Unified Auditing in Oracle 23ai consolidates audit records into a single trail, managed via the DBMS_AUDIT_MGMT package. Let's evaluate each option with extensive detail:
A . Only viewed audit records can be purged from Unified Audits.
False. There's no concept of ''viewed'' audit records restricting purging. Unified Audit records (stored in UNIFIED_AUDIT_TRAIL) can be purged based on time, policy, or manual intervention, regardless of whether they've been viewed. This option misrepresents audit management capabilities.
Mechanics:Purging is controlled by retention policies or explicit commands, not view status. For example, records older than a set retention period (e.g., 90 days via DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_PROPERTY) are eligible for purging.
Why Incorrect:No Oracle documentation ties purging to viewing, making this a fabricated limitation.
B . Use DBMS_AUDIT_MGMT.CREATE_PURGE_JOB as a privileged user toschedule an automatic purge job.
True. This procedure creates a scheduled job to automatically purge audit records based on a retention policy or custom criteria. It's a standard method for ongoing audit trail maintenance, requiring privileges like AUDIT_ADMIN.
Mechanics:Example: BEGIN DBMS_AUDIT_MGMT.CREATE_PURGE_JOB(AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED, JOB_FREQUENCY => 'DAILY', JOB_STATUS => DBMS_AUDIT_MGMT.JOB_ENABLED); END;. This schedules daily purges of old records, using the retention period set by SET_AUDIT_TRAIL_PROPERTY.
Practical Use:Ideal for production environments to prevent the audit trail from growing indefinitely (e.g., avoiding tablespace exhaustion in SYSAUX).
Edge Case:If no retention period is set, the job purges nothing until configured, highlighting the need for prior setup.
C . Only the owner of a Unified Audit Policy can purge audit records by resetting the policy.
False. Audit policies don't have ''owners'' in the traditional sense; they're created by users with AUDIT_ADMIN and managed globally. Resetting or disabling a policy (e.g., NOAUDIT POLICY my_policy) stops auditing but doesn't purge existing records. Purging is a separate operation via DBMS_AUDIT_MGMT.
Why Incorrect:This conflates policy management with audit trail cleanup, which are distinct in Oracle.
D . Use DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL as a privileged user to manually purge audit records.
True. This procedure manually purges all Unified Audit records up to the current timestamp (or a specified time), requiring AUDIT_ADMIN privileges. It's a one-time cleanup tool.
Mechanics:Example: BEGIN DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL(AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED, USE_LAST_ARCH_TIMESTAMP => FALSE); END;. This clears the entire trail unless restricted by a timestamp.
Practical Use:Useful for immediate space reclamation or post-incident cleanup, unlike scheduled jobs.
Edge Case:If the audit trail is large, this may require significant undo space and time, potentially impacting performance.
