Examine this SQL statement: mysql> GRANT r_read@localhost TO mark WITH ADMIN OPTION; Which two are true? (Choose two.)

The correct answer is A. Mark can grant the privileges assigned to the r_read@localhost role to another user. E. ADMIN OPTION allows Mark to drop the role. Important note: The listed correct answers (A, E) appear to be incorrect based on MySQL 8.0 documentation. The actual correct answers are C and D. WITH ADMIN OPTION on a role grant means the grantee (Mark) can grant or revoke that role to/from other users and roles - making C…

Security

Question

Examine this SQL statement:

mysql> GRANT r_read@localhost TO mark WITH ADMIN OPTION; Which two are true? (Choose two.)

Options

AMark can grant the privileges assigned to the r_read@localhost role to another user.
BADMIN OPTION causes the role to be activated by default.
CMark can grant the r_read@localhost role to another user.
DMark can revoke the r_read@localhost role from another role.
EADMIN OPTION allows Mark to drop the role.
FMark must connect from localhost to activate the r_read@localhost role.

How the community answered

(50 responses)

A
84% (42)
B
4% (2)
D
10% (5)
F
2% (1)

Explanation

Important note: The listed correct answers (A, E) appear to be incorrect based on MySQL 8.0 documentation. The actual correct answers are C and D.

WITH ADMIN OPTION on a role grant means the grantee (Mark) can grant or revoke that role to/from other users and roles - making C and D the correct choices.

Why C is correct: Per MySQL 8.0 docs: "A user granted a role WITH ADMIN OPTION can in turn grant or revoke the role to or from other user accounts or roles." Mark can therefore grant r_read@localhost to another user.

Why D is correct: The same clause allows revoking the role from another role, not just from users.

Why the distractors (including the listed "correct" answers) are wrong:

A - WITH ADMIN OPTION grants admin over the role, not permission to individually extract and re-grant the underlying privileges (SELECT, INSERT, etc.) assigned to it.
B - Default activation is controlled by SET DEFAULT ROLE or activate_all_roles_on_login, not ADMIN OPTION.
E - Dropping a role requires DROP ROLE or CREATE ROLE privilege; ADMIN OPTION does not confer this.
F - The @localhost in a role name is part of the role's identifier, not a connection host restriction on the grantee.

Memory tip: Think of WITH ADMIN OPTION as "pass-it-on" permission - Mark can pass the role (not its contents) to others, and take it back. It doesn't grant ownership or creation/deletion rights.

If this question appeared on an Oracle MySQL OCP practice exam, I'd flag it as having an errata - the answer key should read C and D.

Topics

#Role-based access control#GRANT statement#ADMIN OPTION#User authorization

Community Discussion

No community discussion yet for this question.

Full 1Z0-908 Practice