CASSANDRA Security 2 — Questions and Answers
Question 1: What CQL command is used to create a new database role in Apache Cassandra?
- ADD ROLE analyst
- CREATE USER analyst
- CREATE ROLE analyst (Correct answer)
- GRANT ROLE analyst
Correct answer: CREATE ROLE analyst
CREATE ROLE is the modern CQL command for creating both login users and non-login roles; CREATE USER is a legacy alias kept for backward compatibility.
Question 2: Which CQL statement correctly grants SELECT permission on table 'orders' in keyspace 'sales' to role 'analyst'?
- GRANT READ ON TABLE sales.orders TO analyst
- GRANT SELECT ON TABLE sales.orders TO analyst (Correct answer)
- ALLOW SELECT ON sales.orders FOR analyst
- PERMIT SELECT ON TABLE sales.orders TO analyst
Correct answer: GRANT SELECT ON TABLE sales.orders TO analyst
The correct syntax is GRANT <permission> ON <resource> TO <role>, using standard SQL-style permission names like SELECT, MODIFY, and ALTER.
Question 3: How do you assign superuser privileges to a role when creating it in Cassandra?
- CREATE ROLE admin WITH ADMIN = true
- CREATE ROLE admin WITH SUPERUSER = true (Correct answer)
- CREATE ROLE admin WITH PRIVILEGE = SUPER
- CREATE ROLE admin WITH ROLE = SUPERUSER
Correct answer: CREATE ROLE admin WITH SUPERUSER = true
The SUPERUSER = true option in CREATE ROLE or ALTER ROLE grants full administrative access, allowing the role to manage all other roles and permissions.
Question 4: What is the recommended strategy for the system_auth keyspace replication in a multi-datacenter production cluster?
- SimpleStrategy with RF=1 (default)
- SimpleStrategy with RF=3 globally
- NetworkTopologyStrategy with RF=1 per DC
- NetworkTopologyStrategy with RF matching the number of nodes in each DC (Correct answer)
Correct answer: NetworkTopologyStrategy with RF matching the number of nodes in each DC
Using NetworkTopologyStrategy with a replication factor matching each datacenter's node count ensures authentication data is available even during node failures across all DCs.
Question 5: Which permission keyword in Cassandra grants all available privileges on a given resource?
- ADMIN
- FULL
- ALL (Correct answer)
- ROOT
Correct answer: ALL
GRANT ALL ON <resource> TO <role> grants every applicable permission (SELECT, MODIFY, ALTER, DROP, AUTHORIZE, DESCRIBE) on the specified resource.
Question 6: What CQL statement removes SELECT permission on a table from a role in Cassandra?
- DENY SELECT ON TABLE ks.tbl FROM role
- REVOKE SELECT ON TABLE ks.tbl FROM role (Correct answer)
- REMOVE SELECT ON TABLE ks.tbl FROM role
- DELETE SELECT ON TABLE ks.tbl FROM role
Correct answer: REVOKE SELECT ON TABLE ks.tbl FROM role
REVOKE is the standard CQL keyword to remove a previously granted permission from a role, mirroring the SQL standard for access control.
Question 7: What CQL command lists all permissions granted to a specific role in Apache Cassandra?
- SHOW PERMISSIONS OF analyst
- DESCRIBE PERMISSIONS FOR analyst
- LIST PERMISSIONS OF analyst (Correct answer)
- SELECT * FROM system_auth.role_permissions WHERE role='analyst'
Correct answer: LIST PERMISSIONS OF analyst
LIST PERMISSIONS OF <role> returns all permissions assigned to the specified role, and LIST ALL PERMISSIONS shows every permission in the cluster.
CASSANDRA Security 2
What CQL command is used to create a new database role in Apache Cassandra?