Apache Ranger for authorization in Hadoop - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to start the Apache Ranger service.

Hadoop

sudo systemctl [1] ranger-admin

Drag options to blanks, or click blank then click option'

Astop

Bstatus

Cstart

Drestart

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'stop' instead of 'start' will shut down the service.

Using 'status' only checks if the service is running.

The command sudo systemctl start ranger-admin starts the Apache Ranger admin service.

2fill in blank

medium

Complete the code to list all Ranger policies using the REST API with curl.

Hadoop

curl -u admin:admin123 -X GET http://localhost:[1]/service/public/v2/api/policy

Drag options to blanks, or click blank then click option'

A6080

B8080

C9090

D7070

Attempts:

3 left

💡 Hint

Common Mistakes

Using port 8080 or 9090 will fail to connect to Ranger admin.

Port 7070 is not the default for Ranger REST API.

Apache Ranger admin REST API typically runs on port 6080.

3fill in blank

hard

Fix the error in the Ranger policy JSON to allow access to the 'data_lake' resource.

Hadoop

{
  "policyName": "AccessDataLake",
  "service": "hdfs",
  "resources": {
    "path": {
      "values": ["[1]"],
      "isExcludes": false,
      "isRecursive": true
    }
  },
  "policyItems": []
}

Drag options to blanks, or click blank then click option'

Adata_lake

B/data_lake

C/data-lake

Ddata-lake

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting the leading slash causes the policy to not match the resource.

Using dashes instead of underscores changes the path name.

The path resource in Ranger policies requires the full absolute path starting with a slash.

4fill in blank

hard

Fill both blanks to create a Ranger policy that grants 'read' access to user 'alice' on the '/reports' path.

Hadoop

{
  "policyName": "ReadReports",
  "service": "hdfs",
  "resources": {
    "path": {
      "values": ["[1]"],
      "isExcludes": false,
      "isRecursive": false
    }
  },
  "policyItems": [
    {
      "users": ["[2]"],
      "accesses": [
        {"type": "read", "isAllowed": true}
      ]
    }
  ]
}

Drag options to blanks, or click blank then click option'

A/reports

Balice

Cbob

D/data

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect path names or user names will cause the policy to not apply.

Setting 'isRecursive' to true when not needed may grant unintended access.

The path must be '/reports' and the user must be 'alice' to grant read access correctly.

5fill in blank

hard

Fill all three blanks to create a Ranger policy dictionary in Python that maps user 'bob' to 'write' access on '/projects'.

Hadoop

policy = {
  '[1]': 'WriteProjects',
  '[2]': 'hdfs',
  'resources': {
    'path': {
      'values': ['/projects'],
      'isExcludes': False,
      'isRecursive': False
    }
  },
  'policyItems': [
    {
      'users': ['[3]'],
      'accesses': [{'type': 'write', 'isAllowed': True}]
    }
  ]
}

Drag options to blanks, or click blank then click option'

ApolicyName

Bservice

Cbob

Dread

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'read' instead of 'write' for access type is incorrect here.

Mixing up keys and values in the dictionary causes errors.

The keys 'policyName' and 'service' define the policy name and service type. The user is 'bob' for write access.

Practice

1. What is the main purpose of Apache Ranger in a Hadoop ecosystem?

easy

A. To speed up data processing tasks

B. To store large amounts of data efficiently

C. To control who can access data and what actions they can perform

D. To backup data automatically

Solution

1. Step 1: Understand Apache Ranger's role

   Apache Ranger is designed to manage security by controlling access to data.

2. Step 2: Compare options with Ranger's function

   Only To control who can access data and what actions they can perform describes access control, which matches Ranger's purpose.

3. Final Answer:

   To control who can access data and what actions they can perform -> Option C

4. Quick Check:

   Authorization = Access control [OK]

Hint: Remember: Ranger = data access control tool [OK]

Common Mistakes:

• Confusing Ranger with data storage tools
• Thinking Ranger speeds up processing
• Assuming Ranger handles backups

2. Which of the following is the correct way to define a policy in Apache Ranger?

easy

A. Specify users/groups, resources, and allowed actions

B. Write SQL queries to filter data

C. Create MapReduce jobs for data processing

D. Configure Hadoop cluster nodes

Solution

1. Step 1: Identify what a Ranger policy includes

   A policy defines who (users/groups) can do what (actions) on which data (resources).

2. Step 2: Match options to policy components

   Only Specify users/groups, resources, and allowed actions correctly lists these elements.

3. Final Answer:

   Specify users/groups, resources, and allowed actions -> Option A

4. Quick Check:

   Policy = Users + Resources + Actions [OK]

Hint: Policies = users/groups + resources + permissions [OK]

Common Mistakes:

• Confusing policies with SQL queries
• Mixing policy with data processing tasks
• Thinking policies configure cluster hardware

3. Given the following Ranger policy snippet:
{"users": ["alice"], "resources": {"database": "sales"}, "permissions": ["select", "update"]}
What actions can user 'alice' perform on the 'sales' database?

medium

A. Only select data

B. Select and update data

C. Delete data

D. No actions allowed

Solution

1. Step 1: Read the policy details

   User 'alice' is allowed 'select' and 'update' permissions on the 'sales' database.

2. Step 2: Determine allowed actions

   Since both 'select' and 'update' are listed, alice can perform both actions.

3. Final Answer:

   Select and update data -> Option B

4. Quick Check:

   Permissions = select + update [OK]

Hint: Check permissions list carefully for allowed actions [OK]

Common Mistakes:

• Assuming delete permission without it listed
• Ignoring update permission
• Thinking no actions allowed if unsure

4. You created a Ranger policy but users report they cannot access the resource. Which of the following is the most likely error?

medium

A. The policy does not include the correct user or group

B. The Hadoop cluster is down

C. The data is corrupted

D. The policy has too many permissions

Solution

1. Step 1: Analyze why access is denied

   If users cannot access, often the policy lacks their user or group in its definition.

2. Step 2: Evaluate other options

   Cluster down or data corruption would cause broader issues, not just access denial. Too many permissions does not block access.

3. Final Answer:

   The policy does not include the correct user or group -> Option A

4. Quick Check:

   User/group missing = access denied [OK]

Hint: Check user/group inclusion in policy first [OK]

Common Mistakes:

• Blaming cluster or data issues prematurely
• Assuming too many permissions cause denial
• Not verifying policy user/group settings

5. You want to create a Ranger policy that allows group 'data_scientists' to read any table in the 'analytics' database but not modify data. Which permission set should you assign?

hard

A. no permissions

B. select and update permissions

C. all permissions including delete

D. select permission only

Solution

1. Step 1: Understand the requirement

   The group should only read data, which means 'select' permission is needed without any modify permissions.

2. Step 2: Match permissions to requirement

   Only 'select' permission allows reading without modification.

3. Final Answer:

   select permission only -> Option D

4. Quick Check:

   Read only = select permission [OK]

Hint: Read-only access = select permission only [OK]

Common Mistakes:

• Giving update permission when only read is needed
• Assigning all permissions unnecessarily
• Leaving permissions empty causing no access