User account baduser@hostname on your MySQL instance has been compromised. Which two commands stop any new connections using the compromised account? (Choose two.)

Question

Options

• AALTER USER baduser@hostname PASSWORD DISABLED;
• BALTER USER baduser@hostname MAX_USER_CONNECTIONS 0;
• CALTER USER baduser@hostname ACCOUNT LOCK;
• DALTER USER baduser@hostname IDENTIFIED WITH mysql_no_login;
• EALTER USER baduser@hostname DEFAULT ROLE NONE;

• A
  5% (2)
• B
  15% (6)
• C
  73% (29)
• E
  8% (3)

Explanation

ACCOUNT LOCK (C) immediately marks the account so MySQL rejects any new login attempt with an "account is locked" error, while IDENTIFIED WITH mysql_no_login (D) swaps the authentication plugin to one that explicitly refuses all connection attempts at the protocol level - both methods survive server restarts and take effect instantly without dropping existing sessions.

Why the distractors fail:

• A (PASSWORD DISABLED) is not valid MySQL syntax - there is no such clause in ALTER USER.
• B (MAX_USER_CONNECTIONS 0) sets the limit to 0, which MySQL interprets as "use the global default" (unlimited), so it actually removes any per-user cap rather than blocking logins.
• E (DEFAULT ROLE NONE) strips the user's auto-assigned roles on login but does nothing to prevent the connection itself - the attacker can still authenticate, they just land with fewer privileges.

Memory tip: Think "Lock the door or change the lock" - ACCOUNT LOCK slams the door shut, and mysql_no_login replaces the lock with one that has no key. Both stop entry; the other options only rearrange furniture inside the house.

No community discussion yet for this question.