Advanced MongoDB: aggregation, replication and security
You will learn MongoDB reporting queries, index and schema patterns, replica sets, access control and encryption.
Level 301 · 23 lessons · 21 practice labs
Lessons
Aggregation pipelines
- $group, $unwind and computed fields: You will group documents, take totals and averages, unfold arrays with $unwind and compute new fields.
- Multi-angle reports with $facet and $bucket: You will produce both a distribution split into ranges and summary counts in a single query.
- $lookup, $graphLookup and writing results with $merge: You will join collections, walk hierarchical relations and save the result into another collection.
- Short task: a monthly sales report pipeline
Performance and schema
- Compound indexes and the ESR rule: You will choose field order in a compound index using the equality, sort, range (ESR) rule.
- Special indexes: TTL, partial and text: You will build indexes that expire documents automatically, cover only some documents and search text.
- Finding slow queries with explain and the profiler: You will read how many documents a query scans with explain and catch slow queries with the profiler.
- Schema patterns: embedding, referencing, bucket and versioning: You will decide with reasons between embedded and referenced models based on data size and read patterns.
- Short task: design an index for a slow query
Reliability and scaling
- Multi-document transactions: You will open a transaction session that changes several documents all together or not at all, and know its limits.
- Replica sets: primary, secondary and elections: You will set up a three-member replica set and watch how a new primary is elected when the old one fails.
- Write and read concern: You will choose how many members must hold a write before it is acknowledged and balance speed against durability.
- Change streams: You will watch changes in a collection as they happen and notify another system.
- Sharding basics: You will understand how data is split across servers and how to pick a good shard key.
- Short task: test write safety in a replica set
Security and backup
- Enabling authentication: SCRAM and the first admin: You will lock down a MongoDB that runs without authentication using SCRAM and create the first admin safely.
- Role-based access: built-in and custom roles: You will know the built-in roles and write a custom role giving an app only the collections and actions it needs.
- TLS and network hardening: bindIp and firewall: You will narrow the listening address, restrict port 27017 with a firewall and encrypt connections with TLS.
- Encryption at rest and client-side field-level encryption: You will understand storage encryption and client-side field-level encryption together with the key-management question.
- MongoDB auditing: You will write authentication and authorisation events to the audit log and filter it for suspicious logins.
- Defending against NoSQL injection: You will see how operators like $ne in user input distort a query and close the hole with type-restricting validation.
- Backups with mongodump, mongorestore and the oplog: You will back up with mongodump, restore with mongorestore and return to a chosen moment using the oplog.
- Capstone: report on, scale and protect a MongoDB cluster
Practice labs
- Compute monthly revenue by category: Unwind order lines and write a report that sums revenue by month and category.
- Build a multi-angle summary in one query: Return price ranges, brand breakdown and total product count in one response with $facet.
- Resolve an org chart with $graphLookup: Find every employee under a manager with their depth and write the result to a summary collection with $merge.
- Catch the slowest query with the profiler: Enable the profiler with a 50 ms threshold, run the app and identify the most expensive query shape.
- Design a compound index with the ESR rule: Choose field order by ESR for an order query with equality, sort and range, and measure the difference.
- Tidy a collection with TTL and partial indexes: Expire session documents automatically with a TTL index and shrink index size with a partial index covering only active records.
- Update two collections in one transaction: Make a transfer between accounts in a multi-document transaction and show nothing remains after a failure.
- Build a stock alert with a change stream: Set up a change stream listener that prints a message when stock falls below 5, and test it.
- Resume a change stream after a crash: After the listener crashes, continue from where it stopped with a resume token and prove no event was missed.
- Read a replica set's status: From rs.status output, find the primary, replication lag and the unhealthy member.
- Measure write safety with w:majority: Write with w:1 and w:majority, bring down the primary and compare which writes were lost.
- Split a collection across two shards: Shard a log collection on a small sharded cluster and verify how data spreads across the shards.
- Enable authentication and create the first admin: On a server running without authentication, create the first admin account and show unauthenticated access is refused.
- Open the server only to the app network: Use bindIp and firewall rules so only the application server can reach the database.
- Make TLS mandatory: Issue certificates from your own CA, configure the server with requireTLS and show plain connections fail.
- Track deletes in the audit log: Filter the audit log to record only deletes and user management events, then test it.
- Encrypt an ID number on the client side: Encrypt a customer's ID number with field-level encryption and show no plain text remains in the database.
- Restore to a point in time using the oplog: Restore last night's dump and replay the oplog up to just before a mistaken delete to recover the data.
- Reproduce an operator injection: Show that sending a $ne operator to the lab's login form bypasses the password check.
- Validate input by type: Add validation in the vulnerable app so body fields can only be strings, then retry the attack.
- Close the $where and server-side JavaScript risk: Rewrite a report that puts user input inside $where as a safe pipeline and disable server-side JavaScript.
About this course
You will learn MongoDB reporting queries, index and schema patterns, replica sets, access control and encryption.
What you will learn
- Aggregation pipelines
- Performance and schema
- Reliability and scaling
- Security and backup
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.