Unified Auditing in Oracle 23ai consolidates audit records into a single trail, managed via the
DBMS_AUDIT_MGMT package. Let’s evaluate each option with extensive detail:
A . Only viewed audit records can be purged from Unified Audits.
False. There’s no concept of “viewed” audit records restricting purging. Unified Audit records (stored
in UNIFIED_AUDIT_TRAIL) can be purged based on time, policy, or manual intervention, regardless of
whether they’ve been viewed. This option misrepresents audit management capabilities.
Mechanics:Purging is controlled by retention policies or explicit commands, not view status. For
example, records older than a set retention period (e.g., 90 days via
DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_PROPERTY) are eligible for purging.
Why Incorrect:No Oracle documentation ties purging to viewing, making this a fabricated limitation.
B . Use DBMS_AUDIT_MGMT.CREATE_PURGE_JOB as a privileged user toschedule an automatic
purge job.
True. This procedure creates a scheduled job to automatically purge audit records based on a
retention policy or custom criteria. It’s a standard method for ongoing audit trail maintenance,
requiring privileges like AUDIT_ADMIN.
Mechanics:Example: BEGIN DBMS_AUDIT_MGMT.CREATE_PURGE_JOB(AUDIT_TRAIL_TYPE =>
DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED, JOB_FREQUENCY => 'DAILY', JOB_STATUS =>
DBMS_AUDIT_MGMT.JOB_ENABLED); END;. This schedules daily purges of old records, using the
retention period set by SET_AUDIT_TRAIL_PROPERTY.
Practical Use:Ideal for production environments to prevent the audit trail from growing indefinitely
(e.g., avoiding tablespace exhaustion in SYSAUX).
Edge Case:If no retention period is set, the job purges nothing until configured, highlighting the need
for prior setup.
C . Only the owner of a Unified Audit Policy can purge audit records by resetting the policy.
False. Audit policies don’t have “owners” in the traditional sense; they’re created by users with
AUDIT_ADMIN and managed globally. Resetting or disabling a policy (e.g., NOAUDIT POLICY
my_policy) stops auditing but doesn’t purge existing records. Purging is a separate operation via
DBMS_AUDIT_MGMT.
Why Incorrect:This conflates policy management with audit trail cleanup, which are distinct in
Oracle.
D . Use DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL as a privileged user to manually purge audit
records.
True. This procedure manually purges all Unified Audit records up to the current timestamp (or a
specified time), requiring AUDIT_ADMIN privileges. It’s a one-time cleanup tool.
Mechanics:Example: BEGIN DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL(AUDIT_TRAIL_TYPE =>
DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED, USE_LAST_ARCH_TIMESTAMP => FALSE); END;. This
clears the entire trail unless restricted by a timestamp.
Practical Use:Useful for immediate space reclamation or post-incident cleanup, unlike scheduled
jobs.
Edge Case:If the audit trail is large, this may require significant undo space and time, potentially
impacting performance.
E. Use DBMS_AUDIT_MGMT.DELETE_AUDIT_RECORDS('POLICY_NAME') as a privileged user to
manually purge audit records of a specified Unified Policy.
False. No such procedure exists in DBMS_AUDIT_MGMT. The package offers CLEAN_AUDIT_TRAIL
and CREATE_PURGE_JOB, but nothing targets a specific policy’s records by name in this format. You
can filter records in UNIFIED_AUDIT_TRAIL by policy (e.g., SELECT * WHERE
UNIFIED_AUDIT_POLICIES = 'POLICY_NAME'), but purging is all-or-nothing or time-based, not policy-
specific via a single command.
Why Incorrect:This appears to be a fabricated or misinterpreted option, possibly confusing audit
policy management with trail purging.
Reference:Oracle Database Security Guide 23ai, "Managing the Unified Audit Trail"; Oracle Database
PL/SQL Packages and Types Reference 23ai, "DBMS_AUDIT_MGMT Package."
