Which three are true about unified auditing in full mode?

Question

Options

• AThe unified audit trail is written to a read-only table.
• BThe unified audit trail is written to a read-only external file.
• CAudit records are created for COMMIT, ROLLBACK, and SAVEPOINT statements.
• DAudit records are created for SYS.
• EAudit records are created for non-sys users.

• A
  95% (39)
• B
  2% (1)
• C
  2% (1)

Explanation

In full unified auditing mode, Oracle writes all audit records to AUDSYS.AUD$UNIFIED, an internal read-only table (A) - only the auditing subsystem can write to it, preventing tampering. Full mode audits all database users including SYS (D), which was a significant gap in traditional auditing, and it audits all non-SYS users (E) as well, making coverage truly comprehensive.

B is wrong because the trail goes to an internal table, not an external OS file - external file auditing is a feature of the older traditional audit trail, not unified auditing.

C is wrong because unified auditing does not generate records for TCL statements (COMMIT, ROLLBACK, SAVEPOINT); these transaction-control operations are intentionally excluded from the audit scope.

Memory tip: Think "full mode = full coverage, tamper-proof table." The word full reminds you it covers everyone (SYS + non-SYS), and read-only table (not file) is the distinguishing storage detail - if you see "external file," it's describing the old-style OS audit, not unified auditing.

No community discussion yet for this question.