Question bank
Confluent Certified Administrator for Apache Kafka
40 Confluent Certified Administrator for Apache Kafka questions with the correct answer and a written explanation, organised across 6 exam domains.
- 40 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Cluster Installation & Configuration
8 questions in this domain
- Question 1Single Choice
Which repository contains the private key and certificate that identifies a Kafka broker during a TLS handshake?
- AKeystoreCorrect answer
- BTruststore
- CCertificate Revocation List
- DKey Distribution Center
Why this is the answer
A keystore holds the local identity's private key and certificate. A truststore holds public CA certificates used to verify remote parties during TLS.
- Question 2Multiple Select
Which statements about SASL mechanisms are correct?
- ASASL/SCRAM stores credentials using salted hashes.Correct answer
- BSASL/GSSAPI uses a Key Distribution Center and tickets.Correct answer
- CSASL/PLAIN should always be combined with SSL/TLS to protect credentials.Correct answer
- DSASL/OAUTHBEARER relies on Kerberos tickets.
Why this is the answer
SASL/SCRAM uses salted hashes, SASL/GSSAPI uses Kerberos tickets, and SASL/PLAIN must be protected with TLS. OAUTHBEARER uses OAuth2 bearer tokens, not Kerberos.
- Question 3Interactive
Given the JAAS configuration shown in the code block, which SASL mechanism is being configured?
- ASCRAM-SHA-256Correct answer
- BPLAIN
- CGSSAPI
- DOAUTHBEARER
Why this is the answer
The JAAS configuration uses ScramLoginModule and explicitly sets sasl.mechanism to SCRAM-SHA-256, so the mechanism is SCRAM-SHA-256.
- Question 4Single Choice
In Kafka's ACL model, what happens when a client request has no explicit Allow rule?
- AIt is denied.Correct answer
- BIt is allowed.
- CIt is queued for approval.
- DIt depends on an existing Deny rule.
Why this is the answer
Kafka's ACL model uses implicit deny; without an explicit Allow rule, access is denied. Kafka does not use explicit Deny rules.
- Question 5Multiple Select
Which resources can be governed by Kafka ACLs beyond topics?
- AConsumer GroupsCorrect answer
- BTransactional IDsCorrect answer
- CSchemas
- DThe ClusterCorrect answer
Why this is the answer
Kafka ACLs can be applied to Consumer Groups, Transactional IDs, and the Cluster itself. Schemas are typically governed by Confluent RBAC rather than raw Kafka ACLs.
- Question 6Interactive
Review the broker security settings in the code block. Which conclusions are accurate?
- AClients must present a valid certificate to the broker.Correct answer
- BMutual TLS is enabled for client connections.Correct answer
- CNo client authentication is needed because encryption alone is sufficient.
- DThis configuration disables TLS for inter-broker communication.
Why this is the answer
With ssl.client.auth=required, the broker demands a client certificate, enabling mutual TLS. The inter-broker protocol remains SSL, so TLS is not disabled.
- Question 7Single Choice
Which SASL mechanism authenticates using a third-party Key Distribution Center and tickets rather than sending a password?
- AGSSAPI (Kerberos)Correct answer
- BSASL/PLAIN
- CSASL/SCRAM
- DSASL/OAUTHBEARER
Why this is the answer
SASL/GSSAPI uses a Key Distribution Center and tickets, avoiding direct password transmission. PLAIN and SCRAM use password-based flows, and OAUTHBEARER uses tokens.
- Question 8Multiple Select
Which of the following are common TLS configuration traps in Kafka?
- AConfusing ssl.client.auth=required with ssl.client.auth=noneCorrect answer
- BOmitting the intermediate CA certificate from the broker keystoreCorrect answer
- CAssuming every SSLHandshakeException is a network/firewall issueCorrect answer
- DUsing JAAS configuration to define user permissions
Why this is the answer
Common TLS mistakes include misapplying ssl.client.auth, forgetting intermediate CAs, and misreading SSLHandshakeException. JAAS defines authentication logic, not permissions.
Kafka Architecture & Fundamentals
8 questions in this domain
- Question 9Single Choice
In a Kafka TLS configuration, what type of cryptographic material is stored inside a truststore used for broker authentication?
- APrivate key and certificate
- BPublic certificates of trusted CAsCorrect answer
- CSASL/SCRAM password hashes
- DConsumer group offset metadata
Why this is the answer
A truststore holds public CA certificates used to verify remote parties during the TLS handshake. A keystore contains the private key and certificate that identify the local entity.
- Question 10Multiple Select
Which two statements correctly describe the authentication behavior required by mutual TLS in a Kafka deployment?
- AOnly the broker presents a certificate
- BBoth broker and client present valid certificatesCorrect answer
- CmTLS requires two-way authenticationCorrect answer
- DmTLS uses SASL/PLAIN for encryption
Why this is the answer
mTLS requires both broker and client to present certificates, providing strong two-way authentication. It does not replace SASL/PLAIN, and standard TLS only authenticates the server.
- Question 11Interactive
In the JAAS configuration shown in the code block, which Kafka security component is being defined for the broker?
- AAuthentication credentials and mechanismCorrect answer
- BAuthorization permissions for resources
- CDisk-level encryption keys
- DTopic replication settings
Why this is the answer
JAAS defines the SASL mechanism, login module, and credentials needed to authenticate. Permissions and authorization are handled separately by ACLs or RBAC.
- Question 12Single Choice
What is a common consequence when a client trusts only the root CA but an intermediate CA certificate is absent from the broker's keystore?
- AClients fail to validate the broker's certificateCorrect answer
- BClients automatically fetch the missing certificate
- CNo impact because the root CA is trusted
- DThe broker rejects all SASL connections
Why this is the answer
The trust chain must be complete. If the intermediate CA is absent from the keystore, clients cannot validate the presented chain even if they trust the root CA.
- Question 13Multiple Select
Which of these authentication mechanisms are valid SASL mechanisms that a Kafka client can use during the connection handshake?
- ASASL/PLAINCorrect answer
- BSASL/SCRAMCorrect answer
- CSASL/GSSAPICorrect answer
- DSASL/TLS
Why this is the answer
Kafka supports SASL/PLAIN, SASL/SCRAM, SASL/GSSAPI, and SASL/OAUTHBEARER. TLS is an encryption protocol, not a SASL mechanism.
- Question 14Interactive
Based on the SSLHandshakeException in the code block, which area should a Kafka administrator investigate before changing network settings?
- ANetwork connectivity and firewall rules
- BTruststore contents and certificate chainCorrect answer
- CKafka consumer group offsets
- DDisk space on the broker
Why this is the answer
SSLHandshakeException is often caused by an untrusted certificate chain. Administrators should inspect the truststore and ensure all required CA certificates are present before checking the network.
- Question 15Single Choice
Which statement accurately distinguishes the role of SASL from the role of SSL/TLS in a secure Kafka cluster?
- ASASL handles identity, SSL/TLS handles encryptionCorrect answer
- BSASL handles encryption, SSL/TLS handles identity
- CSASL and SSL/TLS both authorize topic access
- DSASL is used only for key rotation
Why this is the answer
SASL handles identity and authentication, while SSL/TLS secures the channel with encryption and integrity. They are complementary in a secure Kafka configuration.
- Question 16Multiple Select
Which resource types are valid targets for access control lists when securing an Apache Kafka cluster?
- ATopicsCorrect answer
- BConsumer GroupsCorrect answer
- CTransactional IDsCorrect answer
- DClusterCorrect answer
Why this is the answer
ACLs can be applied to topics, consumer groups, transactional IDs, and the cluster itself. Administrators must manage all these resource types for proper security.
Kafka Connect & kDB
6 questions in this domain
- Question 17Single Choice
In TLS configuration, what is the main purpose of a truststore?
- ATo hold the private key and certificate that identify the local broker
- BTo store public certificates of trusted certificate authorities used to verify remote partiesCorrect answer
- CTo store the usernames and passwords for SASL authentication
- DTo encrypt the Kafka topic data at rest using KMS
Why this is the answer
A truststore contains the public certificates of trusted certificate authorities that a broker or client uses to verify remote identities during the TLS handshake. The keystore, not the truststore, holds the private key and local certificate.
- Question 18Multiple Select
Which two statements correctly distinguish SASL from SSL?
- ASASL handles authentication or identity verification.Correct answer
- BSSL/TLS provides encryption and integrity for the communication channel.Correct answer
- CSASL encrypts data stored in Kafka log segments.
- DSSL/TLS primarily manages ACLs and authorization.
Why this is the answer
SASL is an authentication framework that verifies identity, while SSL/TLS secures the channel between client and broker by providing encryption and integrity. SASL does not encrypt data at rest, and TLS does not manage authorization.
- Question 19Interactive
Based on the JAAS configuration shown in the code block, and knowing that encryption is not enabled, what security issue is most likely to occur?
- AThe username and password are transmitted in plaintext over the network.Correct answer
- BThe broker will reject the certificate chain because no truststore exists.
- CThe principal will be denied authorization because no ACLs are defined.
- DThe client will be forced to use Kerberos tickets instead of a password.
Why this is the answer
SASL/PLAIN sends username and password in clear text unless protected by SSL/TLS. The other choices describe certificate or authorization issues that are not directly caused by this JAAS/PLAIN setup.
- Question 20Single Choice
What value must be set for ssl.client.auth to enforce mutual TLS on a Kafka broker?
- Anone
- Brequested
- CrequiredCorrect answer
- Dcertificate
Why this is the answer
ssl.client.auth=required enforces mutual TLS by requiring every client to present a valid certificate. With ssl.client.auth=none, only the server presents a certificate and encryption is not mutual.
- Question 21Multiple Select
Besides Topic-level READ, which two ACLs are commonly required for a Kafka consumer to work correctly?
- AREAD on the Consumer Group resourceCorrect answer
- BDESCRIBE on the Topic resourceCorrect answer
- CALTER on the Cluster resource
- DWRITE on the Transactional ID resource
Why this is the answer
A consumer needs READ on the consumer group to commit offsets and DESCRIBE on the topic to discover metadata. Cluster ALTER and Transactional ID WRITE are not general consumer requirements.
- Question 22Interactive
The code block shows a Kafka broker TLS property. What does this configuration instruct the broker to do?
- ARequire every client to present a valid certificate for authentication.Correct answer
- BAllow clients to connect without any certificate.
- CEncrypt data at rest using LUKS.
- DDisable TLS encryption entirely.
Why this is the answer
The setting ssl.client.auth=required enforces mutual TLS; the broker requires clients to present valid certificates during the TLS handshake.
Operations & Monitoring
8 questions in this domain
- Question 23Single Choice
What type of material is stored in a truststore in a Kafka TLS configuration?
- APublic certificates of trusted CAsCorrect answer
- BThe local entity's private key
- CUsername and password pairs
- DConsumer group offsets
Why this is the answer
A truststore stores public certificates of trusted certificate authorities so a peer can be verified during the TLS handshake. Private keys and certificates identifying the local entity are kept in a keystore.
- Question 24Multiple Select
Which actions are performed during the SSL/TLS handshake? Select all that apply.
- ANegotiation of encryption parametersCorrect answer
- BExchange of certificatesCorrect answer
- CEstablishment of a secure sessionCorrect answer
- DCommit of consumer offsets
Why this is the answer
The handshake negotiates algorithms, exchanges certificates for authentication, and establishes the secure session. Committing offsets is a Kafka protocol operation, not part of TLS.
- Question 25Interactive
Examine the broker setting shown in the exhibit. What security behavior does this configuration enforce?
- ABoth the broker and the client must present valid certificatesCorrect answer
- BOnly the broker must present a certificate
- CNo TLS encryption is required
- DOnly the client must present a certificate
Why this is the answer
Setting ssl.client.auth=required enforces mutual TLS, meaning the broker also requires a valid client certificate. Setting it to none would only allow server-side TLS.
- Question 26Single Choice
What is the primary security benefit of SASL/SCRAM compared with SASL/PLAIN?
- AIt stores credentials as salted hashesCorrect answer
- BIt disables SSL/TLS encryption
- CIt does not require a jaas config
- DIt sends passwords in clear text
Why this is the answer
SCRAM uses salted hashed passwords, reducing risks like rainbow table attacks. PLAIN transmits username and password in clear text unless protected by TLS.
- Question 27Multiple Select
Which statements correctly describe SASL and SSL in Kafka? Select all that apply.
- ASASL verifies identity while SSL protects channel securityCorrect answer
- BSSL is responsible for encryption and integrityCorrect answer
- CSASL/PLAIN should always be protected with SSL/TLSCorrect answer
- DSSL can replace SASL as an authentication mechanism
Why this is the answer
SASL handles authentication and identity while SSL/TLS handles channel security and encryption. SASL/PLAIN sends plaintext credentials, so TLS must wrap it; SSL does not provide Kafka SASL identity verification.
- Question 28Interactive
According to the displayed JAAS configuration, what does this entry define?
- ACredentials and login module for authenticationCorrect answer
- BACL permissions for resource access
- CTLS certificate trust list
- DEncryption keys for data at rest
Why this is the answer
JAAS defines the login module, username, and password used during authentication. It does not define permissions or encryption; ACLs and TLS handle those separately.
- Question 29Single Choice
What is the purpose of using prefix matching in Kafka ACLs?
- AGrant access to a pattern of topicsCorrect answer
- BBypass authentication for a principal
- CEncrypt messages for specific topics
- DReplace SASL with SSL
Why this is the answer
Prefixed ACL resources allow a single rule to apply to all matching resource names, such as logs-*, simplifying management at scale.
- Question 30Multiple Select
In addition to Topics, which resource types can Kafka ACLs protect? Select all that apply.
- AConsumer GroupsCorrect answer
- BTransactional IDsCorrect answer
- CClusterCorrect answer
- DKMS
Why this is the answer
ACLs apply to consumer groups, transactional IDs, and the cluster itself to prevent unauthorized offset commits, secure idempotent producers, and control admin operations. KMS is for key management, not a Kafka ACL resource.
Performance Tuning & Troubleshooting
4 questions in this domain
- Question 31Single Choice
In a Kafka broker's TLS configuration, what is stored in the keystore?
- AThe private key and certificate that identify the brokerCorrect answer
- BThe public certificates of trusted certificate authorities
- CSASL usernames and passwords
- DThe listener name and port configuration
Why this is the answer
A keystore stores the local entity's private key and associated certificate. A truststore stores CA public certificates used to validate remote peers.
- Question 32Multiple Select
Which of the following statements about SASL mechanisms are correct?
- ASASL/GSSAPI uses a Key Distribution Center for Kerberos authenticationCorrect answer
- BSASL/OAUTHBEARER uses bearer tokens from an external Identity ProviderCorrect answer
- CSASL/PLAIN is inherently secure without additional TLS/SSL encryption
- DSASL/SCRAM stores credentials as salted hashes to protect against rainbow table attacksCorrect answer
Why this is the answer
Kerberos relies on a KDC, OAUTHBEARER uses tokens from an IdP, and SCRAM uses salted hashes. PLAIN is insecure unless protected by TLS.
- Question 33Interactive
The JAAS configuration shown in the code block is used by a Kafka client. Which SASL mechanism is being configured?
- ASASL/PLAINCorrect answer
- BSASL/SCRAM
- CSASL/GSSAPI
- DSASL/OAUTHBEARER
Why this is the answer
The PlainLoginModule is the JAAS module for SASL/PLAIN, using a username and password that must be protected by SSL/TLS encryption.
- Question 34Single Choice
In a Kafka broker configuration, what is the effect of setting ssl.client.auth=required?
- AMutual TLS, where both broker and client present certificatesCorrect answer
- BOnly the server must present a certificate
- COnly username and password authentication
- DNo authentication, only encryption
Why this is the answer
Setting ssl.client.auth to required makes brokers request and validate client certificates, enforcing mutual TLS. The value none only provides server-side encryption.
Security
6 questions in this domain
- Question 35Single Choice
In the context of Kafka TLS configuration, what is the primary difference between a keystore and a truststore?
- AA keystore verifies remote CAs; a truststore stores the private key.
- BA keystore stores the private key and certificate for the local entity; a truststore stores trusted CA certificates.Correct answer
- CA keystore stores encrypted passwords; a truststore stores plaintext credentials.
- DA keystore is used only by clients; a truststore is used only by brokers.
Why this is the answer
The keystore holds identity material such as the private key and certificate for the local entity, while the truststore holds CA certificates used to validate remote parties.
- Question 36Multiple Select
Which of the following are supported SASL mechanisms for authentication in Kafka? (Select all that apply.)
- ASASL/PLAINCorrect answer
- BSASL/SCRAMCorrect answer
- CSASL/GSSAPICorrect answer
- DSASL/OAUTHBEARERCorrect answer
Why this is the answer
Kafka supports SASL/PLAIN, SCRAM, GSSAPI/Kerberos, and OAUTHBEARER as authentication mechanisms.
- Question 37Interactive
Refer to the broker configuration in the code block. What security behavior does this setting enforce?
- AIt disables TLS encryption.
- BIt enforces mutual TLS, requiring clients to provide valid certificates.Correct answer
- CIt allows anonymous TLS connections.
- DIt only enables server-side TLS.
Why this is the answer
The value 'required' for ssl.client.auth enforces mutual TLS, meaning clients must present a valid certificate during the handshake.
- Question 38Single Choice
What is the primary purpose of SASL/GSSAPI (Kerberos) authentication in Kafka?
- AIt uses tickets from a Key Distribution Center to authenticate users without sending passwords to the broker.Correct answer
- BIt sends the user's password directly to the broker for validation.
- CIt encrypts the broker's keystore with a shared secret.
- DIt provides ACL-based authorization after the TLS handshake.
Why this is the answer
SASL/GSSAPI relies on a KDC and ticket-based authentication, so passwords are not transmitted directly to the broker.
- Question 39Multiple Select
To which resource types can Kafka ACLs be applied? (Select all that apply.)
- ATopicsCorrect answer
- BConsumer GroupsCorrect answer
- CTransactional IDsCorrect answer
- DClusterCorrect answer
Why this is the answer
ACLs apply to topics, consumer groups, transactional IDs, and the cluster itself.
- Question 40Interactive
Look at the JAAS configuration provided in the code block. Which SASL authentication mechanism is defined?
- ASASL/PLAINCorrect answer
- BSASL/SCRAM
- CSASL/GSSAPI
- DSASL/OAUTHBEARER
Why this is the answer
The login module class name 'PlainLoginModule' identifies the SASL/PLAIN mechanism, which uses a username and password.
Frequently asked questions
Everything about the Confluent Certified Administrator for Apache Kafka question bank and how to use it.