Role-based access control in MongoDB - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

Find users with the 'readWrite' role on the 'sales' database

Given a MongoDB collection system.users that stores user roles, which query returns all users who have the readWrite role on the sales database?

MongoDB

db.system.users.find({ roles: { $elemMatch: { role: 'readWrite', db: 'sales' } } })

A db.system.users.find({ roles: { $elemMatch: { role: 'readWrite', db: 'sales' } } })

B db.system.users.find({ roles: { role: 'readWrite', db: 'sales' } })

C db.system.users.find({ 'roles.role': 'readWrite', 'roles.db': 'sales' })

D db.system.users.find({ roles: { $all: [ { role: 'readWrite' }, { db: 'sales' } ] } })

💡 Hint

Use $elemMatch to match both role and db in the same array element.

The $elemMatch operator matches array elements that satisfy all specified conditions together. Option A correctly finds users with a role of 'readWrite' on the 'sales' database.

🧠 Conceptual

intermediate

Understanding role inheritance in MongoDB

Which statement best describes how role inheritance works in MongoDB's role-based access control?

A Role inheritance only applies to system roles, not user-defined roles.

B Roles cannot inherit privileges; each role is independent and must be assigned separately.

C Roles can inherit privileges from other roles, allowing users to gain all privileges of the inherited roles.

D Inheritance is automatic for all roles assigned to a user, but privileges do not combine.

💡 Hint

Think about how MongoDB allows roles to build on each other.

MongoDB supports role inheritance, where a role can include privileges from other roles. This helps simplify privilege management.

📝 Syntax

advanced

Identify the syntax error in creating a custom role

Which option contains a syntax error when creating a custom role with privileges on the inventory collection?

MongoDB

db.createRole({ role: 'inventoryManager', privileges: [ { resource: { db: 'store', collection: 'inventory' }, actions: ['find', 'update'] } ], roles: [] })

A db.createRole({ role: 'inventoryManager', privileges: [ { resource: { db: 'store', collection: 'inventory' }, actions: ['find'] } ], roles: [] })

B db.createRole({ role: 'inventoryManager', privileges: [ { resource: { db: 'store', collection: 'inventory' }, actions: ['find', 'update'] } ], roles: [] })

C db.createRole({ role: 'inventoryManager', privileges: [ { resource: { db: 'store', collection: 'inventory' }, actions: ['find', 'update'] } ] })

D db.createRole({ role: 'inventoryManager', privileges: { resource: { db: 'store', collection: 'inventory' }, actions: ['find', 'update'] }, roles: [] })

💡 Hint

Check the type of privileges field; it should be an array.

Option D assigns privileges as an object instead of an array, causing a syntax error. It must be an array of privilege documents.

🔧 Debug

advanced

Why does this user lack expected privileges?

A user was assigned the role readWrite on the reports database, but cannot insert documents into the reports collection. What is the most likely cause?

A The user was assigned the role on the wrong database; roles are database-specific.

B The user needs to be assigned the <code>read</code> role instead of <code>readWrite</code>.

C The user must be assigned the <code>dbAdmin</code> role to insert documents.

D The <code>readWrite</code> role does not include insert privileges.

💡 Hint

Remember that roles apply to specific databases in MongoDB.

Roles in MongoDB are scoped to a database. If the user was assigned readWrite on a different database, they won't have insert privileges on reports.

❓ optimization

expert

Optimize role assignments for multiple users with overlapping privileges

You have multiple users needing similar but slightly different privileges on the finance database. What is the best approach to minimize management overhead while ensuring correct access?

A Create one large role with all possible privileges and assign it to all users regardless of their needs.

B Create a base role with common privileges and create additional roles that inherit from it for specific needs, then assign these roles to users.

C Use only built-in roles and assign multiple roles to each user to cover all privileges.

D Assign all privileges directly to each user individually to avoid role complexity.

💡 Hint

Think about how role inheritance can simplify privilege management.

Creating a base role with common privileges and extending it with inherited roles reduces duplication and makes management easier and less error-prone.

Practice

1. What is the main purpose of role-based access control (RBAC) in MongoDB?

easy

A. To optimize query performance automatically

B. To store data in a structured format

C. To manage user permissions by assigning roles with specific privileges

D. To backup the database regularly

Solution

1. Step 1: Understand RBAC concept

   RBAC is about controlling what users can do by giving them roles with permissions.

2. Step 2: Identify RBAC purpose in MongoDB

   MongoDB uses RBAC to assign roles that define user privileges, managing access securely.

3. Final Answer:

   To manage user permissions by assigning roles with specific privileges -> Option C

4. Quick Check:

   RBAC controls access by roles = A [OK]

Hint: RBAC controls user actions via roles, not data or backups [OK]

Common Mistakes:

• Confusing RBAC with data storage
• Thinking RBAC handles backups
• Assuming RBAC optimizes queries

2. Which of the following is the correct syntax to create a role named readOnlyUser with read access on the sales database?

easy

A. db.createRole({role: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []})

B. db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []})

C. db.createRole({role: "readOnlyUser", privileges: [{resource: {db: "sales"}, actions: ["insert"]}], roles: []})

D. db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["update"]}], roles: []})

Solution

1. Step 1: Check correct field for role name

   The field to name the role is name, not role.

2. Step 2: Verify privileges for read access

   Read access uses the find action on the database with empty collection string for all collections.

3. Final Answer:

   db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []}) -> Option B

4. Quick Check:

   Role name uses 'name' field = A [OK]

Hint: Use 'name' for role, 'find' for read, empty collection for all [OK]

Common Mistakes:

• Using 'role' instead of 'name' for role creation
• Assigning wrong actions like 'insert' for read role
• Missing empty string for collection to cover all

3. Given the following commands, what will be the result of db.runCommand({usersInfo: "alice"}) after assigning the role?

db.createRole({
  name: "reportViewer",
  privileges: [{resource: {db: "reports", collection: ""}, actions: ["find"]}],
  roles: []
})
db.createUser({
  user: "alice",
  pwd: "password123",
  roles: ["reportViewer"]
})

medium

A. Returns user info showing 'alice' has role 'reportViewer' with find privileges on 'reports'

B. Returns an error because 'reportViewer' role does not exist

C. Returns user info but shows no roles assigned to 'alice'

D. Returns user info showing 'alice' has admin role

Solution

1. Step 1: Confirm role creation and assignment

   The role 'reportViewer' is created with find privileges on 'reports' and assigned to user 'alice'.

2. Step 2: Understand usersInfo command output

   Running usersInfo for 'alice' shows user details including assigned roles and privileges.

3. Final Answer:

   Returns user info showing 'alice' has role 'reportViewer' with find privileges on 'reports' -> Option A

4. Quick Check:

   Role assigned correctly, usersInfo shows it = C [OK]

Hint: usersInfo shows assigned roles and privileges correctly [OK]

Common Mistakes:

• Assuming usersInfo errors if role was just created
• Expecting no roles shown after assignment
• Confusing assigned roles with admin role

4. You tried to create a role with this command:

db.createRole({
  role: "dataEditor",
  privileges: [{resource: {db: "inventory", collection: "products"}, actions: ["update"]}],
  roles: []
})

But it failed. What is the error?

medium

A. The field 'role' should be 'name' when creating a role

B. The 'actions' array cannot contain 'update'

C. The 'resource' field must include 'collection' as null, not a string

D. Roles cannot have empty 'roles' array

Solution

1. Step 1: Check role creation syntax

   The correct field to name a role is 'name', not 'role'. Using 'role' causes failure.

2. Step 2: Validate other fields

   Actions like 'update' are valid, collection as string is correct, and empty roles array is allowed.

3. Final Answer:

   The field 'role' should be 'name' when creating a role -> Option A

4. Quick Check:

   Use 'name' field for role creation = B [OK]

Hint: Use 'name' not 'role' to name roles in createRole [OK]

Common Mistakes:

• Using 'role' instead of 'name' for role name
• Thinking 'update' is invalid action
• Believing empty roles array is disallowed

5. You want to create a custom role manager that can read and update documents in the employees database and also inherit all privileges from the built-in read role on the same database. Which command correctly achieves this?

hard

A. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]})

B. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["find", "update"]}], roles: [{role: "read", db: "admin"}]})

C. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["insert", "update"]}], roles: [{role: "read", db: "employees"}]})

D. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: ""}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]})

Solution

1. Step 1: Check privileges for read and update on employees

   Privileges should apply to all collections in 'employees' database, so collection is empty string "".

2. Step 2: Verify inherited role database

   The built-in 'read' role must be inherited from the same database 'employees', not 'admin'.

3. Step 3: Confirm actions and roles

   Actions 'find' and 'update' are correct; 'insert' is not required here.

4. Final Answer:

   db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: ""}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]}) -> Option D

5. Quick Check:

   Empty collection for all, inherit 'read' from same DB = D [OK]

Hint: Use empty collection for all, inherit roles from same DB [OK]

Common Mistakes:

• Setting collection name instead of empty string for all
• Inheriting 'read' role from wrong database
• Using wrong actions like 'insert' instead of 'find'