CCAAK Confluent Certified Administrator for Apache Kafka Questions and Answers

Apache Kafka's built-in ACL mechanism (SimpleAclAuthorizer) stores ACL data in ZooKeeper. ACLs are propagated to brokers from ZooKeeper and cached in memory for fast lookup.

From Kafka documentation:

“ACLs are stored in ZooKeeper under /kafka-acl and are loaded into each broker at startup and on updates.”

B → Correct: ZooKeeper stores ACLs centrally.

A → Brokers load ACLs but don’t persist them.

C & D → Do not store or manage ACLs.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 9, p. 285

Apache Kafka Documentation: Authorizer Configuration

Upon detecting a broker failure, the Controller performs leader election among in-sync replicas and updates the new leader and ISR information in ZooKeeper. It then broadcasts this metadata update to all brokers in the cluster.

From Kafka documentation:

“The controller writes the new leader and ISR list to ZooKeeper and informs all brokers so they can update their metadata cache.”

B → Correct: New metadata written to ZooKeeper.

C → Correct: Brokers are updated via metadata propagation.

A → Incorrect: The Controller makes the decision, not ZooKeeper.

D → Incorrect: Producers and consumers learn about changes via brokers, not directly.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 190–191

Apache Kafka Documentation: Controller Behavior & ZooKeeper Interactions

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka’s default authorizer implementation is the SimpleAclAuthorizer, which stores ACLs in ZooKeeper and reads them on each access.

From Kafka documentation:

“Apache Kafka includes an out-of-the-box authorizer implementation that stores ACLs in ZooKeeper.”

A → RBAC is Confluent-specific and not stored in ZooKeeper.

B → Correct: Built-in ACL mechanism uses ZooKeeper.

C → Ranger is an external plugin, not bundled with Apache Kafka.

D → LDAP is used for authentication, not authorization.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 9, p. 285

Apache Kafka Documentation: ACLs and Authorizers

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka supports topic deletion via the kafka-topics.sh tool if the broker property delete.topic.enable=true. This is the recommended and cleanest method to delete a topic and its data from the cluster.

From Kafka documentation:

“To delete a topic, use kafka-topics.sh with --delete flag, provided delete.topic.enable is set to true on the broker.”

A → Correct: Official method.

B → Misunderstood use of null keys (used for compaction).

C → Not recommended; causes inconsistent state.

D → Deletes consumer state, not the topic itself.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 198

Apache Kafka Documentation: Topic Deletion

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

In Kafka Connect, sink connectors consume data from Kafka topics and send it to external systems (e.g., databases, object storage, search indexes).

From Kafka documentation:

“Sink connectors receive data from Kafka topics and write it to external systems.”

A → Correct: Moves data out of Kafka.

B → Moves data into Kafka.

C → Not a connector type.

D → Not a standard connector classification.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 8, p. 241

Apache Kafka Documentation: Kafka Connect – Sink Connectors

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Event stream processing is ideal for real-time and near-real-time scenarios. Kafka Streams and ksqlDB are commonly used in use cases requiring immediate reaction to data.

A → Correct: Fraud detection systems benefit from low-latency anomaly detection.

B → Correct: Real-time product recommendations based on user activity require continuous processing.

C → Incorrect: End-of-day processing is batch-oriented, not real-time.

D → Correct: Real-time alerting and log anomaly detection are classic streaming use cases.

E → Incorrect: Historical dashboards rely on batch aggregation and are not continuous processing.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 7, p. 210–215

Confluent Documentation: Use Cases for Kafka Streams and ksqlDB

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

When a broker is shut down gracefully:

It flushes data from memory to disk to avoid log recovery upon restart.

It also notifies the controller to reassign leadership of the partitions it leads, ensuring high availability.

From Kafka documentation:

“A graceful shutdown will first flush logs to disk and then hand over leadership of partitions to ensure minimal disruption.”

C → Incorrect: Leader election happens only when the controller detects broker loss; it’s not guaranteed on restart.

D → Incorrect: Partition rebalancing is not automatic on broker restart unless manually initiated.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 306

Apache Kafka Documentation: Graceful Shutdown Behavior

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

In Kafka, a Leader ID of -1 indicates that no broker is currently the leader for that partition. This typically happens when the only replica for the partition (broker 1 in this case) is offline or unavailable.

From Kafka documentation:

“If the leader for a partition is not available, the leader ID will be reported as -1.”

A → Correct: The broker hosting the sole replica is down.

B/C/D → Incorrect and unrelated to leader election behavior.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 191

Apache Kafka Documentation: Topic Description Output and Leader Election

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

The linger.ms property defines how long the producer will wait to fill up a batch before sending it. Combined with batch.size, it allows the producer to accumulate more messages, thus improving throughput.

From Kafka documentation:

“If batch.size is not yet reached, linger.ms causes the producer to wait for additional messages before sending the batch.”

A → send.buffer.bytes affects TCP socket size.

B → Correct: Improves batching by adding intentional delay.

C → Reduces bandwidth but not directly batching.

D → A timeout for message delivery, not related to batching.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 5, p. 162

Apache Kafka Documentation: Producer Config – linger.ms

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka quotas allow administrators to throttle producer and consumer throughput to avoid resource starvation. They are based on network and disk usage metrics, applied per client ID or user.

From Apache Kafka documentation:

“Quotas can be configured to control the rate at which data is produced or consumed to avoid one client from overwhelming the system.”

A → Correct: Prevents a single client from degrading cluster performance.

B → Incorrect: Kafka quotas are not for prioritization but fairness.

C → Incorrect: Quotas do not control connection limits.

D → Incorrect: Partition limits are managed via topic configs, not quotas.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 306–308

Apache Kafka Documentation: Quotas

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka supports multiple listeners, allowing you to configure different security settings for internal and external traffic. For example, one listener can use PLAINTEXT for internal replication traffic, and another can use SASL_SSL for external client traffic.

From Kafka documentation:

“Kafka allows configuration of multiple listeners to segregate internal and external traffic, each with its own security protocol.”

B → Correct: Enables secure and isolated communication channels.

A → Unnecessary and inefficient.

C → Invalid: A single listener supports only one protocol.

D → Not a Kafka-level configuration.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 305

Apache Kafka Documentation: Security Configuration – Multiple Listeners

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka architecture maintains exactly one active Controller at any given time, regardless of the number of brokers. The Controller is responsible for administrative tasks like partition leader election and topic creation. The remaining brokers are replicas, ready to take over if the Controller fails.

From Kafka documentation:

“At any given time, there is only one active controller in the Kafka cluster.”

Even in a cluster with 4 brokers, only 1 broker acts as the Controller.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 189

Apache Kafka Documentation: Controller Role Description

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

In Kafka, a partition is a fundamental unit of parallelism and storage. Each topic in Kafka consists of one or more partitions, which are ordered, immutable sequences of records. Importantly, partitions themselves are broken down into segments on the disk. According to the official Kafka documentation:

“A partition is made up of one or more segment files on disk. Each segment is a continuous sequence of messages and each segment file is named after the offset of the first message it contains.”(Apache Kafka Documentation, "Log Basics" section).

Each partition resides in its own directory under the log.dirs configuration on the broker. The documentation states:“The log for each topic partition is stored in its own directory under the log.dirs configuration.”

Given these official clarifications:

Option A is incorrectbecause a partition is not represented by a single segment; rather, it can have multiple segments (as log segments are created to manage file sizes and facilitate compaction or deletion).

Option B is correctas it accurately states that a partition consists of multiple segments.

Option C is correctas all segments for a partition reside in a single directory.

Option D is incorrectbecause partition size is determined by the sum of all its segments, not just the largest one.