Custom role creation in MongoDB - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

Output of creating a custom role with specific privileges

You create a custom role in MongoDB with the following command:

db.getSiblingDB('admin').runCommand({
  createRole: "readWriteReports",
  privileges: [
    {
      resource: { db: "reports", collection: "monthly" },
      actions: ["find", "insert"]
    }
  ],
  roles: []
})

What will be the effect of this role when assigned to a user?

A The user can only read documents in the 'monthly' collection of the 'reports' database.

B The user can read and insert documents only in the 'monthly' collection of the 'reports' database.

C The user can perform any action on the 'monthly' collection in all databases.

D The user can read and insert documents in all collections of the 'reports' database.

💡 Hint

Look carefully at the resource specification and the actions allowed.

The role specifies privileges only on the 'monthly' collection in the 'reports' database with 'find' and 'insert' actions. So the user can only read and insert documents there, not elsewhere.

📝 Syntax

intermediate

Identify the syntax error in this custom role creation command

Which option contains a syntax error when creating a custom role in MongoDB?

MongoDB

db.getSiblingDB('admin').runCommand({
  createRole: "dataAnalyst",
  privileges: [
    {
      resource: { db: "analytics", collection: "" },
      actions: ["find", "update"]
    }
  ],
  roles: []
})

A The roles array must contain at least one role; empty array is invalid.

B The createRole field must be an object, not a string.

C The actions array must include 'insert' to be valid.

D The collection field is an empty string, which is invalid syntax.

💡 Hint

Check the resource field values carefully.

An empty string for collection means no collection specified, which is invalid. To specify all collections, use '*' or omit the collection field.

🧠 Conceptual

advanced

Understanding role inheritance in custom roles

You create a custom role 'manager' that inherits from the built-in 'readWrite' role on the 'sales' database. What privileges does the 'manager' role have?

A All privileges on all databases because 'readWrite' is a global role.

B Only the additional privileges defined in 'manager', ignoring 'readWrite'.

C All read and write privileges on the 'sales' database plus any additional privileges defined in 'manager'.

D No privileges until explicitly granted to the 'manager' role.

💡 Hint

Think about how role inheritance works in MongoDB.

When a custom role inherits from another role, it gains all privileges of the inherited role plus any additional privileges defined.

🔧 Debug

advanced

Why does this custom role creation command fail?

Consider this command:

db.getSiblingDB('admin').runCommand({
  createRole: "auditor",
  privileges: [
    {
      resource: { db: "", collection: "logs" },
      actions: ["find"]
    }
  ],
  roles: []
})

Why does this command fail?

A The database field is an empty string, which is invalid.

B The collection name 'logs' is reserved and cannot be used.

C The actions array must include 'insert' to be valid.

D The roles array cannot be empty.

💡 Hint

Check the resource fields for correctness.

The database field cannot be empty. It must specify a valid database name or use '*' for all databases.

❓ optimization

expert

Optimizing custom role privileges for minimal access

You want to create a custom role that allows a user to only update documents in the 'inventory' collection of the 'store' database, but no other actions or collections. Which command achieves this with the least privileges?

A Create a role with privileges on resource {db: 'store', collection: 'inventory'} and actions ['update'].

B Create a role with privileges on resource {db: 'store', collection: '*'} and actions ['update'].

C Create a role with privileges on resource {db: 'store', collection: 'inventory'} and actions ['update', 'find'].

D Create a role with privileges on resource {db: '*', collection: 'inventory'} and actions ['update'].

💡 Hint

Minimize both the resource scope and actions allowed.

Option A restricts privileges exactly to the 'inventory' collection in 'store' database with only 'update' action, minimizing access.