Encryption at rest concept in MongoDB - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of encryption at rest in MongoDB?

Encryption at rest protects data stored on disk. What does it mainly prevent?

A Unauthorized users reading data files directly from the storage device

B Unauthorized users accessing data through the MongoDB query interface

C Data loss due to hardware failure

D Data corruption caused by software bugs

💡 Hint

Think about what happens if someone steals the physical hard drive.

Encryption at rest ensures that if someone gets the physical storage, they cannot read the data without the encryption keys.

❓ query_result

intermediate

What output shows that encryption at rest is enabled in MongoDB?

After running db.adminCommand({ getCmdLineOpts: 1 }), which output indicates encryption at rest is active?

MongoDB

db.adminCommand({ getCmdLineOpts: 1 })

A {"parsed": {"security": {"enableEncryption": false}}}

B {"parsed": {"security": {"enableEncryption": true}}}

C {"parsed": {"storage": {"dbPath": "/data/db"}}}

D {"parsed": {"net": {"bindIp": "127.0.0.1"}}}

💡 Hint

Look for a security setting that shows encryption is turned on.

The presence of "enableEncryption": true under security confirms encryption at rest is enabled.

📝 Syntax

advanced

Which MongoDB configuration snippet correctly enables encryption at rest?

Choose the valid YAML configuration to enable encryption at rest with a key file.

A

security:
  enableEncryption: true
  encryptionKeyFile: /etc/mongodb/keyfile

B

security:
  enableEncryption: yes
  encryptionKeyFile: /etc/mongodb/keyfile

C

security:
  enableEncryption: true
  encryptionKey: /etc/mongodb/keyfile

D

security:
  encryption: true
  encryptionKeyFile: /etc/mongodb/keyfile

💡 Hint

Check the exact option names and boolean values.

The correct keys are enableEncryption set to true and encryptionKeyFile specifying the key file path.

❓ optimization

advanced

How can enabling encryption at rest impact MongoDB performance?

What is a common performance effect when encryption at rest is enabled?

A Lower memory usage by MongoDB

B Reduced network latency for queries

C Faster disk read/write speeds

D Increased CPU usage due to encryption and decryption processes

💡 Hint

Think about what extra work the server does when encrypting data.

Encryption requires CPU cycles to encrypt data before writing and decrypt after reading, increasing CPU load.

🔧 Debug

expert

Why does MongoDB fail to start after enabling encryption at rest with this config?

Given this config snippet, MongoDB fails to start. What is the likely cause?

security:
  enableEncryption: true
  encryptionKeyFile: /etc/mongodb/keyfile
  encryptionCipherMode: AES256-CBC

A encryptionCipherMode must be set to AES128-GCM instead of AES256-CBC

B The encryptionKeyFile path is incorrect and MongoDB cannot read the key

C The cipher mode AES256-CBC is deprecated and not supported in current MongoDB versions

D enableEncryption must be set to false to start MongoDB

💡 Hint

Check MongoDB documentation for supported cipher modes.

MongoDB deprecated AES256-CBC mode; using it causes startup failure. Supported mode is AES256-GCM.

Practice

1. What does encryption at rest mean in MongoDB?

easy

A. Data is encrypted only in the application memory.

B. Data is encrypted when stored on disk to protect it from unauthorized access.

C. Data is encrypted only during query execution.

D. Data is encrypted only when it is sent over the network.

Solution

1. Step 1: Understand encryption at rest meaning

   Encryption at rest means data is protected by encoding it while stored on disk, not just during transfer or processing.

2. Step 2: Identify correct option

   Only Data is encrypted when stored on disk to protect it from unauthorized access. correctly describes encryption at rest as protecting stored data on disk.

3. Final Answer:

   Data is encrypted when stored on disk to protect it from unauthorized access. -> Option B

4. Quick Check:

   Encryption at rest = Data encrypted on disk [OK]

Hint: Encryption at rest means data is safe on disk, not just in transit [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking encryption happens only during queries
• Assuming encryption applies only in memory

2. Which of the following is the correct way to enable encryption at rest in MongoDB?

easy

A. Run a query like db.enableEncryption() in the shell.

B. Use encrypt() command on collections.

C. Configure the MongoDB server with encryption options in the config file.

D. Set encryption flags in the client application code.

Solution

1. Step 1: Know how encryption at rest is enabled

   Encryption at rest is enabled by configuring the MongoDB server settings, not by running queries or client code.

2. Step 2: Match correct method

   Only Configure the MongoDB server with encryption options in the config file. correctly states enabling encryption via server config file.

3. Final Answer:

   Configure the MongoDB server with encryption options in the config file. -> Option C

4. Quick Check:

   Encryption at rest enabled via server config [OK]

Hint: Encryption at rest is a server setting, not a query command [OK]

Common Mistakes:

• Trying to enable encryption using shell queries
• Assuming client code controls encryption at rest
• Confusing encryption at rest with field-level encryption

3. Given MongoDB is configured with encryption at rest enabled, what will happen if the encryption key is lost?

medium

A. Only new data is encrypted; old data remains readable.

B. Data can still be read normally without the key.

C. MongoDB automatically regenerates the key and decrypts data.

D. Data becomes inaccessible and cannot be decrypted.

Solution

1. Step 1: Understand role of encryption key

   The encryption key is essential to decrypt data stored on disk. Losing it means data cannot be read.

2. Step 2: Evaluate options

   Data becomes inaccessible and cannot be decrypted. correctly states data becomes inaccessible without the key. Other options are incorrect because data cannot be read or auto-decrypted without the key.

3. Final Answer:

   Data becomes inaccessible and cannot be decrypted. -> Option D

4. Quick Check:

   Lost key = no data access [OK]

Hint: Without the key, encrypted data is unreadable [OK]

Common Mistakes:

• Assuming MongoDB can recover data without the key
• Thinking only new data is encrypted
• Believing data remains readable without key

4. A MongoDB admin tries to enable encryption at rest by running db.enableEncryption() in the shell but gets an error. What is the likely cause?

medium

A. Encryption at rest cannot be enabled via shell commands; it requires server config changes.

B. The shell command syntax is incorrect; it should be db.enableEncryption(true).

C. Encryption at rest is enabled by default and does not require commands.

D. The admin lacks permissions to run shell commands.

Solution

1. Step 1: Understand how encryption at rest is enabled

   Encryption at rest is a server-level feature enabled via configuration files, not shell commands.

2. Step 2: Identify cause of error

   Trying to enable it via db.enableEncryption() causes error because this command does not exist.

3. Final Answer:

   Encryption at rest cannot be enabled via shell commands; it requires server config changes. -> Option A

4. Quick Check:

   Enable encryption via config, not shell [OK]

Hint: Encryption at rest needs config file, not shell commands [OK]

Common Mistakes:

• Trying to enable encryption with shell commands
• Assuming encryption is on by default
• Blaming permissions instead of wrong method

5. You want to ensure your MongoDB data is encrypted at rest and can be recovered safely. Which combination of steps is best practice?

hard

A. Enable encryption at rest in server config and securely manage encryption keys separately.

B. Encrypt data manually in application code and store keys in the database.

C. Use shell commands to enable encryption and keep keys in the same server folder.

D. Rely on MongoDB default settings without managing keys.

Solution

1. Step 1: Understand encryption at rest best practices

   Encryption at rest should be enabled via server config, and keys must be managed securely outside the database for safety and recovery.

2. Step 2: Evaluate options for key management and encryption

   Enable encryption at rest in server config and securely manage encryption keys separately. correctly combines enabling encryption at rest with secure key management. Other options either misuse shell commands, store keys insecurely, or rely on defaults.

3. Final Answer:

   Enable encryption at rest in server config and securely manage encryption keys separately. -> Option A

4. Quick Check:

   Config encryption + secure keys = best practice [OK]

Hint: Enable encryption in config and keep keys safe separately [OK]

Common Mistakes:

• Storing keys inside the database
• Trying to enable encryption via shell commands
• Ignoring key management importance