C100DBA Premium Exam Questions

The grantPrivilegesToRole command requires privileges to be an array of privilege documents. Each privilege document must contain a resource document and an actions array. Option A uses exactly that structure: the resource targets testDB with an empty collection name, which represents the database-level collection scope used by MongoDB ' s privilege model, and the actions list contains " find " . Option B omits the required resource wrapper and incorrectly places db and collection directly in the privilege document. Option C supplies privileges as a single document rather than as the required array. Option D has the correct resource structure but supplies actions as a scalar string instead of an array. The find action grants the ability to perform supported read operations on the specified resource scope, subject to the role ' s other inherited privileges. The shown writeConcern and comment fields are legitimate command options and do not change the structural requirement. Consequently, option A is the only choice that conforms to MongoDB ' s documented privilege document format.

Study Guide reference/topic:Security, Networking, and Encryption - user-defined roles, privilege documents, resources, actions, and grantPrivilegesToRole.

===========

Encryption at rest protects persisted database data on storage media, but it is not a complete defense against every form of data exposure or breach. MongoDB ' s encrypted storage capabilities protect files and storage-level data, yet applications and the database server must still process authorized data in usable form. A compromised application account, stolen database credentials, excessive privileges, or a malicious authorized user can therefore expose data even when the underlying storage is encrypted. Network traffic also requires separate transport protection such as TLS; encryption at rest does not secure data as it travels between clients and servers. Option B incorrectly describes transport encryption rather than an at-rest capability. Option A is too subjective and not an inherent limitation, particularly in managed deployments where storage encryption may be enabled automatically. Option D is similarly overstated; encryption adds cryptographic work, but severe performance impact is not an intrinsic defining limitation. The correct security model is defense in depth: combine at-rest encryption with TLS, strong authentication, least-privilege authorization, auditing, and secure key management. Among the choices, C best captures the limitation that at-rest encryption alone cannot prevent all data breaches.

Study Guide reference/topic:Security, Networking, and Encryption - encryption at rest, TLS, authorization, and defense in depth.

===========