ACL rules and categories in Redis - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What is the output of this ACL command?

Given the ACL rule ACL SETUSER alice on >password ~* +@all, what will be the result of the command ACL LIST for user alice?

Redis

ACL LIST

A user alice on >password ~* +@all

B user alice off >password ~* +@all

C user alice on >password ~* -@all

D user alice on >password ~* +@read

💡 Hint

Remember that on means the user is enabled and +@all grants all command categories.

The ACL rule enables user alice with password authentication, allows access to all keys (~*), and grants all command categories (+@all).

🧠 Conceptual

intermediate

Which ACL category allows keyspace notifications commands?

In Redis ACL categories, which category includes commands related to keyspace notifications?

A @admin

B @read

C @pubsub

D @keyspace

💡 Hint

Keyspace notifications use the publish/subscribe system.

The @pubsub category includes commands related to publish/subscribe messaging, which covers keyspace notifications.

📝 Syntax

advanced

Which ACL SETUSER command syntax is valid to allow only read commands on keys starting with 'cache:'?

Select the correct ACL SETUSER command that enables a user with password 'secret', allows only read commands, and restricts keys to those starting with 'cache:'.

A ACL SETUSER bob on >secret ~cache:* +@read

B ACL SETUSER bob on >secret ~cache:* +@write

C ACL SETUSER bob on >secret ~cache:* +@all

D ACL SETUSER bob on >secret ~cache* +@read

💡 Hint

The key pattern must end with a colon and asterisk to match keys starting with 'cache:'.

Option A correctly uses the pattern '~cache:*' to restrict keys and '+@read' to allow only read commands.

🔧 Debug

advanced

Why does this ACL rule fail to restrict commands properly?

Consider the ACL rule: ACL SETUSER eve on >pass123 ~* +@write. Why can user 'eve' still run read commands?

A Because the key pattern ~* allows access to all keys, ignoring command categories

B Because +@write does not restrict read commands; it only adds write commands but does not remove read commands

C Because the password >pass123 is invalid and disables the user

D Because the user is off by default and must be explicitly enabled

💡 Hint

ACL rules add permissions but do not remove existing ones unless explicitly revoked.

The +@write category adds write commands but does not remove read commands, so read commands remain allowed unless explicitly revoked.

❓ optimization

expert

Optimizing ACL rules for minimal permissions

You want to create an ACL user that can only run the commands GET and SET on keys starting with 'app:'. Which ACL rule is the most minimal and correct?

A ACL SETUSER minimal on >mypassword ~app:* +GET +SET +@all

B ACL SETUSER minimal on >mypassword ~app:* +@read +@write

C ACL SETUSER minimal on >mypassword ~app:* +@string

D ACL SETUSER minimal on >mypassword ~app:* +GET +SET

💡 Hint

Use explicit command names to limit permissions precisely.

Option D grants only GET and SET commands explicitly, restricting keys to 'app:*', which is minimal and correct.