You are asked to examine user accounts and find: `` mysql> select user,host,plugin,authentication_string from user…

Question

mysql> select user,host,plugin,authentication_string from user;
+------------------+-----------------------------+-----------------------+-------------------------------------------+
| user | host | plugin | authentication_string |
+------------------+-----------------------------+-----------------------+-------------------------------------------+
| root | localhost | mysql_native_password | *2470CCD6EDEF42FD1618B899005ADCA2EDD1E19 |
| bob | % | mysql_native_password | |
| | localhost | mysql_native_password | *2DCA2EC9D470CE42FD1618B899005ADCA215B899 |
+------------------+-----------------------------+-----------------------+-------------------------------------------+
10 rows in set (0.01 sec)

Options

• ADROP USER ''@'localhost';
• BALTER USER '@'localhost' PASSWORD = 'secret_password';
• CALTER USER bob@'%' IDENTIFIED BY 'secret_password';
• DALTER USER 'root'@'localhost' ACCOUNT LOCK;
• EALTER USER bob PASSWORD = 'secret_password';
• FREVOKE ALL PRIVILEGES FROM ''@'localhost';

• A
  4% (1)
• C
  58% (15)
• D
  4% (1)
• E
  19% (5)
• F
  15% (4)

Explanation

Option C is correct because bob@'%' has an empty authentication_string (no password), making it trivially accessible from any host - ALTER USER bob@'%' IDENTIFIED BY 'secret_password' uses the proper modern MySQL syntax and correctly scopes the fix to the exact account (user + host pair). The likely second correct answer is A, since the anonymous account ''@localhost is a well-known security risk that grants unauthenticated access; DROP USER ''@'localhost' removes it entirely, which is safer than just revoking privileges (F), because the account itself still exists after a revoke.

Why the distractors fail:

• B has malformed syntax ('@'localhost' is missing the opening quote for the username) and uses the deprecated PASSWORD = form.
• D locks root out of the system without addressing the real vulnerabilities (bob's missing password and the anonymous account).
• E omits the host clause, making it ambiguous, and also uses the deprecated PASSWORD = syntax instead of IDENTIFIED BY.
• F revokes privileges but leaves the anonymous account alive - a determined attacker can still connect.

Memory tip: In MySQL security questions, look for three red flags: empty authentication_string (no password), anonymous users (''@...), and accounts with wildcard hosts (%). The correct fix for an empty password is always IDENTIFIED BY, and the correct fix for an anonymous account is DROP USER, not REVOKE.

No community discussion yet for this question.