In one of your databases, unified auditing is enabled and an SH.SALES table exists. You successfully execute these commands: SQL> CREATE AUDIT POLICY sales_pol ACTIONS select on sh.sales; SQL> AUDIT…

Question

Options

• AIt is enabled for all users having SELECT privilege on SH.SALES.
• BOnly successful queries of SH.SALES are written to the audit trail.
• CIt is only enabled for user SH.
• DAudit records are always stored in an external audit file.

• A
  89% (24)
• B
  7% (2)
• D
  4% (1)

Explanation

When AUDIT POLICY sales_pol is enabled without a BY username clause, Oracle applies the policy to all database users - not just the schema owner. This means any user who executes a SELECT on SH.SALES will have that action recorded, making A correct.

Why the distractors are wrong:

• B is wrong because omitting WHENEVER SUCCESSFUL or WHENEVER NOT SUCCESSFUL means Oracle audits both successful and failed attempts by default - not just successes.
• C is wrong because the BY SH clause was never specified. To restrict the policy to a single user, you must explicitly add AUDIT POLICY sales_pol BY SH.
• D is wrong because unified auditing writes records to the AUDSYS.AUD$UNIFIED internal table (queried via UNIFIED_AUDIT_TRAIL), not to external OS files - that behavior belongs to traditional (non-unified) auditing.

Memory tip: Use the phrase "No BY = everybody, no WHEN = everything." If the AUDIT POLICY command lacks a BY clause, all users are covered; if it lacks a WHENEVER clause, both successes and failures are captured.

No community discussion yet for this question.