Create users with least privilege: readWrite on one database, not clusterAdmin. Enable TLS and network allowlists on Atlas.
Role example (concept)
use admin
db.createUser({
user: 'app_rw',
pwd: 'CHANGE_ME',
roles: [{ role: 'readWrite', db: 'practice' }]
})Never commit real passwords—use secrets managers in production.
Defense in depth
- TLS in transit, encryption at rest on Atlas
- IP allowlist / VPC peering
- Audit logs for admin actions
- Field-level encryption for PII when required
Important interview questions and answers
- Q: readWrite scope?
A: CRUD on one database—not other DBs unless granted. - Q: Injection in Mongo?
A: Use parameterized queries in drivers—never concatenate user input into shell strings.
Self-check
- Why separate app user per environment?
- How prevent NoSQL injection?
Tip: App users get readWrite on one DB—not clusterAdmin.
Interview prep
- readWrite role?
- CRUD on one database.
- NoSQL injection?
- Use parameterized driver queries—never string concat.