OCP Security And Upgrades — 50 Questions

Question 1

When using AutoUpgrade to move to 23ai, which file format is required for the configuration?

Accepted Answer

CFG. AutoUpgrade uses a configuration file in a specific text-based key-value format (cfg file).

Answer

JSON

Answer

YAML

Answer

XML

Question 2

Which command is used to enable Unified Auditing if it was not enabled during installation?

Accepted Answer

Relink the oracle binary with 'unified_audit' and restart. Unified Auditing must be enabled by relinking the Oracle binary and restarting the database.

Answer

ALTER SYSTEM SET AUDIT_TRAIL=UNIFIED;

Answer

ALTER DATABASE ENABLE UNIFIED AUDITING;

Answer

Configure in SQL*Plus using 'audit_sys_operations'

Question 3

When migrating to 23ai, which method allows for the least amount of downtime?

Accepted Answer

Transportable Tablespaces. Transportable Tablespaces combined with Data Guard or GoldenGate typically offers the lowest downtime.

Answer

Full Export/Import

Answer

Upgrade in-place

Answer

Manual Database Re-creation

Question 4

Which command is used to rotate the master key for TDE?

Accepted Answer

ALTER SYSTEM SET ENCRYPTION KEY. ALTER SYSTEM SET ENCRYPTION KEY is used to rotate the master encryption key.

Answer

ALTER SYSTEM ROTATE KEY

Answer

ALTER DATABASE REKEY

Answer

ADMINISTER KEY MANAGEMENT

Question 5

Which parameter in 23ai determines the audit trail destination?

Accepted Answer

AUDIT_FILE_DEST. The AUDIT_TRAIL parameter still exists, but for Unified Auditing, the destination is configured automatically within the audit record storage.

Answer

AUDIT_DESTINATION

Answer

AUDIT_LOG_PATH

Answer

LOG_ARCHIVE_DEST

Question 6

Which privilege allows a user to create and manage Unified Audit Policies?

Accepted Answer

AUDIT SYSTEM. The AUDIT SYSTEM privilege is required to manage audit policies.

Answer

GRANT ANY AUDIT

Answer

MANAGE AUDIT

Answer

CREATE AUDIT POLICY

Question 7

What is the default behavior of the Unified Audit trail in 23ai?

Accepted Answer

Stored in the SYSTEM tablespace. In Oracle Database 23ai, the Unified Audit trail is enabled by default and audit records are written to the AUDSYS schema, which resides in the SYSTEM tablespace by default. This is a change from earlier releases where the audit trail was disabled by default and had to be explicitly enabled. The Unified Audit trail captures audit records in a secure, tamper-resistant format within the database, and the default tablespace for the AUDSYS schema is SYSTEM unless explicitly moved.

Answer

Not stored by default

Answer

Stored in the OS as XML files

Answer

Stored in the UNDO tablespace

Question 8

Which parameter ensures that the listener uses a wallet for SSL?

Accepted Answer

WALLET_LOCATION. The listener.ora file must be configured with the SSL_CLIENT_AUTHENTICATION and WALLET_LOCATION parameters.

Answer

SECURE_CONTROL_LISTENER

Answer

SSL_CIPHER_SUITES

Answer

SSL_SERVER_CERT_DN

Question 9

When migrating to 23ai, which file is used to specify the target home directory in AutoUpgrade?

Accepted Answer

config.cfg. AutoUpgrade uses a configuration file, typically named config.cfg, to define the target Oracle home directory for the upgrade. This file contains parameters such as target_home, which specifies the full path to the new Oracle home. The config file is central to AutoUpgrade's operation, allowing DBAs to script and automate upgrades across multiple databases.

Answer

init.ora

Answer

oratab

Answer

spfile.ora

Question 10

You are upgrading to 23ai. Which feature allows you to perform an upgrade without having to manually patch the OS libraries?

Accepted Answer

AutoUpgrade. Oracle Enterprise Manager (OEM) or Fleet Patching and Provisioning (FPP) can automate the environment preparation.

Answer

SQL Developer

Answer

RMAN

Answer

DBUA

Question 11

Which view displays the list of active Unified Audit policies?

Accepted Answer

AUDIT_UNIFIED_POLICIES. The view that displays the list of active Unified Audit policies is AUDIT_UNIFIED_POLICIES. This view contains information about all unified audit policies that have been created in the database, including their names, whether they are enabled, and other attributes. It is a data dictionary view that is part of the Unified Auditing framework introduced in Oracle Database 12c. Querying this view shows the policies that are defined, and you can filter by enabled status to see active ones.

Answer

UNIFIED_AUDIT_TRAIL

Answer

DBA_AUDIT_POLICIES

Answer

DBA_PRIV_AUDIT_POLICIES

Question 12

Which action is required before applying a PSU (Patch Set Update) to a 23ai database?

Accepted Answer

Take a RMAN backup. It is critical to take a full backup of the database before applying any patches.

Answer

Change the global name

Answer

Stop the database

Answer

Recompile all objects

Question 13

Which tool can be used to monitor the progress of an AutoUpgrade process?

Accepted Answer

AutoUpgrade Job Monitor. The AutoUpgrade Job Monitor is the tool provided with Oracle AutoUpgrade to track the progress of an upgrade job. It displays the status of the job, including the current phase, any errors, and the overall progress, allowing DBAs to monitor long-running upgrades without manually parsing log files. It is accessed through the AutoUpgrade utility itself, often via the -jobmonitor option or the graphical interface.

Answer

ADRCI

Answer

SQL*Plus

Answer

Enterprise Manager

Question 14

You want to audit only the SELECT statements performed by a specific user on a specific table. How is this achieved?

Accepted Answer

Unified Audit Policy with a WHEN clause. Use a Unified Audit Policy with the 'WHEN' clause to filter the user and the 'OBJECT' clause for the table.

Answer

Traditional audit

Answer

Flashback Data Archive

Answer

Database Trigger

Question 15

How do you disable a Unified Audit policy?

Accepted Answer

NOAUDIT POLICY. To disable a Unified Audit policy, you use the NOAUDIT POLICY command. This command deactivates the policy, so it no longer generates audit records. It is the standard way to turn off a unified audit policy that was previously enabled with the AUDIT POLICY command. The syntax is NOAUDIT POLICY policy_name; and you can optionally specify users or conditions.

Answer

ALTER POLICY DISABLE

Answer

DISABLE AUDIT POLICY

Answer

DROP POLICY

Question 16

Which THREE components are involved in TDE master key management?

Accepted Answer

Oracle Wallet. In Transparent Data Encryption (TDE) master key management, the Oracle Wallet (option B) is the secure container that stores the TDE master encryption key and is required to be open for the database to access encrypted data. The Database Instance (option C) is involved because it holds the TDE master key in memory after opening the wallet and uses it to encrypt/decrypt the TDE table keys (or column keys) that protect actual data. The Master Encryption Key (option D) is itself the central component being managed—it is the key stored in the wallet and used by the instance to wrap and unwrap the data encryption keys. Options A and E are not part of TDE master key management: a user profile stores user resource limits and password settings, and an audit policy governs auditing of database actions, neither of which participates in the TDE key hierarchy.

Answer

User profile

Answer

Audit policy

Question 17

Which TWO statements about Unified Auditing are correct?

Accepted Answer

It replaces standard auditing. Option A is correct because Unified Auditing is Oracle's consolidated auditing framework that replaces the older standard auditing (and fine-grained auditing) mechanisms, merging them into a single audit trail stored in the AUDSYS schema. Option D is correct because in Oracle Database 23ai, Unified Auditing is enabled by default, so the mixed-mode configuration of prior releases is no longer required. Option B is wrong because Unified Auditing ships with a large set of predefined audit policies and can be enabled with a single CREATE AUDIT POLICY / AUDIT statement rather than requiring manual setup for every event. Option C is wrong because Unified Auditing is a database feature available across supported platforms, not limited to Linux. Option E is wrong because Unified Auditing applies to all database users and can be scoped by user, role, or privilege, not just SYS.

Answer

It requires manual setup for all events

Answer

It is only for Linux

Answer

It only works with SYS user

Question 18

Which THREE tools can be used to manage security settings?

Accepted Answer

Oracle Security Dashboard. SQL*Plus, EM, and the Oracle Security Dashboard are standard management tools.

Answer

AutoUpgrade

Answer

RMAN

Question 19

Which TWO are benefits of TDE?

Accepted Answer

Helps with compliance. Option A (Helps with compliance) is correct because Transparent Data Encryption (TDE) encrypts the database files at rest using a Database Encryption Key (DEK) protected by a certificate or asymmetric key, which directly satisfies regulatory requirements such as PCI DSS, HIPAA, and GDPR that mandate encryption of stored sensitive data. Option B (Protects data at rest) is correct because TDE performs real-time I/O encryption and decryption of the data and log files (.mdf, .ldf, and backups), ensuring that if the physical media or backup files are stolen, the data cannot be read without the certificate and private key. Option C (Reduces disk space) is not a benefit of TDE; encryption does not compress data and may even slightly increase storage overhead due to encryption metadata. Option D (Simplifies login) is unrelated to TDE, which is a data-at-rest encryption feature and does not change authentication or login mechanisms. Option E (Increases performance) is incorrect because TDE adds encryption/decryption overhead to I/O operations, typically causing a small performance decrease rather than an increase.

Answer

Reduces disk space

Answer

Simplifies login

Answer

Increases performance

Question 20

Which TWO audit trails can be enabled simultaneously?

Accepted Answer

Unified Audit. Unified Audit (A) is correct because it is the modern auditing framework in Oracle Database 12c and later, storing audit records in the AUDSYS schema and controlled by the AUDIT_TRAIL initialization parameter set to DB (or by default in 12c+), and it can run concurrently with legacy auditing. Standard Audit (B) is correct because it is the traditional auditing mechanism controlled by AUDIT_TRAIL=DB, DB_EXTENDED, or OS, and Oracle explicitly supports enabling it at the same time as Unified Auditing, allowing both audit trails to capture activity simultaneously. The remaining options are not valid Oracle audit trail types: Redo log audit (C) is not an auditing feature (redo logs are for recovery, not audit records), Memory audit (D) is not a supported audit trail destination, and Tablespace audit (E) is not a distinct audit trail mechanism in Oracle Database.

Answer

Redo log audit

Answer

Memory audit

Answer

Tablespace audit