I am currently working on setting up a MongoDB replica set. I have a primary, secondary and arbiter in place. All fine. From here I have 3 tasks to complete.
My assessment of the tasks.
1) Backup can be taken from either primary or secondary, and it is recommended to be taken from some secondary ( or may be a backup secondary server )
2) Yes. But if you shutdown primary, your application should handle those exceptions ( for write operations because they will fail, till the time new primary is selected )
3) A general ( username, password ) based authentication you can do. mongo2.4 has new roles for authentication. You can choose to have ssl based authentication. Between the mongodb server communication a keyFile based authentication is there