Built-in roles (read, readWrite, dbAdmin) in MongoDB - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What does the read role allow a user to do?

In MongoDB, the read built-in role grants specific permissions. Which of the following best describes what a user with the read role can do?

A Read data from all collections in the database but cannot modify any data.

B Read and write data to all collections in the database.

C Manage users and roles for the database.

D Read data and create indexes but cannot write or modify data.

💡 Hint

Think about what 'read' means in terms of data access.

The read role allows users to read data from all collections but does not allow any write or administrative actions.

❓ query_result

intermediate

What operations can a user with the readWrite role perform?

A user is assigned the readWrite role on a MongoDB database. Which of the following actions can this user perform?

A Only read data from collections.

B Manage database users and roles.

C Read and write data, including inserting, updating, and deleting documents.

D Only create indexes but cannot modify data.

💡 Hint

Consider what 'write' implies in addition to 'read'.

The readWrite role allows users to read and modify data, including inserting, updating, and deleting documents.

❓ query_result

advanced

Which actions are allowed by the dbAdmin role in MongoDB?

The dbAdmin role provides administrative privileges on a database. Which of the following actions can a user with this role perform?

A Read and write data in collections.

B Only read data from collections.

C Manage users and roles across all databases.

D Create and drop collections, manage indexes, and view statistics but cannot read or write data.

💡 Hint

Think about administrative tasks that do not involve data modification.

The dbAdmin role allows users to perform administrative tasks like creating or dropping collections and managing indexes but does not grant read or write data permissions.

📝 Syntax

advanced

Which command correctly grants the readWrite role to a user on the sales database?

You want to grant the readWrite role to user alice on the sales database. Which of the following MongoDB shell commands is correct?

A db.grantRolesToUser('alice', [{ role: 'readWrite', db: 'sales' }])

B db.updateUser('alice', { roles: ['readWrite'] })

C db.updateUser('alice', { roles: [{ role: 'readWrite', db: 'sales' }] })

D db.grantRolesToUser('alice', ['readWrite'])

💡 Hint

Check the correct method and format for updating user roles.

The grantRolesToUser method is used to add roles to a user without overwriting existing roles, and roles must be specified as an array of role objects with role and db fields.

🧠 Conceptual

expert

Why should you avoid assigning the dbAdmin role to users who only need to read and write data?

Consider the security and best practices in MongoDB role assignments. Why is it not recommended to assign the dbAdmin role to users who only need to read and write data?

A Because <code>dbAdmin</code> does not allow reading or writing data, so users cannot perform their tasks.

B Because <code>dbAdmin</code> allows managing collections and indexes, which can affect database structure and performance, posing unnecessary risks.

C Because <code>dbAdmin</code> automatically grants access to all databases, which is a security risk.

D Because <code>dbAdmin</code> role expires after 24 hours, causing access issues.

💡 Hint

Think about the principle of least privilege.

Assigning dbAdmin to users who only need data access grants them unnecessary administrative powers that could unintentionally affect database structure or performance.

Practice

1. Which built-in MongoDB role allows a user to only view data without making any changes?

easy

A. root

B. readWrite

C. dbAdmin

D. read

Solution

1. Step 1: Understand the read role

   The read role allows users to view data but not modify it.

2. Step 2: Compare with other roles

   readWrite allows changes, dbAdmin manages settings, root has full access.

3. Final Answer:

   read -> Option D

4. Quick Check:

   View-only permission = read [OK]

Hint: View-only means read role [OK]

Common Mistakes:

• Confusing readWrite with read
• Thinking dbAdmin allows data viewing only
• Assuming root is for read-only

2. Which of the following is the correct way to assign the readWrite role to a user on the database mydb in MongoDB shell?

easy

A. db.grantRolesToUser('username', [{role: 'readWrite', db: 'mydb'}])

B. db.createUser({user: 'username', roles: ['readWrite']})

C. db.grantRolesToUser('username', ['readWrite'])

D. db.grantRolesToUser('username', [{role: 'readWrite', db: 'admin'}])

Solution

1. Step 1: Check syntax for granting roles

   The correct syntax uses db.grantRolesToUser with an array of role objects specifying role and database.

2. Step 2: Validate database name and role format

   db.grantRolesToUser('username', [{role: 'readWrite', db: 'mydb'}]) correctly specifies role as 'readWrite' and database as 'mydb'. db.grantRolesToUser('username', [{role: 'readWrite', db: 'admin'}]) wrongly uses 'admin' database.

3. Final Answer:

   db.grantRolesToUser('username', [{role: 'readWrite', db: 'mydb'}]) -> Option A

4. Quick Check:

   Grant role with role+db object array [OK]

Hint: Use role objects with db name in array for granting roles [OK]

Common Mistakes:

• Passing roles as simple strings without db
• Using wrong database name for the role
• Using createUser instead of grantRolesToUser for existing users

3. Given a user with the dbAdmin role on database sales, which of the following actions can the user perform?

medium

A. Create and drop indexes on collections

B. Insert new documents into collections

C. Read documents from collections

D. Modify documents in collections

Solution

1. Step 1: Understand dbAdmin role capabilities

   The dbAdmin role allows managing database settings like indexes, stats, and users, but not data changes.

2. Step 2: Match actions to role permissions

   Creating/dropping indexes is a dbAdmin task. Inserting, reading, or modifying documents require readWrite or read roles.

3. Final Answer:

   Create and drop indexes on collections -> Option A

4. Quick Check:

   dbAdmin manages indexes, not data changes [OK]

Hint: dbAdmin manages indexes, not data content [OK]

Common Mistakes:

• Assuming dbAdmin can insert or modify data
• Confusing readWrite with dbAdmin
• Thinking dbAdmin can read data

4. You tried to assign the readWrite role to a user with this command:
db.grantRolesToUser('alice', ['readWrite'])
But it failed. What is the likely cause?

medium

A. The user 'alice' does not exist

B. The role array must contain objects with role and db fields

C. The readWrite role does not exist

D. You must use createUser to assign roles

Solution

1. Step 1: Check syntax for grantRolesToUser

   The method requires an array of role objects with role and db fields, not just strings.

2. Step 2: Analyze the given command

   The command uses an array of strings, which is invalid syntax and causes failure.

3. Final Answer:

   The role array must contain objects with role and db fields -> Option B

4. Quick Check:

   Roles must be objects with role and db [OK]

Hint: Roles need role+db objects, not strings [OK]

Common Mistakes:

• Passing roles as strings instead of objects
• Assuming createUser is needed to add roles to existing users
• Ignoring user existence errors

5. You want a user to manage database indexes and view data but not modify documents. Which combination of built-in roles should you assign?

hard

A. readWrite only

B. dbAdmin only

C. read and dbAdmin

D. readWrite and dbAdmin

Solution

1. Step 1: Identify roles for viewing data and managing indexes

   read allows viewing data, dbAdmin allows managing indexes and database settings.

2. Step 2: Exclude roles that allow modifying documents

   readWrite allows modifying documents, which is not desired here.

3. Final Answer:

   read and dbAdmin -> Option C

4. Quick Check:

   View + manage indexes = read + dbAdmin [OK]

Hint: Combine read and dbAdmin to view and manage without edits [OK]

Common Mistakes:

• Using readWrite which allows document changes
• Assigning only dbAdmin which lacks read permission
• Assuming dbAdmin includes readWrite