CCNA Server Administration Questions

Security administration involves protecting data at rest, in transit, and in logs. Log redaction is a feature that prevents sensitive information, like the contents of a 'find' filter or an 'insert' document, from appearing in the server logs. This is essential for compliance with regulations like GDPR, HIPAA, or PCI-DSS.

When backing up a live database, data changes while the backup is running. The '--oplog' flag tells mongodump to capture all operations that occur during the dump process. This allows the DBA to restore the database to a consistent state by replaying those operations during the 'mongorestore' process, ensuring data integrity.

The auditing system in MongoDB Enterprise is essential for compliance and security monitoring. By configuring the audit log to capture events related to authentication and authorization, administrators gain visibility into who is accessing the database and what actions they are performing. This is crucial for forensic analysis, detecting unauthorized access attempts, and satisfying regulatory requirements that mandate detailed record-keeping for all database interactions within a production environment.

Arbiters are lightweight processes that participate in elections but do not hold data. They are a cost-effective way to achieve a majority for elections in small replica sets. Understanding when to use an arbiter is crucial for designing a cost-efficient and highly available architecture, especially when deploying in multiple zones where adding a full data-bearing node might be cost-prohibitive or unnecessary due to data redundancy requirements.

While mongostat gives a high-level view of server-wide operations and memory, mongotop provides a granular look at where the storage engine is spending its time. It breaks down read and write time by collection, allowing the DBA to identify which specific table is causing the most load on the system.

Binding MongoDB to the correct network interfaces is a fundamental security task. By default, older versions might bind to all interfaces, exposing the database to the public internet. Best practices dictate binding only to the loopback address and specific internal management or application network IPs to minimize the attack surface.

The requirement is for a write concern that ensures acknowledgment after a majority of voting members have applied the write and written it to the on-disk journal. The write concern { w: 'majority', j: true } achieves both: w: 'majority' dynamically requires a majority of voting members, and j: true forces journaling on those members before acknowledgment. Using a fixed w: 2 may not adapt to membership changes, and omitting j: true does not guarantee journaling. (Explanation length: 65 words)

The readWriteAnyDatabase built-in role provides read and write access to all non-system databases without granting administrative privileges. It is the least-privilege role that satisfies the requirement. The other roles either grant excessive privileges, are scoped to a single database, or do not provide the needed access across all application databases.

Internal authentication ensures that only trusted components can join the cluster and communicate with each other. While keyfiles are common, X.509 certificates provide a higher level of security by utilizing a Certificate Authority (CA) and providing stronger identity verification. This is standard practice in high-security environments where protecting the internal traffic between nodes is as vital as client-to-server security.

Effective memory management is the core of MongoDB server administration. While the default cache size is usually optimal, administrators must adjust it when the server hosts other memory-intensive processes. If the operating system or other tools are starved for RAM, it can lead to excessive swapping and system instability, which harms database performance.

Monitoring server health via mongostat is a daily task for a DBA. High write volumes are best identified by looking at the actual operation counts (insert, update, delete) and the state of the write queue. If the 'qw' (queue write) count is high, it indicates that the storage engine cannot keep up with the incoming write requests.

The error 'No space left on device' indicates that the disk partition hosting the 'dbPath' directory is completely full. This prevents WiredTiger from writing data, metadata, or logs, causing an immediate shutdown to prevent data corruption. Administrators must free up space on the disk or extend the partition before restarting the service, as the database cannot recover or accept new writes without sufficient storage capacity to manage its internal files.

Page faults occur when the mongod process attempts to access data that is not currently in the physical RAM (resident memory). While some page faults are normal, a sudden spike usually indicates that the 'working set' (the data and indexes accessed most frequently) has grown larger than the available RAM, forcing frequent disk reads.

Log rotation is a critical administrative task that prevents disk space exhaustion and facilitates log analysis. Using the SIGUSR1 signal on Linux systems allows the administrator to rotate logs without any downtime or server restarts. This ensures continuous availability while maintaining manageable file sizes for diagnostic purposes, which is essential for long-term server health and compliance with retention policies.

The first step in diagnosing replication lag is to quantify it and check the secondary's progress. rs.printSlaveReplicationInfo() provides the lag in seconds and the timestamp of the last oplog entry applied, helping you understand the severity and whether the secondary is making progress. Other actions like restarting or resizing the oplog are premature without diagnosis.

Checking the replica set status is a routine administrative task to ensure high availability and data consistency. The 'rs.status()' command provides a comprehensive view of the cluster, including the state of every member, the current primary, and the sync lag. This command is the primary diagnostic tool for verifying that the replica set is healthy and that all nodes are correctly communicating with each other.

The database profiler is an essential administrative tool for diagnosing performance issues. Profiling level 1 is used to capture 'slow' operations without the overhead of capturing every single request (level 2). Setting the 'slowms' threshold to 200 allows the DBA to filter out expected noise and focus on the problematic operations.

The --repair flag is a last-resort tool that attempts to salvage data from corrupted files, but it cannot fix severe filesystem or metadata corruption where blocks are missing or unreadable. The 'Short read' error indicates physical or logical corruption that WiredTiger cannot bypass. In this scenario, restoring from a known-good backup is the only reliable way to ensure data integrity.

MongoDB's Role-Based Access Control (RBAC) allows for granular permission management. The 'backup' role provides the necessary privileges to use tools like mongodump without granting general read access to all collections. The 'clusterMonitor' role allows the user to run commands like 'serverStatus' and 'top', which are essential for monitoring performance.

The speed at which a new replica set member becomes 'secondary' and ready to participate depends on the amount of data it must synchronize from an existing member. Initial sync involves cloning data and applying the oplog. Understanding this process is vital for capacity planning, as adding a large member can put significant I/O and network pressure on the current primary or secondaries, potentially impacting performance for existing application traffic during the synchronization process.

mongotop is designed to provide per-collection read and write statistics, showing how much time each collection spends on these operations. This directly answers the need to find collections generating the most disk I/O. The other tools either provide server-wide metrics, point-in-time operation lists, or static collection statistics that do not reflect active I/O.

The 'net' section in the YAML configuration file provides granular control over how the MongoDB instance communicates over the network. Configuring the 'bindIp' and 'port' is a fundamental step in securing and reaching the database. Properly setting these parameters ensures that the server is accessible only on the intended interfaces, which is a critical security practice to prevent unauthorized access from untrusted networks or public interfaces.

A replica set requires a majority of nodes to elect a primary. In a two-node set, a failure of one node makes it impossible to reach a majority, as one out of two is not greater than half. This design limitation is critical because it leads to the loss of a primary and the inability to elect a new one, resulting in a read-only database and complete outage for write operations.

To gracefully transfer primacy before maintenance, the DBA should use `rs.stepDown()`, which forces the primary to become a secondary and triggers an election. The optional argument specifies how long the stepped-down member remains ineligible for election, preventing it from immediately reclaiming primacy. This allows a secondary to take over and provides a stable primary during the maintenance window.