Audit SQL Server Instances Flashcards
What is SQL Server Auditing?
Tracking and logging events.
What are the components to a SQL Server Audit?
Audit (the actions to monitor)
Server Audit Specification
Database Audit Specification
How many audit specifications can you have per server and per database?
One of each.
Where can you send the results of an audit?
File
Windows Security Event Log
Windows Application Event Log
Where can you start an audit?
Server->Security->Audits
What two things do you need to start an audit?
Audit File
Server Audit Specification
What is contained in the Server Audit Specification?
All of the actions that are being audited.
What is contained in the Audit File
It’s basically the header file (where it’s going to be saved, and other settings of the audit file)
What is the system view that gives you current permissions for any given user?
sys.server_permissions
Where can you audit logins without creating an audit file?
Within Server Properties - Login Audit
What is C2 Audit Tracing?
Government Standard Auditing Level All event clusters in audit - Performance hit
What is Common Criteria Compliance?
Residual Information Protection (Information needs to be overwritten) performance hit
Login Auditing
A grant on a column with Deny on a table will equal a deny on a select or update
How can you track who modified an object?
Using a Database level audit
When can you make changes to an audit specification?
When the audit is disabled.
