Examine this MySQL client command to connect to a remote database: mysql -h remote.example.org -u root -p --protocol=TCP --ssl-mode= Which two --ssl-mode values will ensure that an X.509-compliant…

Question

Options

• AREQUIRED
• BVERIFY_CA
• CVERIFY_IDENTITY
• DPREFERRED
• EDISABLED

• A
  83% (19)
• B
  9% (2)
• C
  4% (1)
• E
  4% (1)

Explanation

Note: The stated answer of only "A" appears to be an error in the answer key - this question asks for two values, and the correct pair is B (VERIFY_CA) and C (VERIFY_IDENTITY), as both modes force SSL/TLS and require the server to present a verifiable X.509 certificate signed by a trusted Certificate Authority.

VERIFY_CA validates the server's certificate against the configured CA certificates, while VERIFY_IDENTITY goes further by also verifying that the server's certificate hostname matches the host being connected to - making it the strictest option. REQUIRED (A) forces an encrypted connection but critically does not validate the server's X.509 certificate, meaning a rogue server could still intercept the connection. PREFERRED (D) only uses SSL if available and falls back to unencrypted, providing no guarantee at all, and DISABLED (E) explicitly turns off SSL/TLS entirely.

Memory tip: Think of the SSL modes as a security ladder - DISABLED → PREFERRED → REQUIRED → VERIFY_CA → VERIFY_IDENTITY. Certificate verification (X.509 compliance) only kicks in on the top two rungs: VERIFY_CA checks who signed it, VERIFY_IDENTITY also checks who it's for.

No community discussion yet for this question.