CCAAK Confluent Certified Administrator for Apache Kafka Questions and Answers

Apache Kafka supports several security protocols for configuring broker listeners, which define how clients connect to brokers securely or insecurely. As per the official Apache Kafka documentation (“Security Overview” and “Broker Configuration” sections):

PLAINTEXT:“PLAINTEXT – Unauthenticated, unencrypted connections.”This is the default protocol when no security is configured.

SSL:“SSL – SSL authentication and encryption.”It provides secure communication between clients and brokers using SSL/TLS.

SASL_SSL:“SASL_SSL – SASL authentication and SSL encryption.”This combines SASL-based authentication with SSL encryption for secure and authenticated connections.

SASL_PLAINTEXTis also supported, but it was not listed in your options.

Option C (SASL)is not a valid protocol on its own—it’s a mechanism used within SASL_PLAINTEXT or SASL_SSL.

Option E (GSSAPI)is a SASL mechanism (often used with Kerberos), not a protocol.

Therefore, the correct answers are:

A. PLAINTEXT

B. SSL

D. SASL_SSL

Page Reference:

Confluent Kafka: The Definitive Guide, 1st Edition, Chapter 9 (“Kafka Security”), p. 282–283.

Apache Kafka Documentation, “Security Overview” and “Configuring Broker Listeners”.

Kafka's Controller is a broker that also performs controller duties. It is not a dedicated node. Therefore, it continues to host topics, partitions, and leaders just like any other broker.

From Kafka documentation:

“The controller is one of the brokers in the cluster and continues to perform all normal broker functions.”

A → Correct: The controller is also a normal broker with partitions.

B/C/D → Incorrect: Replication and consumer fetches are not tied to the controller.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 190

Apache Kafka Documentation: Kafka Controller Behavior

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

In Apache Kafka, rack awareness can be used to ensure better fault tolerance and availability by spreading partition replicas across brokers in different racks. The broker configuration property that explicitly indicates the rack a broker belongs to is broker.rack.

As per the official Apache Kafka documentation:

“To assign a broker to a specific rack, configure the broker.rack property in server.properties. This informs Kafka of the rack location for the broker.”

This is useful for features like rack-aware partition assignment and leader election. With broker.rack set, Kafka can make intelligent decisions to ensure that replicas are distributed across racks.

Other options:

client.rack is a client-side setting to inform Kafka of the client’s rack for fetching from the closest replica, not for brokers.

zookeeper.rack and kafka.rack do not exist in Kafka’s official configuration.

Page Reference:

Apache Kafka Documentation, “Rack Awareness” section.

Confluent Kafka: The Definitive Guide, 1st Edition, Chapter 6 (Kafka Cluster), p. 215.

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Partitions are Kafka’s core mechanism for scaling and distributing load. Each partition of a topic is distributed across brokers. Producers and consumers interact with specific partitions, and Kafka automatically balances those partitions across available brokers.

From Kafka documentation:

“Partitions allow Kafka to parallelize data and distribute load across brokers and clients.”

A → Correct: Distributes data and load

B → Incorrect: Replicas are for fault tolerance, not load balancing

C → Incorrect: Offsets track read progress, not distribute load

D → Incorrect: Connectors are part of Kafka Connect, not used for client balancing

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 4, p. 132–134

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

For maximum throughput and lowest latency, the setting acks=0 allows the producer to send messages without waiting for any acknowledgment from the broker. This increases speed but at the cost of durability.

From Kafka documentation:

“acks=0: The producer does not wait for any acknowledgment from the broker. The message can be lost but offers the highest throughput.”

A → Correct: Maximizes throughput with no delivery guarantee.

B → Balanced option but not max throughput.

C → Offers strongest durability but lowest throughput.

D → Invalid configuration.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 5, p. 158–159

Apache Kafka Documentation: Producer Configs – acks

By default, Kafka does not enable any security mechanism. This means:

Communication is done over PLAINTEXT (unencrypted).

No authentication is configured.

No authorization is enforced.

From Apache Kafka documentation:

“By default, Kafka has no security. All network communication is done in plaintext, and there is no client authentication or authorization.”

This means that:

Option A is correct.

Option B is incorrect because encryption is not enabled by default.

Option C is incorrect because authentication is not provided unless SASL is configured.

Option D is incorrect as neither encryption nor authentication is enabled by default.

Page Reference:

Confluent Kafka: The Definitive Guide, 1st Edition, Chapter 9, p. 275

Apache Kafka Documentation: “Security Overview” section

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

In Kafka, a partition is a fundamental unit of parallelism and storage. Each topic in Kafka consists of one or more partitions, which are ordered, immutable sequences of records. Importantly, partitions themselves are broken down into segments on the disk. According to the official Kafka documentation:

“A partition is made up of one or more segment files on disk. Each segment is a continuous sequence of messages and each segment file is named after the offset of the first message it contains.”(Apache Kafka Documentation, "Log Basics" section).

Each partition resides in its own directory under the log.dirs configuration on the broker. The documentation states:“The log for each topic partition is stored in its own directory under the log.dirs configuration.”

Given these official clarifications:

Option A is incorrectbecause a partition is not represented by a single segment; rather, it can have multiple segments (as log segments are created to manage file sizes and facilitate compaction or deletion).

Option B is correctas it accurately states that a partition consists of multiple segments.

Option C is correctas all segments for a partition reside in a single directory.

Option D is incorrectbecause partition size is determined by the sum of all its segments, not just the largest one.

A → Correct: Kafka uses ZooKeeper's ephemeral node (/controller) to elect a single controller. If the node disappears (e.g., due to GC pause or failure), a new controller is elected.“Kafka uses an ephemeral znode in ZooKeeper to hold the identity of the controller.” — Apache Kafka docs

B → Correct: The controller assigns partition leaders after startup or during rebalancing.

C → Correct: The controller epoch is a monotonically increasing number used to detect outdated controller messages.“Kafka uses a controller epoch to avoid split-brain situations. A new controller will increase the epoch.”

Incorrect options:

D → Wrong: Broker ID is not used as epoch.

E → Wrong: Only one active controller at a time, not one per broker.

F → Wrong: Partition assignment to consumers is handled by the consumer coordinator, not the controller.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 189–192

Apache Kafka Documentation: “Kafka Controller Design”

Kafka topics support two main cleanup policies:

delete: The default policy where Kafka deletes old log segments based on retention time or size.

compact: Enables log compaction, retaining only the latest value for each key.

From Kafka documentation:

“Valid cleanup.policy values are 'delete' and 'compact'.”

B → Invalid: 'default' is not a recognized cleanup policy.

D → Invalid: 'cleanup' is not a valid keyword in this context.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 196–197

Apache Kafka Documentation: Topic Configs – cleanup.policy

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

In Kafka, the Controller is responsible for managing partition leadership. When a broker that was leader for certain partitions goes down, the Controller immediately detects the failure and:

Triggers a new leader election among the in-sync replicas (ISRs) of those partitions.

Updates the partition metadata to reflect the new leaders and notifies the cluster.

Kafka documentation states:

“When a broker fails, the controller triggers a leader election for all partitions previously led by the failed broker.”

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 190–191

Apache Kafka Documentation: “Kafka Controller and Leader Election”

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

The kafka-consumer-groups.sh script is used to monitor consumer group offsets and lag. It shows the current offset, log end offset, and lag for each partition consumed by a consumer group.

From Kafka documentation:

“You can use kafka-consumer-groups.sh with the --describe flag to get the offset lag per consumer group.”

A → Incorrect: No such built-in script.

B → Correct: Official script for viewing consumer group lag.

C → Incorrect: Does not exist as a built-in Kafka tool.

D → Incorrect: Used for partition reassignment, unrelated to lag monitoring.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 308

Apache Kafka Documentation: kafka-consumer-groups.sh usage

The consumer property auto.offset.reset applies only when no committed offset exists or the committed offset is invalid (e.g., below the log start offset).

However, if an offset is within the valid log range (even if the actual message was removed due to compaction), it is considered valid, and auto.offset.reset is not used.

From Kafka documentation:

“If the consumer’s committed offset is still within the range of the log, even if the message was compacted away, it will be respected.”

Explanation of options:

A, B, C → All scenarios where auto.offset.reset would apply.

D → Correct: Offset is valid even though the message is gone.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 199

Apache Kafka Documentation: Consumer Configs – auto.offset.reset

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

A message (also referred to as a record or event) is the smallest unit of data in Kafka. Each message consists of a key, value, timestamp, and metadata. Messages are stored in partitions and are identified by their offsets.

From Kafka documentation:

“The atomic unit of data in Kafka is a message, which includes a key, value, and headers.”

A → Logical grouping of messages.

B → Correct: Base-level data structure.

C → A topic holds partitions, not messages directly.

D → Refers to the position of a message, not the message itself.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 4, p. 120

Apache Kafka Documentation: Message Structure