Authentication mechanisms in MongoDB - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

Output of user authentication command

What is the output of the following MongoDB command when authenticating a user with correct credentials?

MongoDB

db.auth('username', 'correct_password')

A 1

B 0

C null

D throws an error

💡 Hint

The auth() method returns 1 on successful authentication.

In MongoDB, the auth() method returns 1 if the username and password are correct, indicating successful authentication.

🧠 Conceptual

intermediate

Default authentication mechanism in MongoDB

Which authentication mechanism does MongoDB use by default when authentication is enabled?

A X.509 certificates

B SCRAM-SHA-256

C Kerberos

D LDAP

💡 Hint

SCRAM is a challenge-response mechanism used by default.

MongoDB uses SCRAM-SHA-256 as the default authentication mechanism since version 4.0 for secure password-based authentication.

📝 Syntax

advanced

Correct syntax for creating a user with SCRAM authentication

Which of the following commands correctly creates a user with SCRAM authentication in MongoDB?

MongoDB

db.createUser({user: 'alice', pwd: 'password123', roles: ['readWrite']})

A db.addUser('alice', 'password123', ['readWrite'])

B db.createUser({username: 'alice', password: 'password123', roles: ['readWrite']})

C db.createUser({user: 'alice', pwd: 'password123', roles: ['readWrite']})

D db.createUser({user: 'alice', password: 'password123', roles: ['readWrite']})

💡 Hint

The correct keys are 'user' and 'pwd' for username and password.

The createUser method requires 'user' and 'pwd' keys to specify username and password respectively. Other keys like 'username' or 'password' are invalid.

🔧 Debug

advanced

Identify the cause of authentication failure

A user tries to authenticate with db.auth('bob', 'wrongpass') but always gets 0. What is the most likely cause?

A The password is incorrect

B The user 'bob' does not exist

C The database is not running

D The user 'bob' has no roles assigned

💡 Hint

db.auth returns 0 when authentication fails due to wrong credentials.

If the user exists but the password is wrong, db.auth returns 0. If the user does not exist, it also returns 0, but the most common cause is wrong password.

❓ optimization

expert

Best practice to secure MongoDB authentication in production

Which option is the best practice to enhance security of MongoDB authentication in a production environment?

A Use default settings without authentication for faster access

B Disable authentication and rely on network firewall only

C Store passwords in plain text for easy retrieval

D Enable SCRAM-SHA-256 and use TLS encryption for connections

💡 Hint

Combining strong authentication with encrypted connections improves security.

Enabling SCRAM-SHA-256 ensures strong password authentication, and TLS encrypts data in transit, protecting credentials and data from interception.

Practice

1. What is the main purpose of authentication in MongoDB?

easy

A. To create indexes on collections

B. To backup the database automatically

C. To optimize query performance

D. To verify the identity of a user before granting access

Solution

1. Step 1: Understand authentication concept

   Authentication means checking who you are before allowing access.

2. Step 2: Identify the purpose in MongoDB

   MongoDB uses authentication to verify user identity to protect data.

3. Final Answer:

   To verify the identity of a user before granting access -> Option D

4. Quick Check:

   Authentication = Verify identity [OK]

Hint: Authentication means checking who you are [OK]

Common Mistakes:

• Confusing authentication with backup
• Thinking authentication improves query speed
• Mixing authentication with indexing

2. Which of the following is the correct syntax to authenticate a user in MongoDB shell?

easy

A. db.auth('username', 'password')

B. db.authenticate('username', 'password')

C. db.login('username', 'password')

D. db.userAuth('username', 'password')

Solution

1. Step 1: Recall MongoDB authentication method

   The correct method to authenticate is db.auth().

2. Step 2: Match syntax with options

   Only db.auth('username', 'password') matches the correct syntax.

3. Final Answer:

   db.auth('username', 'password') -> Option A

4. Quick Check:

   Authenticate = db.auth() [OK]

Hint: Use db.auth() to log in with username and password [OK]

Common Mistakes:

• Using db.authenticate() which does not exist
• Using db.login() which is invalid
• Confusing method names with userAuth()

3. Consider this MongoDB shell command sequence:

use admin
var result = db.auth('alice', 'mypassword')

What will be the value of result if authentication succeeds?

medium

A. 1

B. false

C. true

D. null

Solution

1. Step 1: Understand db.auth() return value

   When authentication succeeds, db.auth() returns 1.

2. Step 2: Match return value with options

   Only 1 matches the expected numeric return value.

3. Final Answer:

   1 -> Option A

4. Quick Check:

   Success returns 1 [OK]

Hint: db.auth() returns 1 if login works [OK]

Common Mistakes:

• Expecting boolean true instead of numeric 1
• Thinking it returns false on success
• Assuming it returns null or undefined

4. You run db.auth('bob', 'wrongpass') but it always returns 1. What is the most likely cause?

medium

A. The user 'bob' does not exist

B. The password is case-insensitive

C. You are already authenticated as 'bob' or another user

D. MongoDB does not check passwords

Solution

1. Step 1: Understand db.auth() behavior when already logged in

   If already authenticated, db.auth() returns 1 without rechecking password.

2. Step 2: Analyze why wrong password still returns 1

   This happens because the session is already authenticated as 'bob' or another user.

3. Final Answer:

   You are already authenticated as 'bob' or another user -> Option C

4. Quick Check:

   Already logged in means db.auth() returns 1 [OK]

Hint: db.auth() returns 1 if already logged in [OK]

Common Mistakes:

• Assuming wrong password always returns false
• Thinking MongoDB ignores passwords
• Believing user must exist for true return

5. You want to create a user with read-only access to the sales database. Which command correctly creates this user with proper authentication roles?

hard

A. db.addUser('readonly', 'pass123', 'read')

B. db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]})

C. db.createUser({username: 'readonly', password: 'pass123', roles: ['read']})

D. db.createUser({user: 'readonly', pwd: 'pass123', roles: ['readWrite']})

Solution

1. Step 1: Identify correct syntax for creating user with roles

   The correct syntax uses db.createUser() with user, pwd, and roles as an array of objects specifying role and database.

2. Step 2: Match read-only role on 'sales' database

   db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]}) correctly assigns role 'read' on database 'sales'.

3. Final Answer:

   db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]}) -> Option B

4. Quick Check:

   Create user with roles array = db.createUser({user: 'readonly', pwd: 'pass123', roles: [{role: 'read', db: 'sales'}]}) [OK]

Hint: Use db.createUser() with roles array for access control [OK]

Common Mistakes:

• Using deprecated db.addUser() method
• Incorrect field names like username instead of user
• Assigning wrong roles like readWrite for read-only access