CCAAK Confluent Certified Administrator for Apache Kafka Question and Answers

In Kafka, the Controller is responsible for managing partition leadership. When a broker that was leader for certain partitions goes down, the Controller immediately detects the failure and:

Triggers a new leader election among the in-sync replicas (ISRs) of those partitions.

Updates the partition metadata to reflect the new leaders and notifies the cluster.

Kafka documentation states:

“When a broker fails, the controller triggers a leader election for all partitions previously led by the failed broker.”

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 190–191

Apache Kafka Documentation: “Kafka Controller and Leader Election”

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Confluent Schema Registry supports the following schema types for use with Kafka:

Avro

Protobuf

JSON Schema

These schemas are officially supported for subject versioning, compatibility checks, and REST interface integration.

From Confluent documentation:

“The Confluent Schema Registry supports Avro, JSON Schema, and Protobuf formats.”

Incorrect Options:

gRPC is not supported as a schema format.

Thrift is not supported in Schema Registry.

Page Reference:

Confluent Kafka: The Definitive Guide, 1st Edition, Chapter 7, p. 208–210

Confluent Schema Registry Documentation: Overview Section (Schema Types)

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka Replicator does not preserve source cluster offsets. Offsets in the destination DR cluster are generated independently, and there is no guarantee they match those from the source cluster.

From Confluent Replicator documentation:

“Replicator does not guarantee preservation of message offsets between source and destination. Offsets in the destination cluster are newly assigned.”

C → Correct: Offsets may differ even for the same data.

A → Incorrect: Lag is not the issue if offsets inherently differ.

B → Misleading: Kafka does not overwrite committed messages.

D → Invalid: Kafka messages are immutable; no "update" happens.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 313

Confluent Replicator Documentation: “Offset Mapping and Limitations”

Kafka Connect allows parallelism via tasks. The setting tasks.max=1 limits the connector to a single task, meaning it can only process one table at a time. To increase throughput and reduce lag, the number of tasks should be increased, allowing parallel processing of multiple tables.

From Kafka documentation:

“A single connector can have multiple tasks to maximize parallelism. Increasing tasks.max allows the connector to process more data in parallel.”

A → Increasing Connect nodes won’t help unless more tasks are configured.

B → Correct: Enables parallelism for each table.

C → Unrelated to source connector lag.

D → Increasing replication factor doesn’t improve connector performance.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 8, p. 245–246

Apache Kafka Documentation: Kafka Connect Concepts – tasks.max

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka does not enforce a single compression format per topic or partition. Each producer can independently choose whether to compress its messages and what compression type to use (e.g., gzip, snappy, lz4). These compressed messages coexist with uncompressed ones in the same topic.

From Kafka documentation:

“Producers can individually configure compression settings. Kafka stores messages in the format they are received, so compressed and uncompressed messages can exist in the same partition.”

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 5, p. 164–165

Apache Kafka Documentation: Producer Config – compression.type

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Event stream processing is ideal for real-time and near-real-time scenarios. Kafka Streams and ksqlDB are commonly used in use cases requiring immediate reaction to data.

A → Correct: Fraud detection systems benefit from low-latency anomaly detection.

B → Correct: Real-time product recommendations based on user activity require continuous processing.

C → Incorrect: End-of-day processing is batch-oriented, not real-time.

D → Correct: Real-time alerting and log anomaly detection are classic streaming use cases.

E → Incorrect: Historical dashboards rely on batch aggregation and are not continuous processing.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 7, p. 210–215

Confluent Documentation: Use Cases for Kafka Streams and ksqlDB

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka supports multiple SASL mechanisms for authentication, including:

SASL/PLAIN – Username/password

SASL/GSSAPI – Kerberos-based

SASL/OAUTHBEARER – OAuth 2.0 token-based

From Apache Kafka documentation:

“Kafka supports the following SASL mechanisms: GSSAPI (Kerberos), PLAIN, SCRAM, OAUTHBEARER.”

B → SAML20 is not supported.

E → OTP is not a supported SASL mechanism.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 9, p. 280–284

Apache Kafka Documentation: Kafka SASL Authentication

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka performs an authorization check every time a client attempts to access a resource (topics, consumer groups, etc.), ensuring real-time enforcement of security policies.

From Kafka documentation:

“Kafka checks authorization for every operation, every time the resource is accessed.”

This behavior ensures that any changes to ACLs are applied immediately and consistently.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 9, p. 284

Apache Kafka Documentation: “Kafka Security - Authorization”

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

In Kafka, a Leader ID of -1 indicates that no broker is currently the leader for that partition. This typically happens when the only replica for the partition (broker 1 in this case) is offline or unavailable.

From Kafka documentation:

“If the leader for a partition is not available, the leader ID will be reported as -1.”

A → Correct: The broker hosting the sole replica is down.

B/C/D → Incorrect and unrelated to leader election behavior.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 191

Apache Kafka Documentation: Topic Description Output and Leader Election

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

To ensure that duplicate messages are not processed and no messages are skipped, ksqlDB’s persistent queries must be configured to provide exactly-once processing guarantees. This is achieved by setting the processing.guarantee property to exactly_once. This configuration ensures that messages are neither lost nor processed more than once in the event of failures or restarts.

As per the official Confluent documentation:

“ksqlDB persistent queries can be configured for either at-least-once or exactly-once processing semantics by setting the processing.guarantee configuration property.”

“When processing.guarantee is set to exactly_once, ksqlDB ensures that messages are processed only once, even in failure scenarios. This eliminates duplicates and guarantees strong message delivery semantics.”

Other options:

Option B and C (ksql.streams.auto.offset.reset) only control the starting offset for new consumers, and do not enforce exactly-once semantics.

Option D (ksql.fail.on.production.error) controls whether errors during message production should fail the query, and does not affect exactly-once processing.

Page Reference:

Confluent Kafka: The Definitive Guide, 1st Edition, Chapter 11 (Stream Processing with ksqlDB), p. 365.

Confluent Documentation, “ksqlDB Configuration Properties” (processing.guarantee).

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka relies on ZooKeeper heartbeats to track broker health. If the broker JVM is unresponsive due to long GC pauses, ZooKeeper won’t receive timely heartbeats and will mark the broker as dead.

From Kafka Documentation:

“If the garbage collection pause is too long, the broker will not send heartbeats to ZooKeeper and will be considered dead. Leadership and partition reassignments will then occur.”

B → Correct: Broker marked dead, causes partition leadership transfers.

A → Incorrect: Log cleaner thread is unrelated to JVM pauses.

C → Incorrect: Clients may be impacted, but this is not the first result.

D → Incorrect: This is a normal OS function, not caused by GC issues.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 305

Kafka Official Docs: "ZooKeeper Timeout and Broker Health"

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Let’s break it down step by step using official Kafka architecture principles:

Total partitions: 10

Each partition stores: 25 GB per day

Total data for the topic per day (no replication): 10 partitions × 25 GB = 250 GB

Replication factor: 3 → three copies of each partition across the brokers

Each partition is replicated across three brokers. Since the replication factor is three, each broker will have one full replica of one-third of the partitions. In a balanced cluster with three brokers:

Each broker stores a replica of every partition (since replication factor = number of brokers).

So, each broker will store the full 250 GB of data for that topic.

Hence:

Each broker will consume: 250 GB

This is confirmed in the official Apache Kafka documentation:

“A replica is a fully-qualified copy of a partition. When the replication factor equals the number of brokers, each broker contains a full copy of the topic data.”

“Each broker stores the total size of data for the topic, regardless of which partitions it leads.”

Page Reference:

Confluent Kafka: The Definitive Guide, 1st Edition, Chapter 6 (Kafka Cluster), p. 209–210.

Apache Kafka Documentation, “Replication” and “Storage” sections.

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

The Kafka REST Proxy, provided as part of Confluent Platform, allows clients to interact with Kafka over REST APIs. When securing communication between REST Proxy and REST clients, it uses TLS (HTTPS).

As per the official Confluent documentation for REST Proxy security:

“The REST Proxy supports HTTPS to encrypt communication between REST clients and the REST Proxy.”

TLS/SSL encryption ensures that data in transit is secure and private.

Other options listed, such as MD5 (a hashing algorithm), SCRAM (an authentication mechanism), and Kerberos (an authentication protocol), do not provide direct encryption of the communication channel itself for REST Proxy. They can be part of broader security configurations (e.g., SCRAM for Kafka brokers, Kerberos for SASL authentication), butTLS (HTTPS)is the explicit mechanism for encrypting data between the REST Proxy and its clients.

Page Reference:

Confluent Kafka: The Definitive Guide, 1st Edition, Chapter 9 (“Kafka Security”), Section “REST Proxy Security” (p. 288–289).

Confluent Platform REST Proxy Documentation, “Encryption (HTTPS)”.