Role-based access control in Microservices - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Role Hierarchies in RBAC

In a microservices system using Role-Based Access Control (RBAC), which statement best describes the role hierarchy concept?

A Role hierarchy means roles are assigned randomly without any structure or inheritance.

B Roles are independent and do not share permissions; each role must be assigned permissions explicitly without inheritance.

C Higher roles inherit permissions from lower roles, allowing users with higher roles to access all resources of lower roles.

D Lower roles inherit permissions from higher roles, so users with lower roles can access resources of higher roles.

💡 Hint

Think about how managers have more access than employees in a company.

In RBAC, higher roles inherit permissions from lower roles, so users with higher roles automatically get all permissions of the roles below them.

❓ Architecture

intermediate

Designing RBAC in Microservices

Which architecture best supports centralized role management and decentralized permission enforcement in a microservices environment?

A Each microservice manages its own roles and permissions independently without a central authority.

B A central authorization service manages roles and permissions; each microservice queries it to enforce access control locally.

C Roles and permissions are hardcoded in each microservice's codebase with no external management.

D A central database stores user data but roles and permissions are managed by clients.

💡 Hint

Think about separating management and enforcement responsibilities.

Centralizing role management simplifies updates and consistency, while local enforcement in microservices reduces latency and dependency.

❓ scaling

advanced

Scaling RBAC for Millions of Users

When scaling RBAC for millions of users across many microservices, which approach best reduces latency and load on the central authorization service?

A Use short-lived access tokens containing user roles and permissions, validated locally by microservices without querying central service each time.

B Require every microservice to query the central authorization service for each user request to get fresh permissions.

C Store all user roles and permissions in each microservice's local database and sync daily with central service.

D Disable RBAC and rely on network firewalls to restrict access.

💡 Hint

Think about caching permissions securely to avoid repeated calls.

Embedding roles in short-lived tokens allows microservices to verify permissions quickly without frequent central queries, improving performance and scalability.

❓ tradeoff

advanced

Tradeoffs in RBAC Permission Granularity

What is a key tradeoff when choosing very fine-grained permissions in an RBAC system for microservices?

A Fine-grained permissions increase security but add complexity and overhead in managing many permissions.

B Fine-grained permissions reduce security risks and simplify management.

C Fine-grained permissions eliminate the need for roles entirely.

D Fine-grained permissions always improve system performance.

💡 Hint

Consider how many permissions you must track and update.

More detailed permissions improve control but require more effort to maintain and can slow down authorization checks.

❓ estimation

expert

Estimating Capacity for RBAC Authorization Service

You design a central RBAC authorization service for a system with 10 million users and 100 microservices. Each user makes on average 5 requests per second requiring authorization. Estimate the number of authorization checks per second the service must handle if all microservices query it directly.

A 1 million authorization checks per second

B 500 thousand authorization checks per second

C 5 million authorization checks per second

D 50 million authorization checks per second

💡 Hint

Multiply users, requests per second, and microservices.

Each user makes 5 requests/sec, 10 million users total = 50 million requests/sec. If each request queries the central service, it must handle 50 million checks/sec.