Custom role creation in MongoDB - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a custom role named "readWriteReports".

MongoDB

db.createRole({ role: "readWriteReports", privileges: [], [1]: ["read"] })

Drag options to blanks, or click blank then click option'

Apermissions

Bactions

Croles

Dusers

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'actions' instead of 'roles' causes an error.

Leaving out the roles field results in incomplete role definition.

The roles field defines inherited roles for the new custom role.

2fill in blank

medium

Complete the code to add a privilege that allows reading from the "reports" collection.

MongoDB

db.createRole({ role: "readReports", privileges: [{ resource: { db: "analytics", collection: "reports" }, [1]: ["find"] }], roles: [] })

Drag options to blanks, or click blank then click option'

Aactions

Bprivileges

Cpermissions

Droles

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'permissions' instead of 'actions' causes the role to not work.

Putting 'actions' outside the privilege object causes syntax errors.

The actions field lists the operations allowed on the specified resource.

3fill in blank

hard

Fix the error in the role creation by completing the missing field for resource specification.

MongoDB

db.createRole({ role: "writeLogs", privileges: [{ [1]: { db: "logsDB", collection: "logs" }, actions: ["insert", "update"] }], roles: [] })

Drag options to blanks, or click blank then click option'

Atarget

Bresources

Cprivilege

Dresource

Attempts:

3 left

💡 Hint

Common Mistakes

Using plural 'resources' causes the command to fail.

Using 'privilege' or 'target' is invalid in this context.

The field resource specifies the database and collection the privileges apply to.

4fill in blank

hard

Fill in the blank to create a role that inherits from "read" and "write" roles.

MongoDB

db.createRole({ role: "readWrite", privileges: [], [1]: ["read", "write"] })

Drag options to blanks, or click blank then click option'

Aroles

Bprivileges

Cactions

Dpermissions

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'privileges' or 'actions' instead of 'roles' causes errors.

The roles field is an array listing roles this custom role inherits from.

5fill in blank

hard

Fill all three blanks to create a role with a privilege allowing "remove" action on "temp" collection in "testDB".

MongoDB

db.createRole({ role: "tempRemover", privileges: [{ [1]: { db: [2], collection: [3] }, actions: ["remove"] }], roles: [] })

Drag options to blanks, or click blank then click option'

Aresource

B"testDB"

C"temp"

D"logsDB"

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong field name instead of 'resource' causes failure.

Using wrong database or collection names causes unexpected behavior.

The resource field specifies the database and collection. Here, db is "testDB" and collection is "temp".

Practice

1. What is the main purpose of creating a custom role in MongoDB?

easy

A. To speed up database queries

B. To assign specific permissions tailored to user needs

C. To backup the database automatically

D. To create new collections in the database

Solution

1. Step 1: Understand role purpose

   Custom roles are designed to control what actions a user can perform.

2. Step 2: Match purpose to options

   Only To assign specific permissions tailored to user needs describes assigning specific permissions tailored to user needs.

3. Final Answer:

   To assign specific permissions tailored to user needs -> Option B

4. Quick Check:

   Custom role purpose = Assign specific permissions [OK]

Hint: Custom roles control user permissions precisely [OK]

Common Mistakes:

• Confusing roles with database backups
• Thinking roles speed up queries
• Assuming roles create collections

2. Which of the following is the correct syntax to create a custom role named readWriteReports with read and write privileges on the reports database?

easy

A. db.createRole({role: "readWriteReports", privileges: [{resource: {db: "reports"}, actions: ["readWrite"]}], roles: []})

B. db.createRole({role: "readWriteReports", privileges: [{resource: {db: "reports", collection: ""}, actions: ["find", "insert", "update"]}], roles: []})

C. db.createRole({name: "readWriteReports", privileges: [{resource: {db: "reports", collection: ""}, actions: ["find", "insert", "update"]}], roles: []})

D. db.createRole({name: "readWriteReports", privileges: [{resource: {db: "reports"}, actions: ["readWrite"]}], roles: []})

Solution

1. Step 1: Check correct field names

   The field for role name is name, not role.

2. Step 2: Verify privileges structure

   Privileges must specify resource with db and collection, and actions as an array of strings.

3. Final Answer:

   db.createRole({name: "readWriteReports", privileges: [{resource: {db: "reports", collection: ""}, actions: ["find", "insert", "update"]}], roles: []}) -> Option C

4. Quick Check:

   Use 'name' for role name and specify privileges correctly [OK]

Hint: Use 'name' key for role name in createRole [OK]

Common Mistakes:

• Using 'role' instead of 'name' for role name
• Omitting collection field in resource
• Using 'readWrite' as action instead of specific actions

3. Given the following command, what will be the effect of the custom role limitedUser?

db.createRole({
  name: "limitedUser",
  privileges: [
    { resource: { db: "sales", collection: "orders" }, actions: ["find"] }
  ],
  roles: []
})

medium

A. User has no permissions on sales.orders collection

B. User can read and write on sales.orders collection

C. User can perform any action on sales database

D. User can only read documents from sales.orders collection

Solution

1. Step 1: Analyze privileges actions

   The action specified is only "find", which means read access.

2. Step 2: Understand resource scope

   The resource is the "orders" collection in the "sales" database, so permissions apply only there.

3. Final Answer:

   User can only read documents from sales.orders collection -> Option D

4. Quick Check:

   Action 'find' = read only on specified collection [OK]

Hint: Action 'find' means read-only permission [OK]

Common Mistakes:

• Assuming 'find' allows write operations
• Thinking permissions apply to whole database
• Confusing empty roles array as full access

4. Identify the error in this custom role creation command:

db.createRole({
  name: "dataEditor",
  privileges: [
    { resource: { db: "analytics", collection: "reports" }, actions: "update" }
  ],
  roles: []
})

medium

A. The 'actions' field should be an array, not a string

B. The 'resource' field is missing the database name

C. The 'name' field should be 'role'

D. The 'roles' array cannot be empty

Solution

1. Step 1: Check 'actions' field type

   The 'actions' field must be an array of strings, but here it is a single string "update".

2. Step 2: Verify other fields

   The 'resource' includes both db and collection correctly; 'name' is correct; 'roles' can be empty.

3. Final Answer:

   The 'actions' field should be an array, not a string -> Option A

4. Quick Check:

   'actions' must be an array [OK]

Hint: Always use array for 'actions' even if one action [OK]

Common Mistakes:

• Using string instead of array for 'actions'
• Confusing 'name' with 'role' field
• Thinking 'roles' array cannot be empty

5. You want to create a custom role reportManager that allows users to read all collections in the reports database and also run the aggregate action on the summary collection only. Which of the following commands correctly implements this?

hard

A. db.createRole({name: "reportManager", privileges: [{resource: {db: "reports", collection: ""}, actions: ["find"]}, {resource: {db: "reports", collection: "summary"}, actions: ["aggregate"]}], roles: []})

B. db.createRole({name: "reportManager", privileges: [{resource: {db: "reports"}, actions: ["find"]}, {resource: {db: "reports", collection: "summary"}, actions: ["aggregate"]}], roles: []})

C. db.createRole({name: "reportManager", privileges: [{resource: {db: "reports", collection: "summary"}, actions: ["find", "aggregate"]}], roles: []})

D. db.createRole({name: "reportManager", privileges: [{resource: {db: "reports", collection: ""}, actions: ["find", "aggregate"]}], roles: []})

Solution

1. Step 1: Understand the requirements

   Users must have read (find) access on all collections in 'reports' and aggregate only on 'summary' collection.

2. Step 2: Check privileges for all collections

   Using collection: "" means all collections in the database, so first privilege grants find on all collections.

3. Step 3: Check aggregate privilege on summary

   Second privilege grants aggregate only on 'summary' collection.

4. Final Answer:

   db.createRole({name: "reportManager", privileges: [{resource: {db: "reports", collection: ""}, actions: ["find"]}, {resource: {db: "reports", collection: "summary"}, actions: ["aggregate"]}], roles: []}) -> Option A

5. Quick Check:

   Separate privileges for all collections and specific collection actions [OK]

Hint: Use empty string for all collections, specify collection for specific actions [OK]

Common Mistakes:

• Using db only without collection for find
• Combining find and aggregate on all collections
• Missing separate privilege for aggregate on summary