Which two are true about auditing in an Oracle Database?

Question

Options

• ASYS logon operations are always audited In unified auditing.
• BAll SYS operations are audited by default in unified auditing.
• CNo SYS operations are audited by default In unified auditing.
• DSYS logon operations are always audited in mixed mode auditing.
• ENo SYS operations are audited if audit_sys_operations is set on false in unified auditing.
• FNo SYS operations are audited if audit_sys_operations is set on false in mixed mode auditing.

• A
  16% (9)
• B
  7% (4)
• C
  71% (39)
• D
  4% (2)
• E
  2% (1)

Explanation

In pure unified auditing, Oracle starts with a clean slate - no audit policies are predefined or enabled, so no SYS operations are captured by default, making C correct. In mixed mode auditing, the traditional AUDIT_SYS_OPERATIONS initialization parameter still governs SYS auditing, so setting it to FALSE explicitly suppresses SYS audit records, making F correct.

Why the distractors are wrong:

• A & B overstate unified auditing defaults - nothing about SYS is audited automatically, let alone "always" or "all."
• D is wrong because SYS logon auditing in mixed mode is not unconditional - it depends on AUDIT_SYS_OPERATIONS being TRUE.
• E is a trap: AUDIT_SYS_OPERATIONS is a traditional-auditing parameter and has no effect in unified auditing, so citing it as the reason for no SYS auditing is incorrect (C gives the real reason - no policy exists by default).

Memory tip: Think of it as two separate worlds. In Unified mode, the old parameter is Useless - auditing is policy-driven and nothing runs by default. In Mixed mode, the old parameter Matters - FALSE = no SYS audit. The word "always" (A, D) should be an instant red flag; Oracle auditing is rarely absolute.

No community discussion yet for this question.