Examine this command and output: Which two options will improve the security of the MySQL instance? (Choose two.)

Question

Exhibit

Options

• ARemove group read/write privileges from the private_key.pem file.
• BRemove world read privileges from the server-cert.pem certificate file.
• CChange the group ownership of the mysql directory to the mysql user group.
• DRemove world read privileges from the public_key.pem file.
• EChange the parent directory owner and group to mysql.
• FRemove the world read/execute privilege from the accounting directory.

• A
  2% (1)
• B
  2% (1)
• C
  79% (42)
• D
  11% (6)
• F
  6% (3)

Explanation

Changing the group ownership of the mysql directory (C) and its parent directory ownership to mysql (E) directly tighten access control by ensuring only the mysql user and group can interact with critical database files - this is a foundational Linux security principle: processes should own the files they need, nothing more.

Options A and D are distractors because the private and public key files serve authentication purposes where MySQL itself needs read access (removing group read from the private key could break MySQL's own TLS operations, and the public key is intentionally world-readable by design for RSA client auth). Option B is wrong because server-cert.pem is a public certificate - world-readable is expected and correct for TLS negotiation. Option F targets an unrelated "accounting" directory, not the MySQL instance itself.

Memory tip: Think "MySQL owns its home" - the service account (mysql) must own both the data directory and its parent; if anything else owns the house, strangers can walk in. Ownership fixes (C, E) are structural; permission tweaks (A, B, D, F) on individual files are surface-level and don't address the root ownership problem shown in the output.

No community discussion yet for this question.