-POLICY.html#GUID-8E40B0C3-0005-4710-8583-92F6F333284B
Topics
Community Discussion
No community discussion yet for this question.