I85PREP
⌘ K
MongoDB Atlas Admin Associate study materials
MongoDB Atlas Admin Associate study resources

MongoDB Atlas Admin Associate practice questions

One question at a time. Build your MongoDB Atlas Admin Associate understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Atlas Deployment and Cluster Configuration

Which Atlas cluster tier is a free-tier shared cluster suitable for learning and small development workloads?

  1. M60
  2. M0 Correct answer.
  3. M30
  4. M10

Explanation

M0 is the free-tier shared cluster Atlas provides for learning and light development. M10 and higher are dedicated clusters with dedicated RAM, storage, and throughput, and they incur charges. M0 has limited resources and is not intended for production traffic.

Question 2Atlas Deployment and Cluster Configuration

A developer's IP address is not on an Atlas project's IP access list. What happens when the developer tries to connect to the cluster?

  1. The connection is blocked until the IP address is added to the access list. Correct answer.
  2. Atlas automatically adds the IP address after the first failed attempt.
  3. The developer connects with read-only privileges.
  4. The developer connects but cannot run administrative commands.

Explanation

Atlas requires client IP addresses to be present on the project IP access list before connections are accepted. A missing entry causes the connection attempt to be rejected, regardless of database user credentials. Adding the address, or an appropriate CIDR block, is required to allow access.

Question 3Atlas Deployment and Cluster Configuration

Which connection string prefix does Atlas provide for a replica set that uses a DNS seed list?

  1. mongodb://
  2. mongodb+replica://
  3. mongodb+srv:// Correct answer.
  4. mongodb+ssl://

Explanation

Atlas provides mongodb+srv:// connection strings, which use a DNS SRV record to discover the cluster hosts. This format simplifies connection strings because individual hostnames and ports do not need to be listed. The mongodb:// scheme is the standard format without SRV discovery.

Question 4Atlas Deployment and Cluster Configuration

When cluster tier auto-scaling is enabled, which behavior does Atlas provide?

  1. Atlas can scale below the configured minimum during idle periods.
  2. Atlas adjusts the tier within its configured bounds. Correct answer.
  3. Atlas changes tiers only after a manual scale event.
  4. Atlas scales only storage; the cluster tier stays fixed.

Explanation

Cluster tier auto-scaling lets Atlas raise or lower the cluster tier in response to resource utilization, but only within the minimum and maximum tiers you configure. It does not require a manual scale event and never goes outside the bounds. Storage auto-scaling is a separate setting.

Question 5Atlas Deployment and Cluster Configuration

In an Atlas multi-region replica set, which node type can you add in an additional region to serve reads without becoming eligible for primary election?

  1. Read-only nodes Correct answer.
  2. Electable nodes
  3. Arbiters
  4. Config servers

Explanation

Atlas supports read-only nodes in additional regions, and those nodes can serve read traffic but do not participate in elections for the primary. Electable nodes can become primary, which changes the fault-tolerance and election behavior. Atlas does not use arbiters, and config servers belong to sharded clusters rather than replica set read distribution.

Question 6Atlas Deployment and Cluster Configuration

What is the purpose of configuring a maintenance window for an Atlas cluster?

  1. It defines a preferred weekly period when Atlas performs routine maintenance. Correct answer.
  2. It prevents Atlas from ever applying patches to the cluster.
  3. It controls when cluster tier auto-scaling may occur.
  4. It sets the exact time when automatic backups are deleted.

Explanation

A maintenance window lets you choose a preferred weekly time when Atlas should perform routine maintenance such as patching. It does not stop maintenance permanently or govern backup deletion. Auto-scaling decisions are based on utilization, not on the maintenance window.

Question 7Atlas Deployment and Cluster Configuration

Which Atlas connectivity option establishes a private connection from a customer VPC to Atlas using an endpoint service rather than routing traffic over the public internet?

  1. VPC peering
  2. Private endpoint (AWS PrivateLink/Azure Private Link) Correct answer.
  3. Database user authentication
  4. IP access list

Explanation

A private endpoint uses a cloud provider endpoint service such as AWS PrivateLink or Azure Private Link to reach Atlas privately from the customer VPC. VPC peering also provides private routing, but it connects networks directly rather than through an endpoint service. IP access lists and database user authentication control access but do not create the private network path.

Question 8Atlas Deployment and Cluster Configuration

When storage auto-scaling is enabled on an Atlas cluster, what happens as disk utilization approaches the configured threshold?

  1. Atlas moves the cluster to a shared tier.
  2. Atlas increases the provisioned storage automatically. Correct answer.
  3. Atlas pauses the cluster until storage is manually expanded.
  4. Atlas deletes the oldest backup snapshots to free space.

Explanation

With storage auto-scaling enabled, Atlas automatically increases provisioned storage when utilization approaches the configured threshold, avoiding a full-disk condition. The added storage is not automatically reduced later if usage falls. Backup retention and cluster tier selection are configured separately.

Question 9Atlas Deployment and Cluster Configuration

To use a customer-managed key for encryption at rest in Atlas, which configuration must be completed before enabling encryption?

  1. Upload the key to the Atlas project as a database user credential.
  2. Place the key in the connection string as an authentication parameter.
  3. Configure a KMS provider and authorize Atlas to use the customer key. Correct answer.
  4. Enable TLS and use the key as the cluster's certificate authority.

Explanation

Customer-managed encryption at rest requires configuring a supported key management service provider and granting Atlas the access it needs to use the customer key. Database user credentials, TLS certificates, and connection strings serve different purposes and do not supply the encryption key. Atlas then uses the KMS-backed key to protect cluster data at rest.

Question 10Atlas Deployment and Cluster Configuration

For a global Atlas sharded cluster, how do you ensure that documents for European users are stored on shards located in the EU?

  1. Configure zone sharding so the relevant shard key range maps to an EU zone. Correct answer.
  2. Enable multi-region cluster tier auto-scaling for the EU region.
  3. Add a read-only node in the EU region to each shard.
  4. Set read preference to nearest in the European region.

Explanation

Zone sharding lets you associate ranges of the shard key with zones, and each zone is backed by shards in chosen regions. Mapping European user data to an EU zone keeps those documents on EU shards. Read preference and read-only nodes affect where reads are served, not where the documents are stored.

Question 11Atlas Deployment and Cluster Configuration

When you create a standard Atlas replica set cluster in a single region, what topology does Atlas deploy by default?

  1. Three primary nodes behind a load balancer
  2. Two arbiters and one primary node
  3. One primary and one secondary node
  4. One primary and two secondary nodes Correct answer.

Explanation

Atlas creates a three-node replica set by default: one primary that accepts writes and two secondaries that replicate the primary's oplog. If the primary fails, one of the secondaries is elected automatically, so the cluster keeps serving reads and writes without manual intervention.

Question 12Atlas Deployment and Cluster Configuration

You need a cluster whose nodes each have dedicated RAM and storage, and you must be able to scale the cluster up to an M60 tier. Which Atlas cluster tier should you select?

  1. M10 dedicated tier Correct answer.
  2. M2 shared tier
  3. M5 shared tier
  4. M0 free tier

Explanation

M10 is the smallest dedicated Atlas tier. Dedicated tiers give each node its own RAM and storage and can be scaled through larger M-series sizes such as M40 and M60, whereas M0, M2, and M5 are shared tiers with fixed, limited resources.

Question 13Atlas Deployment and Cluster Configuration

In an Atlas sharded cluster, which process accepts client connections and routes each operation to the appropriate shard?

  1. The config server replica set
  2. The primary shard
  3. The mongos router Correct answer.
  4. The balancer

Explanation

mongos is the query router in a sharded cluster. Clients connect to mongos, which consults the config servers for metadata and forwards each operation to the shard or shards that own the relevant data chunks.

Question 14Atlas Deployment and Cluster Configuration

You change an Atlas replica set cluster from M30 to M40 during business hours. How does Atlas apply the change?

  1. It upgrades the nodes one at a time using a rolling process, so the cluster stays available. Correct answer.
  2. It creates a new cluster and requires you to restore from a snapshot manually.
  3. It resizes only the primary node immediately and leaves secondaries unchanged.
  4. It stops the cluster, rebuilds every node, and restarts it after the resize completes.

Explanation

Atlas performs a rolling tier change: it upgrades secondaries one at a time, then steps down the primary so an upgraded node can take over. The cluster remains available, although a brief primary election can interrupt in-flight operations.

Question 15Atlas Deployment and Cluster Configuration

A development team pauses an M20 Atlas cluster over the weekend. What happens to the cluster and its data while it is paused?

  1. The cluster is automatically downgraded to an M0 free tier and data is migrated.
  2. The cluster continues to serve reads from secondaries but rejects writes.
  3. The data is deleted after 24 hours unless the cluster is resumed.
  4. Data and configuration are retained, and connections fail while paused. Correct answer.

Explanation

Pausing a cluster stops its nodes but keeps the data and configuration intact, and compute charges stop while it is paused. Client connections fail until you resume the cluster, after which the same data and connection string are available.

Question 16Atlas Deployment and Cluster Configuration

You want to deploy an Atlas cluster whose nodes are spread across AWS, Azure, and Google Cloud. Which statement describes Atlas support for this configuration?

  1. A single replica set can include nodes running on different cloud providers. Correct answer.
  2. All nodes of a replica set must run on a single cloud provider; only sharded clusters can span providers.
  3. Multi-cloud deployment is supported only for M0 free tier clusters.
  4. Multi-cloud deployment requires a private endpoint in each provider instead of a connection string.

Explanation

Atlas multi-cloud clusters let you choose a different cloud provider and region for each node group in a replica set. This spreads the deployment across providers for resilience or data-locality reasons while clients still use a single connection string.

Question 17Atlas Deployment and Cluster Configuration

You are configuring an AWS VPC peering connection between your application VPC and an Atlas cluster's VPC. Which condition prevents the peering connection from being established?

  1. The application VPC uses RFC 1918 private addresses.
  2. The application VPC belongs to a different AWS account.
  3. The CIDR blocks of the two VPCs overlap. Correct answer.
  4. The Atlas cluster has three electable nodes.

Explanation

VPC peering requires the two CIDR ranges to be unique; overlapping ranges make routing ambiguous, so the peering connection cannot be created. Cross-account peering and private RFC 1918 addressing are both supported and are not barriers.

Question 18Atlas Deployment and Cluster Configuration

You want to deploy an Atlas sharded cluster. What is the minimum cluster tier that Atlas requires for sharded clusters?

  1. M10
  2. M30 Correct answer.
  3. M40
  4. M20

Explanation

Atlas requires sharded clusters to use at least the M30 tier because each shard is itself a replica set and mongos routers add resource overhead. Smaller M10 and M20 tiers are available only for replica set clusters.

Question 19Atlas Deployment and Cluster Configuration

A multi-region Atlas replica set has five electable nodes: three in us-east-1, one in eu-west-1, and one in ap-southeast-1. The entire us-east-1 region becomes unavailable. What is the effect on write availability?

  1. Writes continue because the two remaining nodes elect a new primary.
  2. Writes fail because two nodes are not a majority of the five voters. Correct answer.
  3. Writes continue because Atlas promotes the highest-priority surviving node.
  4. Writes fail until us-east-1 recovers because Atlas requires all regions online.

Explanation

A replica set needs a majority of voting members to elect and keep a primary. With three of five electable nodes in us-east-1, losing that region leaves only two nodes, which cannot form a majority, so the deployment cannot accept writes until quorum is restored.

Question 20Atlas Deployment and Cluster Configuration

You add a second region to an existing Atlas replica set that was created with an SRV connection string. What must clients do to keep connecting after the new nodes are online?

  1. Recreate the cluster; the SRV hostname is tied to the original region.
  2. Replace the SRV string with a standard string that lists every new host.
  3. Continue using the same SRV connection string; DNS resolves the updated host list. Correct answer.
  4. Request a new SRV connection string because adding a region changes the cluster ID.

Explanation

Atlas publishes cluster members through DNS SRV records, and drivers periodically re-resolve those records. Adding a region changes the host list behind the name but not the SRV connection string itself, so clients keep using the same string and discover the new nodes automatically.

Question 21Atlas Deployment and Cluster Configuration

In MongoDB Atlas, at which hierarchy level are clusters created and project IP access list entries managed?

  1. Database user
  2. Project Correct answer.
  3. Organization
  4. Cluster

Explanation

Atlas resources are organized as an organization containing projects, and each project contains clusters and its own network access settings. Creating a cluster or editing the project IP access list therefore happens inside the project.

Question 22Atlas Deployment and Cluster Configuration

What does enabling termination protection on an Atlas cluster prevent?

  1. Early backup deletion
  2. Automatic cluster pausing
  3. Automatic tier scale-down
  4. Accidental cluster deletion Correct answer.

Explanation

Termination protection is a safety setting that blocks deletion of the cluster while it is enabled. An authorized user must disable termination protection before Atlas will accept a delete request.

Question 23Atlas Deployment and Cluster Configuration

In an Atlas sharded cluster, which component stores the cluster metadata and sharding configuration?

  1. Each shard's primary only
  2. The Atlas backup snapshot store
  3. The mongos routers
  4. The config server replica set Correct answer.

Explanation

Config servers hold the metadata that describes shards, chunks, and routing rules for a sharded cluster. Atlas deploys them as a replica set so metadata remains available if a member fails.

Question 24Atlas Deployment and Cluster Configuration

A team needs point-in-time recovery for an Atlas dedicated cluster. Which backup capability must be enabled?

  1. Cloud provider native snapshots
  2. Continuous Cloud Backup Correct answer.
  3. On-demand snapshots only
  4. Application-level filesystem backups

Explanation

Point-in-time recovery requires continuous backup, which captures the oplog and lets Atlas restore to a precise moment. On-demand snapshots alone can restore only to the times when those snapshots were taken.

Question 25Atlas Deployment and Cluster Configuration

Which Atlas setting determines how long Cloud Backup snapshots are retained for a cluster?

  1. The backup policy Correct answer.
  2. The IP access list
  3. The cluster tier
  4. The maintenance window

Explanation

A cluster's backup policy defines snapshot frequency, retention period, and the continuous backup window. Cluster tier and maintenance window affect resources and scheduling, not snapshot retention.

Question 26Atlas Deployment and Cluster Configuration

You manually increase storage on an Atlas dedicated cluster. Which statement describes later storage size changes?

  1. Storage can be increased, but cannot later be decreased. Correct answer.
  2. Storage can be increased or decreased at any time.
  3. Storage can be decreased only during a maintenance window.
  4. Storage is fixed for the life of the cluster.

Explanation

Atlas lets you provision additional storage for a dedicated cluster, but it does not support reducing the provisioned storage size on that cluster. A smaller footprint generally requires a new cluster and a data migration.

Question 27Atlas Deployment and Cluster Configuration

You need to rename an existing Atlas cluster to comply with a new naming standard. What must you do?

  1. Edit the name in cluster settings
  2. Rename the parent project so the cluster name changes
  3. Create a new cluster and migrate data Correct answer.
  4. Run an Atlas CLI rename command

Explanation

An Atlas cluster name is fixed at creation and cannot be edited through the UI, API, or CLI. Renaming therefore requires deploying a new cluster with the desired name and migrating the workload to it.

Question 28Atlas Deployment and Cluster Configuration

Atlas is upgrading a replica set cluster to a new MongoDB major version. How does Atlas apply the upgrade?

  1. It upgrades only the primary; secondaries remain on the old version.
  2. It creates a new cluster and switches the connection string automatically.
  3. It performs a rolling upgrade, restarting members one at a time. Correct answer.
  4. It stops all nodes, upgrades them, then restarts the cluster.

Explanation

Atlas performs MongoDB version upgrades as a rolling operation, updating and restarting replica set members individually. During the election that occurs, the cluster remains available through the other members and the connection string does not change.

Question 29Atlas Deployment and Cluster Configuration

Which read preference directs reads to an Atlas analytics node?

  1. primaryPreferred, which reads from the primary unless it is unavailable
  2. nearest, which selects the lowest-latency member regardless of role
  3. secondary with the tag nodeType: ANALYTICS Correct answer.
  4. primary, which forces all reads to the primary node

Explanation

Atlas tags analytics nodes with nodeType: ANALYTICS, so clients must use a secondary read preference with a matching readPreferenceTag. A plain nearest read preference can still select ordinary secondaries and does not guarantee analytics-node targeting.

Question 30Atlas Deployment and Cluster Configuration

An Atlas sharded cluster's config server replica set loses two of its three voting members. What is the immediate effect?

  1. The mongos routers immediately stop accepting every read and write operation.
  2. The cluster automatically converts to a replica set.
  3. No config server primary can be elected, so metadata changes fail. Correct answer.
  4. All shard data is deleted and must be restored from backup.

Explanation

A config server replica set needs a majority of voting members to elect a primary. With only one member left, metadata-changing operations such as creating a sharded collection cannot complete, although cached routing information may allow some existing traffic to continue.

Question 31Atlas Deployment and Cluster Configuration

Which Atlas cluster tier is a shared, free-tier deployment intended for learning and early development?

  1. M0 Correct answer.
  2. M10
  3. M30
  4. M60

Explanation

M0 is Atlas's free shared tier; it runs on shared infrastructure and is intended for development and learning rather than production. M10 and higher are dedicated tiers with dedicated RAM and storage.

Question 32Atlas Deployment and Cluster Configuration

When Atlas deploys a three-node dedicated replica set in a single AWS region, how does it place the nodes?

  1. One node in each of three Availability Zones Correct answer.
  2. All three nodes in one Availability Zone
  3. Nodes are placed only in the region's default Availability Zone
  4. Two nodes in one Availability Zone and one in a second

Explanation

Atlas spreads a three-node replica set across three Availability Zones in the selected region so that a single zone failure does not take down a majority of the replica set. This is the standard single-region dedicated replica set layout.

Question 33Atlas Deployment and Cluster Configuration

Which Atlas cluster type automatically scales compute and storage and bills primarily per database operation?

  1. Dedicated M10 replica set
  2. M0 free cluster
  3. Serverless instance Correct answer.
  4. Sharded cluster with two shards

Explanation

Serverless instances automatically scale with workload and charge based on reads, writes, and storage rather than a fixed cluster tier. They suit intermittent or unpredictable traffic.

Question 34Atlas Deployment and Cluster Configuration

A dedicated Atlas cluster is approaching its provisioned disk capacity. Which cluster setting lets Atlas automatically increase storage when utilization crosses a threshold?

  1. Maintenance window
  2. Storage auto-scaling Correct answer.
  3. Backup snapshot schedule
  4. Compute auto-scaling

Explanation

Storage auto-scaling monitors disk utilization and increases provisioned storage when it crosses the configured threshold, helping avoid out-of-space conditions. Compute auto-scaling adjusts cluster tier, not disk size.

Question 35Atlas Deployment and Cluster Configuration

A sharded Atlas cluster is running low on aggregate storage and throughput. Which change adds capacity horizontally?

  1. Add additional mongos routers
  2. Add one or more shards to the cluster Correct answer.
  3. Increase the cluster tier of the existing shards
  4. Increase the config server tier

Explanation

Adding shards increases the number of data-bearing nodes and distributes chunks across more hardware, which is horizontal scaling. Increasing tier is vertical scaling, and mongos routers only route requests.

Question 36Atlas Deployment and Cluster Configuration

You need to move an existing Atlas cluster from AWS to Azure. Which approach does Atlas support?

  1. Change the cluster's region to an Azure region in the same cluster
  2. Open a support ticket to have Atlas convert the provider
  3. Create a new Atlas cluster on Azure and migrate the data to it Correct answer.
  4. Edit the cluster's cloud provider in place and let Atlas migrate the nodes

Explanation

Atlas does not change an existing cluster's cloud provider in place. The supported path is to deploy a new cluster with the desired provider and migrate the data using Atlas tools or mongodump/mongorestore.

Question 37Atlas Deployment and Cluster Configuration

Which Atlas connectivity feature provides private access from an AWS VPC to an Atlas cluster without configuring VPC peering?

  1. Project IP access list
  2. AWS PrivateLink Correct answer.
  3. Database user authentication
  4. Atlas Data Federation

Explanation

AWS PrivateLink creates a private endpoint in your VPC that connects to Atlas over the AWS network, avoiding VPC peering and public IP exposure. IP access lists control which addresses may connect but do not create a private path.

Question 38Atlas Deployment and Cluster Configuration

Which Atlas setting controls the recurring weekly time period when Atlas may apply maintenance patches to a cluster?

  1. Snapshot retention policy
  2. Cluster pause schedule
  3. Maintenance window Correct answer.
  4. Backup window

Explanation

The maintenance window defines the weekly period during which Atlas can perform maintenance such as patches and upgrades. Backup and snapshot settings govern data protection, not patch timing.

Question 39Atlas Deployment and Cluster Configuration

You have an existing Atlas replica set cluster and now require sharding. What must you do?

  1. Deploy a new sharded cluster and migrate the data Correct answer.
  2. Add mongos processes directly to the existing replica set
  3. Increase the replica set tier until the cluster supports sharding
  4. Enable sharding from the cluster configuration page

Explanation

Atlas does not convert an existing replica set cluster into a sharded cluster in place. Sharding requires a new sharded cluster deployment; you then migrate the data using Atlas migration tools or mongodump/mongorestore.

Question 40Atlas Deployment and Cluster Configuration

A three-node replica set runs in us-east-1. You need local reads in eu-west-1 but must not add electable voting members there. Which Atlas configuration meets this requirement?

  1. Add electable nodes in eu-west-1 and set read preference to secondary
  2. Add read-only nodes in eu-west-1 to the existing replica set Correct answer.
  3. Create a separate replica set in eu-west-1 and use client-side joins
  4. Convert the cluster to a sharded cluster with one shard in eu-west-1

Explanation

Atlas replica sets can include read-only nodes in additional regions; these serve reads without participating in elections. Electable nodes would increase the voting majority and are not needed for local read access.

Question 41Security, Authentication, and Authorization

A newly created Atlas database user is configured with a username and password. Which authentication mechanism does MongoDB use by default for this user?

  1. X.509
  2. SCRAM-SHA-256 Correct answer.
  3. LDAP
  4. AWS IAM

Explanation

Password-based database users in Atlas authenticate with SCRAM, and the credentials are stored in the admin authentication database. X.509, LDAP, and AWS IAM are alternative mechanisms that require explicit configuration.

Question 42Security, Authentication, and Authorization

Which statement correctly distinguishes Atlas users from database users?

  1. Both types of users are stored in the admin database of each cluster.
  2. Atlas users authenticate to MongoDB deployments, while database users sign in to the Atlas control plane.
  3. Database users can manage billing, while Atlas users can only read collections.
  4. Atlas users sign in to the Atlas control plane, while database users authenticate to MongoDB deployments. Correct answer.

Explanation

Atlas users are identities for the Atlas control plane, such as the web UI and Admin API, and are managed through organizations and projects. Database users exist inside MongoDB deployments and authenticate against the database with mechanisms such as SCRAM or X.509.

Question 43Security, Authentication, and Authorization

What is the purpose of an Atlas project IP access list?

  1. It encrypts all client connections to the cluster by using TLS certificates.
  2. It lists client IP addresses or CIDR blocks permitted to reach project clusters. Correct answer.
  3. It defines the database roles a user may assume after authentication completes.
  4. It controls which database users may authenticate with SCRAM credentials.

Explanation

The project IP access list restricts network connectivity so that only listed client addresses or CIDR ranges can reach clusters in the project. It supplements authentication but does not replace database user credentials or role assignments.

Question 44Security, Authentication, and Authorization

An administrator needs an API key that can manage every project in an organization. Which key type and scope should be used?

  1. A global API key with no assigned roles, relying only on IP access list entries.
  2. A database user with the atlasAdmin role on each cluster.
  3. A project API key with the Project Owner role on a single project.
  4. An organization API key with an organization-level role such as Organization Owner. Correct answer.

Explanation

Organization API keys grant access to organization-level resources and can be assigned organization roles that span projects. Project API keys are scoped to one project, and database users are for MongoDB access rather than the Atlas Admin API.

Question 45Security, Authentication, and Authorization

To enable X.509 authentication for database users in an Atlas project, which requirement must be met?

  1. The client certificate is signed by a CA configured for the project. Correct answer.
  2. The cluster has TLS disabled so the certificate can be exchanged in plaintext.
  3. The client presents a username and password together with the certificate.
  4. Each client certificate is issued by a public CA and includes the Atlas organization ID.

Explanation

X.509 authentication relies on a trust relationship between Atlas and a certificate authority configured for the project. Clients present certificates signed by that trusted CA, and the certificate subject identifies the database user. TLS must remain enabled to protect the connection.

Question 46Security, Authentication, and Authorization

How does Atlas handle custom database roles?

  1. Custom roles can be assigned only to Atlas users and never to database users.
  2. Custom roles replace built-in roles and cannot include built-in privileges.
  3. Custom roles are defined only in mongosh on the primary and are hidden from the Atlas UI.
  4. Custom roles combine resource actions and can inherit from built-in roles. Correct answer.

Explanation

Atlas lets you define custom roles in a project by specifying privileges on resources and optionally inheriting from built-in roles. These roles can then be assigned to database users alongside or instead of built-in roles.

Question 47Security, Authentication, and Authorization

Which statement describes database auditing in MongoDB Atlas?

  1. Auditing requires a separate audit daemon installed on each client machine.
  2. Auditing is enabled by default on every cluster and cannot be disabled by an administrator.
  3. Auditing records only Atlas control-plane logins and never database operations.
  4. Auditing is enabled per project and records database events such as authentication failures. Correct answer.

Explanation

Atlas database auditing is configured at the project level and records auditable database events, including authentication and authorization activity. It is not enabled by default and does not require a client-side daemon.

Question 48Security, Authentication, and Authorization

A team wants to use its own AWS KMS key to encrypt an Atlas cluster's data at rest. What is required?

  1. Create a custom database role with the encrypt action on the cluster.
  2. Use X.509 authentication and disable Atlas-managed encryption keys.
  3. Enable TLS on the cluster and store the KMS key in a database collection.
  4. Configure the cloud KMS key in Atlas and grant Atlas permission to use it. Correct answer.

Explanation

Customer-managed keys require configuring the cloud provider's KMS in Atlas and granting Atlas the permissions needed to use the key. Atlas then uses envelope encryption, with the customer key protecting the data encryption keys.

Question 49Security, Authentication, and Authorization

Which statement accurately describes AWS PrivateLink connectivity for an Atlas cluster?

  1. It replaces database authentication for any client that reaches the private endpoint.
  2. It requires customer and Atlas VPC CIDR ranges to be non-overlapping and uses peering.
  3. It encrypts data at rest using keys stored in the customer VPC.
  4. It provides one-way private access from client VPCs to Atlas without VPC peering. Correct answer.

Explanation

AWS PrivateLink connects client VPCs to Atlas through interface endpoints, providing private one-way access without VPC peering and without requiring non-overlapping CIDR ranges. Clients still must authenticate as database users after the private connection is established.

Question 50Security, Authentication, and Authorization

When LDAP authorization is enabled for an Atlas project, how are MongoDB privileges determined?

  1. Every authenticated LDAP user automatically receives the atlasAdmin role.
  2. LDAP authorization disables database authentication and requires X.509 certificates.
  3. LDAP is used only for Atlas UI login, while database roles are assigned manually.
  4. LDAP groups map to Atlas roles, so group membership determines database privileges. Correct answer.

Explanation

With LDAP authorization, Atlas maps LDAP groups to MongoDB roles so that a user's directory group membership determines the privileges granted in the database. This requires LDAP authentication to be configured and does not automatically grant administrative roles.