Creating users and roles in MongoDB - Practice Exercises

Challenge - 5 Problems

❓ query_result

intermediate

What is the output of this user creation command?

Consider the following MongoDB command to create a user with readWrite role on the 'sales' database:

db.createUser({
  user: "salesUser",
  pwd: "pass123",
  roles: [{ role: "readWrite", db: "sales" }]
})

What will be the result of running this command if the user does not exist yet?

MongoDB

db.createUser({ user: "salesUser", pwd: "pass123", roles: [{ role: "readWrite", db: "sales" }] })

A User 'salesUser' is created with readWrite access on 'sales' database and a success message is returned.

B SyntaxError: Missing parentheses in function call.

C AuthenticationFailed: Cannot create user without admin privileges.

D User 'salesUser' is created but has no roles assigned.

💡 Hint

Creating a user with roles requires specifying the role and database correctly.

The command creates a new user named 'salesUser' with password 'pass123' and assigns the readWrite role on the 'sales' database. MongoDB returns a success message if the user is created successfully.

📝 Syntax

intermediate

Which command correctly creates a role with read-only access on the 'inventory' database?

You want to create a custom role named 'inventoryRead' that allows reading any collection in the 'inventory' database. Which of the following commands is syntactically correct?

A db.createRole({ role: "inventoryRead", privileges: [{ resource: { db: "inventory", collection: "all" }, actions: ["find"] }], roles: [] })

B db.createRole({ role: "inventoryRead", privileges: [{ resource: { db: "inventory" }, actions: ["find"] }], roles: [] })

C db.createRole({ role: "inventoryRead", privileges: [{ resource: { db: "inventory", collection: "" }, actions: ["find"] }], roles: [] })

D db.createRole({ name: "inventoryRead", privileges: [{ resource: { db: "inventory", collection: "*" }, actions: ["read"] }], roles: [] })

💡 Hint

The 'collection' field should be an empty string to specify all collections.

Option C correctly uses 'role' as the field name, specifies the 'find' action for read access, and uses an empty string for 'collection' to mean all collections in the 'inventory' database.

❓ optimization

advanced

How to optimize role assignment for multiple databases?

You want to create a user who has readWrite access on both 'sales' and 'marketing' databases. Which command is the most efficient and correct way to assign these roles during user creation?

A db.createUser({ user: "multiDBUser", pwd: "pass456", roles: [{ role: "readWrite", db: "sales" }, { role: "readWrite", db: "marketing" }] })

B db.createUser({ user: "multiDBUser", pwd: "pass456", roles: [{ role: "readWrite", db: "sales,marketing" }] })

C db.createUser({ user: "multiDBUser", pwd: "pass456", roles: [{ role: "readWrite" }] })

D db.createUser({ user: "multiDBUser", pwd: "pass456", roles: ["readWrite"] })

💡 Hint

Each role must specify a single database.

Option A correctly assigns readWrite role separately for each database. Option A is invalid because 'db' cannot list multiple databases as a string. Options C and D lack database specification or proper role structure.

🔧 Debug

advanced

Why does this role creation command fail?

You run this command to create a role:

db.createRole({
  role: "dataAnalyst",
  privileges: [{ resource: { db: "analytics", collection: "reports" }, actions: ["find", "update"] }],
  roles: [{ role: "read", db: "analytics" }]
})

But it fails with an error. What is the most likely cause?

A The 'actions' array contains 'update' which is not a valid action.

B The 'roles' array references a role 'read' which is invalid; it should be 'readAnyDatabase' or 'readWrite'.

C The role 'read' does not exist; it should be 'readAnyDatabase'.

D The 'roles' array should be empty when privileges are specified.

💡 Hint

Check the validity of roles referenced inside the roles array.

The built-in role is 'read' only at the database level, but when specifying roles inside createRole, the role name must be exact and valid. 'read' is valid only if it exists on the specified database. If it does not, the command fails. Usually, 'read' is valid, but if the database or role is misspelled or missing, it causes failure. Here, the error is caused by referencing a role that does not exist or is misspelled.

🧠 Conceptual

expert

What is the effect of assigning the 'root' role to a user?

In MongoDB, if you create a user and assign the built-in 'root' role, what does this role allow the user to do?

A The user has read-only access to all databases.

B The user can only read and write data on the admin database.

C The user can only create and delete collections but cannot manage users.

D The user can perform any action on any database, including user and role management.

💡 Hint

Think about the highest level of access in MongoDB.

The 'root' role is the highest built-in role in MongoDB. It grants full administrative privileges across all databases, including the ability to manage users, roles, and perform any database operation.