Role-based access control in MongoDB - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

Find users with the 'readWrite' role on the 'sales' database

Given a MongoDB collection system.users that stores user roles, which query returns all users who have the readWrite role on the sales database?

MongoDB

db.system.users.find({ roles: { $elemMatch: { role: 'readWrite', db: 'sales' } } })

A db.system.users.find({ roles: { $elemMatch: { role: 'readWrite', db: 'sales' } } })

B db.system.users.find({ roles: { role: 'readWrite', db: 'sales' } })

C db.system.users.find({ 'roles.role': 'readWrite', 'roles.db': 'sales' })

D db.system.users.find({ roles: { $all: [ { role: 'readWrite' }, { db: 'sales' } ] } })

💡 Hint

Use $elemMatch to match both role and db in the same array element.

The $elemMatch operator matches array elements that satisfy all specified conditions together. Option A correctly finds users with a role of 'readWrite' on the 'sales' database.

🧠 Conceptual

intermediate

Understanding role inheritance in MongoDB

Which statement best describes how role inheritance works in MongoDB's role-based access control?

A Role inheritance only applies to system roles, not user-defined roles.

B Roles cannot inherit privileges; each role is independent and must be assigned separately.

C Roles can inherit privileges from other roles, allowing users to gain all privileges of the inherited roles.

D Inheritance is automatic for all roles assigned to a user, but privileges do not combine.

💡 Hint

Think about how MongoDB allows roles to build on each other.

MongoDB supports role inheritance, where a role can include privileges from other roles. This helps simplify privilege management.

📝 Syntax

advanced

Identify the syntax error in creating a custom role

Which option contains a syntax error when creating a custom role with privileges on the inventory collection?

MongoDB

db.createRole({ role: 'inventoryManager', privileges: [ { resource: { db: 'store', collection: 'inventory' }, actions: ['find', 'update'] } ], roles: [] })

A db.createRole({ role: 'inventoryManager', privileges: [ { resource: { db: 'store', collection: 'inventory' }, actions: ['find'] } ], roles: [] })

B db.createRole({ role: 'inventoryManager', privileges: [ { resource: { db: 'store', collection: 'inventory' }, actions: ['find', 'update'] } ], roles: [] })

C db.createRole({ role: 'inventoryManager', privileges: [ { resource: { db: 'store', collection: 'inventory' }, actions: ['find', 'update'] } ] })

D db.createRole({ role: 'inventoryManager', privileges: { resource: { db: 'store', collection: 'inventory' }, actions: ['find', 'update'] }, roles: [] })

💡 Hint

Check the type of privileges field; it should be an array.

Option D assigns privileges as an object instead of an array, causing a syntax error. It must be an array of privilege documents.

🔧 Debug

advanced

Why does this user lack expected privileges?

A user was assigned the role readWrite on the reports database, but cannot insert documents into the reports collection. What is the most likely cause?

A The user was assigned the role on the wrong database; roles are database-specific.

B The user needs to be assigned the <code>read</code> role instead of <code>readWrite</code>.

C The user must be assigned the <code>dbAdmin</code> role to insert documents.

D The <code>readWrite</code> role does not include insert privileges.

💡 Hint

Remember that roles apply to specific databases in MongoDB.

Roles in MongoDB are scoped to a database. If the user was assigned readWrite on a different database, they won't have insert privileges on reports.

❓ optimization

expert

Optimize role assignments for multiple users with overlapping privileges

You have multiple users needing similar but slightly different privileges on the finance database. What is the best approach to minimize management overhead while ensuring correct access?

A Create one large role with all possible privileges and assign it to all users regardless of their needs.

B Create a base role with common privileges and create additional roles that inherit from it for specific needs, then assign these roles to users.

C Use only built-in roles and assign multiple roles to each user to cover all privileges.

D Assign all privileges directly to each user individually to avoid role complexity.

💡 Hint

Think about how role inheritance can simplify privilege management.

Creating a base role with common privileges and extending it with inherited roles reduces duplication and makes management easier and less error-prone.