A particular government's security policy is to have very strict data encryption and safety settings. This is done by restricting access based on their own CA authority and limiting access to…

Question

Options

• AA. using GRANT ... REQUIRE X509 AND REQUIRE ISSUER /C=...' AND REQUIRE SUBJECT '/C=....'
• BB. using GRANT USAGE 'X509,....ON . TO user@remotehost IDENTIFIED BY 'secret_password'
• CC. using GRANT ... REQUIRE SSL for a secure connection
• DD. using GRANT USAGE, SSL......ON . TO user@remotehost IDENTIFIED BY 'secret_password'

• A
  74% (29)
• B
  5% (2)
• C
  13% (5)
• D
  8% (3)

Explanation

Option A is correct because it uses both REQUIRE ISSUER and REQUIRE SUBJECT clauses, which together enforce exactly what the policy demands: ISSUER pins the certificate to the government's own CA authority, and SUBJECT restricts access to specific individuals (department members) identified by their certificate's Distinguished Name - neither control is achievable with SSL alone.

Option C (REQUIRE SSL) only ensures an encrypted connection but imposes no restriction on who issued the certificate or which users can connect - any client with any valid certificate would be permitted, which fails the CA-restriction requirement.

Options B and D both use syntactically incorrect or incomplete GRANT statements where X509 or SSL appear as positional arguments rather than as REQUIRE clauses, making them invalid MySQL syntax that would not compile or enforce any meaningful certificate validation.

Memory tip: Think "ISSUER = the factory (your CA), SUBJECT = the worker (your user)" - when a policy says both "our own CA" and "specific people," you need both REQUIRE ISSUER and REQUIRE SUBJECT, which only option A provides.

No community discussion yet for this question.