Using Unified Audit, you must determine who performed an pkan backup ot recovery operations on a database. You are connected as sysdba. Which statement(s) achieve this? A. B. C. D. E.

Question

Options

• Agrant audit_viewer to sys; select RMAN_OPERATION, RMAN_OBJECT_TYPE, DBUSERNAME from unified_audit_trail;
• Bselect RMAN_OPERATION, RMAN_OBJECT_TYPE, DBUSERNAME from unified_audit_trail;
• Cgrant audit_admin to sys; select RMAN_OPERATION, RMAN_OBJECT_TYPE, DBUSERNAME from unified_audit_trail;
• Dcreate audit policy RMAN_poll privileges create session; select RMAN_OPERATION, RMAN_OBJECT_TYPE, DBUSERNAME from unified_audit_trail;
• Ealter system set AUDIT_SYS_OPERATION = TRUE; select RMAN_OPERATION, RMAN_OBJECT_TYPE, DBUSERNAME from unified_audit_trail;

• A
  73% (33)
• B
  16% (7)
• C
  2% (1)
• D
  7% (3)
• E
  2% (1)

Explanation

Option A is correct because SYS - even as SYSDBA - does not have SELECT access on UNIFIED_AUDIT_TRAIL by default, so AUDIT_VIEWER must be explicitly granted first; and crucially, RMAN backup/recovery operations are automatically captured by Unified Audit without needing a custom policy.

Why the distractors are wrong:

• B - Omits the required role grant; querying UNIFIED_AUDIT_TRAIL without AUDIT_VIEWER (or AUDIT_ADMIN) will fail even for SYSDBA.
• C - AUDIT_ADMIN is for managing audit policies (create, enable, disable), not for reading records; AUDIT_VIEWER is the correct least-privilege role for viewing audit data.
• D - RMAN operations need no custom policy; they are pre-defined unified audit actions captured automatically. A policy on CREATE SESSION captures logins, not RMAN activity.
• E - AUDIT_SYS_OPERATION=TRUE belongs to traditional auditing, not Unified Audit - it has no effect on UNIFIED_AUDIT_TRAIL.

Memory tip: "A VIEWER just watches - grant AUDIT_VIEWER when you only need to see the trail, not manage it."

No community discussion yet for this question.