Which three statements are true about ASM Cloud File System (ACFS) auditing?
A.
Audit information gathered by each cluster node can be consolidated into the unified ACFS audit trail.
B.
acfsutil audit archive must be used to archive audit files that are larger than 10MB.
C.
acfsutil audit init must be run by a system administrator.
D.
acfsutil audit purge can be run by an audit manager.
E.
acfsutil audit read marks audit files to indicate that it is safe to purge them.
Explanation:
C: The acfsutil audit init command must be run by the system administrator before enabling auditing for any of the audit sources on a file system.
D: Only an audit manager can run the acfsutil audit purge command.
E: acfsutil audit read marks the audit trail to indicate to the audit manager that the log archive file for the current node has been reviewed, backed up as necessary,
and is safe to purge.
Incorrect Answers:
B: acfsutil audit archive does not address file size.
https://docs.oracle.com/database/121/OSTMG/GUID-DF1A88B0-E86C-4ABB-BDFD-B06DA8D4CBEC.htm#OSTMG90000
A WRONG Each host in the Cloud FS cluster writes to a separate audit file
B WRONG When audit files reach 10 MB, they are considered full and are automatically archived. When a file is archived, it is closed and .bak is appended to the file name. The next audit record is written to a new audit file, enabling auditing to continue without interruption. Files that are not full can be manually archived by using the acfsutil audit archive command.
C,D,E correct
C, D and E is correct!
correct C,D,E
Source:
D81242GC10 Oracle Database 12c: ASM Administration 7-12