You enabled an audit policy by issuing the following statements:
SQL> AUDIT POLICY ORA_DATABASE_PARAMETER BY SCOTT;
SQL> AUDIT POLICY ORA_DATABASE_PARAMETER BY SYS, SYSTEM;
For which database users and for which executions is the audit policy now active? Select two.
A.
SYS, SYSTEM
B.
SCOTT
C.
Only for successful executions
D.
Only for failed executions
E.
Both successful and failed executions
Explanation:
* The ORA_DATABASE_PARAMETER policy audits commonly used Oracle
Database parameter settings. By default, this policy is not enabled.
A,E
E – TRUE – check in lab
but when you execute command AUDIT POLICY for on user and in second command for another user then second command not overwrites first command then you have on and two user audit anabled !!!!! – tested in lab !!!
So what is your answer?
AE
A and E appears to be correct
A, B correct.
I did testing :
SQL> select policy_name, enabled_opt, user_name, success, failure from audit_unified_enabled_policies order by 1,2;
POLICY_NAME ENABLED_ USER_NAME SUC FAI
———————————— ——– ———— — —
ORA_DATABASE_PARAMETER BY SYS YES YES
ORA_DATABASE_PARAMETER BY SYSTEM YES YES
ORA_DATABASE_PARAMETER BY SCOTT YES YES
I see all 3 users in your results John, so it is A+B+E
Tested, Its enabled for all the three users and for both successful and failure executions.
ABE are correct.
A,E It cannot be active for SCOTT because another AUDIT POLICY was issued after it was issued for SCOTT, which effectively cancels the policy being applied for SCOTT.
Not B
>> If you run multiple AUDIT statements on the same unified audit policy but specify different BY users, then Oracle Database audits all of these users.
https://docs.oracle.com/database/121/DBSEG/audit_config.htm#DBSEG460
So, ABE
@Relo, the only time the LAST execution of the audit policy statement applies to the last users specified is when you use the EXCEPT keyword.
If you specify the policy in 3 separate SQL statements and specify a different user in each statement, then all 3 users are audited.
If you use the EXCEPT keyword (see question 35) then only the last users are included/excluded and overwrite and previously configured users for the policy
ABE
If you run multiple AUDIT statements on the same unified audit policy but specify different BY users, then Oracle Database audits all of these users.
SQL > AUDIT POLICY some_audit_policy WHENEVER NOT SUCCESSFUL;
If you omit the WHENEVER clause, then both failed and successful user activities are written to the audit trail.
•If you run multiple AUDIT statements on the same unified audit policy but specify different EXCEPT users, then Oracle Database uses the last exception user list, not any of the users from the preceding lists. This means the effect of the earlier AUDIT POLICY … EXCEPT statements are overridden by the latest AUDIT POLICY … EXCEPT statement.
The question should ask “Select 3”
ANS: A, B, E
A, B, E CORRECT.
SQL> AUDIT POLICY ORA_DATABASE_PARAMETER BY SCOTT;
Audit succeeded.
SQL> AUDIT POLICY ORA_DATABASE_PARAMETER BY SYS, SYSTEM;
Audit succeeded.
SQL> select policy_name, enabled_opt, user_name, success, failure from audit_unified_enabled_policies order by 1,2;
POLICY_NAME ENABLED_ USER_NAME SUC FAI
————————————————– ——– —————————— — —
ORA_DATABASE_PARAMETER BY SYSTEM YES YES
ORA_DATABASE_PARAMETER BY SYS YES YES
ORA_DATABASE_PARAMETER BY SCOTT YES YES
ORA_LOGON_FAILURES BY ALL USERS NO YES
ORA_SECURECONFIG EXCEPT DBSNMP YES YES
A,B and E are correct
From the Oracle docs
Notes on the BY and EXCEPT Clauses
The following notes apply to the BY and EXCEPT clauses:
If multiple AUDIT … BY … statements are specified for the same unified audit policy, then the policy is enabled for the union of the users specified in each statement.
If multiple AUDIT … EXCEPT … statements are specified for the same unified audit policy, then only the most recently specified statement takes effect. That is, the policy is enabled for all users except the users specified in the most recent AUDIT … EXCEPT … statement.
If a policy is enabled using the BY clause and you would like to instead enable it using the EXCEPT clause, then you must first use the NOAUDIT … BY … statement to disable the policy for all users for whom the policy is currently enabled, and then enable the policy with the AUDIT … EXCEPT … statement.
If a policy is enabled using the EXCEPT clause and you would like to instead enable it using the BY clause, then you must first use the NOAUDIT statement to disable the audit policy. Note that you cannot specify the EXCEPT clause with the NOAUDIT statement. You can then enable the policy with the AUDIT … BY … statement.
Restriction on the BY and EXCEPT Clauses
You cannot specify an AUDIT … BY … statement and an AUDIT … EXCEPT … statement for the same unified audit policy. If you attempt to do so, then an error occurs.
WHENEVER [NOT] SUCCESSFUL
Specify WHENEVER SUCCESSFUL to audit only SQL statements and operations that succeed.
Specify WHENEVER NOT SUCCESSFUL to audit only SQL statements and operations that fail or result in errors.
If you omit this clause, then Oracle Database performs the audit regardless of success or failure.
ABE
Its A and E
From Oracle Documentation “If you run multiple AUDIT statements on the same unified audit policy but specify different BY users, then Oracle Database audits all of these users.” so AB are correct
It’s truly a great and helpful piece of information. I am glad that you simply shared this useful information with us. Please keep us up to date like this. Thanks for sharing.|
Everything is very open with a really clear description of the issues. It was definitely informative. Your site is extremely helpful. Many thanks for sharing!|
I have read so many posts on the topic of the blogger lovers except this post is truly a good article, keep it up.|