Role-based access control in MongoDB - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a new role named 'readRole' with read-only privileges on the 'sales' database.

MongoDB

db.createRole({ role: 'readRole', privileges: [{ resource: { db: 'sales', collection: '' }, actions: ['[1]'] }], roles: [] })

Drag options to blanks, or click blank then click option'

Aread

BuserAdmin

CdbAdmin

Dwrite

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'write' instead of 'read' grants write permissions, which is not read-only.

Confusing 'dbAdmin' or 'userAdmin' with read privileges.

The 'read' action grants read-only access to the specified database or collection.

2fill in blank

medium

Complete the code to grant the built-in role 'readWrite' on the 'inventory' database to the user 'alice'.

MongoDB

db.grantRolesToUser('alice', [{ role: '[1]', db: 'inventory' }])

Drag options to blanks, or click blank then click option'

Aread

BreadWrite

CdbAdmin

DuserAdmin

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'read' only grants read access, not write.

Using 'dbAdmin' or 'userAdmin' grants administrative privileges, not data access.

The 'readWrite' role allows both reading and writing data on the specified database.

3fill in blank

hard

Fix the error in the command to revoke the 'readWrite' role from user 'bob' on the 'reports' database.

MongoDB

db.revokeRolesFromUser('bob', [{ role: '[1]', db: 'reports' }])

Drag options to blanks, or click blank then click option'

AreadWrite

BdbAdmin

Cread

DuserAdmin

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'read' only revokes read permissions, leaving write intact.

Using 'dbAdmin' or 'userAdmin' revokes unrelated roles.

The role to revoke is 'readWrite' to remove read and write permissions.

4fill in blank

hard

Fill both blanks to create a role 'customAdmin' with privileges to manage users and roles on the 'admin' database.

MongoDB

db.createRole({ role: 'customAdmin', privileges: [{ resource: { db: '[1]', collection: '' }, actions: ['[2]'] }], roles: [] })

Drag options to blanks, or click blank then click option'

Aadmin

Bread

CuserAdmin

DreadWrite

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'read' or 'readWrite' actions instead of 'userAdmin'.

Specifying the wrong database other than 'admin'.

The 'admin' database is where user and role management happens, and 'userAdmin' action allows managing users and roles.

5fill in blank

hard

Fill all three blanks to create a role 'reportWriter' that can read from 'reports' and write to 'logs' databases.

MongoDB

db.createRole({ role: 'reportWriter', privileges: [{ resource: { db: '[1]', collection: '' }, actions: ['read'] }, { resource: { db: '[2]', collection: '' }, actions: ['[3]'] }], roles: [] })

Drag options to blanks, or click blank then click option'

Areports

Blogs

Cwrite

DreadWrite

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'readWrite' action instead of just 'write' for the second privilege.

Mixing up the database names for read and write.

The role reads from 'reports' database and writes to 'logs' database using the 'write' action.

Practice

1. What is the main purpose of role-based access control (RBAC) in MongoDB?

easy

A. To optimize query performance automatically

B. To store data in a structured format

C. To manage user permissions by assigning roles with specific privileges

D. To backup the database regularly

Solution

1. Step 1: Understand RBAC concept

   RBAC is about controlling what users can do by giving them roles with permissions.

2. Step 2: Identify RBAC purpose in MongoDB

   MongoDB uses RBAC to assign roles that define user privileges, managing access securely.

3. Final Answer:

   To manage user permissions by assigning roles with specific privileges -> Option C

4. Quick Check:

   RBAC controls access by roles = A [OK]

Hint: RBAC controls user actions via roles, not data or backups [OK]

Common Mistakes:

• Confusing RBAC with data storage
• Thinking RBAC handles backups
• Assuming RBAC optimizes queries

2. Which of the following is the correct syntax to create a role named readOnlyUser with read access on the sales database?

easy

A. db.createRole({role: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []})

B. db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []})

C. db.createRole({role: "readOnlyUser", privileges: [{resource: {db: "sales"}, actions: ["insert"]}], roles: []})

D. db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["update"]}], roles: []})

Solution

1. Step 1: Check correct field for role name

   The field to name the role is name, not role.

2. Step 2: Verify privileges for read access

   Read access uses the find action on the database with empty collection string for all collections.

3. Final Answer:

   db.createRole({name: "readOnlyUser", privileges: [{resource: {db: "sales", collection: ""}, actions: ["find"]}], roles: []}) -> Option B

4. Quick Check:

   Role name uses 'name' field = A [OK]

Hint: Use 'name' for role, 'find' for read, empty collection for all [OK]

Common Mistakes:

• Using 'role' instead of 'name' for role creation
• Assigning wrong actions like 'insert' for read role
• Missing empty string for collection to cover all

3. Given the following commands, what will be the result of db.runCommand({usersInfo: "alice"}) after assigning the role?

db.createRole({
  name: "reportViewer",
  privileges: [{resource: {db: "reports", collection: ""}, actions: ["find"]}],
  roles: []
})
db.createUser({
  user: "alice",
  pwd: "password123",
  roles: ["reportViewer"]
})

medium

A. Returns user info showing 'alice' has role 'reportViewer' with find privileges on 'reports'

B. Returns an error because 'reportViewer' role does not exist

C. Returns user info but shows no roles assigned to 'alice'

D. Returns user info showing 'alice' has admin role

Solution

1. Step 1: Confirm role creation and assignment

   The role 'reportViewer' is created with find privileges on 'reports' and assigned to user 'alice'.

2. Step 2: Understand usersInfo command output

   Running usersInfo for 'alice' shows user details including assigned roles and privileges.

3. Final Answer:

   Returns user info showing 'alice' has role 'reportViewer' with find privileges on 'reports' -> Option A

4. Quick Check:

   Role assigned correctly, usersInfo shows it = C [OK]

Hint: usersInfo shows assigned roles and privileges correctly [OK]

Common Mistakes:

• Assuming usersInfo errors if role was just created
• Expecting no roles shown after assignment
• Confusing assigned roles with admin role

4. You tried to create a role with this command:

db.createRole({
  role: "dataEditor",
  privileges: [{resource: {db: "inventory", collection: "products"}, actions: ["update"]}],
  roles: []
})

But it failed. What is the error?

medium

A. The field 'role' should be 'name' when creating a role

B. The 'actions' array cannot contain 'update'

C. The 'resource' field must include 'collection' as null, not a string

D. Roles cannot have empty 'roles' array

Solution

1. Step 1: Check role creation syntax

   The correct field to name a role is 'name', not 'role'. Using 'role' causes failure.

2. Step 2: Validate other fields

   Actions like 'update' are valid, collection as string is correct, and empty roles array is allowed.

3. Final Answer:

   The field 'role' should be 'name' when creating a role -> Option A

4. Quick Check:

   Use 'name' field for role creation = B [OK]

Hint: Use 'name' not 'role' to name roles in createRole [OK]

Common Mistakes:

• Using 'role' instead of 'name' for role name
• Thinking 'update' is invalid action
• Believing empty roles array is disallowed

5. You want to create a custom role manager that can read and update documents in the employees database and also inherit all privileges from the built-in read role on the same database. Which command correctly achieves this?

hard

A. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]})

B. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["find", "update"]}], roles: [{role: "read", db: "admin"}]})

C. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: "employees"}, actions: ["insert", "update"]}], roles: [{role: "read", db: "employees"}]})

D. db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: ""}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]})

Solution

1. Step 1: Check privileges for read and update on employees

   Privileges should apply to all collections in 'employees' database, so collection is empty string "".

2. Step 2: Verify inherited role database

   The built-in 'read' role must be inherited from the same database 'employees', not 'admin'.

3. Step 3: Confirm actions and roles

   Actions 'find' and 'update' are correct; 'insert' is not required here.

4. Final Answer:

   db.createRole({name: "manager", privileges: [{resource: {db: "employees", collection: ""}, actions: ["find", "update"]}], roles: [{role: "read", db: "employees"}]}) -> Option D

5. Quick Check:

   Empty collection for all, inherit 'read' from same DB = D [OK]

Hint: Use empty collection for all, inherit roles from same DB [OK]

Common Mistakes:

• Setting collection name instead of empty string for all
• Inheriting 'read' role from wrong database
• Using wrong actions like 'insert' instead of 'find'