CCAAK Confluent Certified Administrator for Apache Kafka Free Practice Exam Questions (2025 Updated)

Apache Kafka's built-in ACL mechanism (SimpleAclAuthorizer) stores ACL data in ZooKeeper. ACLs are propagated to brokers from ZooKeeper and cached in memory for fast lookup.

From Kafka documentation:

“ACLs are stored in ZooKeeper under /kafka-acl and are loaded into each broker at startup and on updates.”

B → Correct: ZooKeeper stores ACLs centrally.

A → Brokers load ACLs but don’t persist them.

C & D → Do not store or manage ACLs.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 9, p. 285

Apache Kafka Documentation: Authorizer Configuration

Kafka quotas allow administrators to throttle producer and consumer throughput to avoid resource starvation. They are based on network and disk usage metrics, applied per client ID or user.

From Apache Kafka documentation:

“Quotas can be configured to control the rate at which data is produced or consumed to avoid one client from overwhelming the system.”

A → Correct: Prevents a single client from degrading cluster performance.

B → Incorrect: Kafka quotas are not for prioritization but fairness.

C → Incorrect: Quotas do not control connection limits.

D → Incorrect: Partition limits are managed via topic configs, not quotas.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 306–308

Apache Kafka Documentation: Quotas

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka supports multiple SASL mechanisms for authentication, including:

SASL/PLAIN – Username/password

SASL/GSSAPI – Kerberos-based

SASL/OAUTHBEARER – OAuth 2.0 token-based

From Apache Kafka documentation:

“Kafka supports the following SASL mechanisms: GSSAPI (Kerberos), PLAIN, SCRAM, OAUTHBEARER.”

B → SAML20 is not supported.

E → OTP is not a supported SASL mechanism.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 9, p. 280–284

Apache Kafka Documentation: Kafka SASL Authentication

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

When sizing a ksqlDB cluster, the following factors are crucial:

A. Data Schema: Complex schemas may require more CPU/memory for serialization/deserialization.

B. Number of Queries: Each persistent query consumes system resources (CPU, memory).

C. Number of Partitions: Determines parallelism and state store scalability.

From Confluent documentation:

“Cluster capacity planning depends on schema complexity, query concurrency, and partition count.”

D → Incorrect: Encryption impacts producer/broker, not ksqlDB sizing directly.

E → Incorrect: Retention is managed by Kafka, not ksqlDB.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 7, p. 225–229

Confluent ksqlDB Documentation: Capacity Planning Guidelines

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

In ksqlDB, INSERT VALUES is used to produce data directly into a topic that underlies a STREAM or TABLE. It is a DML command that appends new records into a Kafka topic.

From ksqlDB documentation:

“INSERT VALUES adds data into a stream or table. This data is persisted in the Kafka topic backing the stream or table.”

Option analysis:

A/B → SELECT queries retrieve data but do not write.

D → Defines a table, does not write data.

C → Correct: Actually writes (produces) data to Kafka.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 7, p. 227–229

Confluent Docs: ksqlDB INSERT INTO and INSERT VALUES Statements

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

In Kafka Connect, sink connectors consume data from Kafka topics and send it to external systems (e.g., databases, object storage, search indexes).

From Kafka documentation:

“Sink connectors receive data from Kafka topics and write it to external systems.”

A → Correct: Moves data out of Kafka.

B → Moves data into Kafka.

C → Not a connector type.

D → Not a standard connector classification.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 8, p. 241

Apache Kafka Documentation: Kafka Connect – Sink Connectors

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka Connect is a framework for connecting Kafka with external systems like databases, key-value stores, file systems, etc. It handles ingestion and egress of data using scalable and fault-tolerant connectors.

From Kafka documentation:

“Kafka Connect is a scalable and fault-tolerant component for efficiently streaming data between Kafka and other systems.”

A → Correct: Purpose-built for data integration.

B → For stream processing, not integration.

C → Manages schemas, not data movement.

D → For HTTP-based Kafka interaction.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 8, p. 239–241

Apache Kafka Documentation: Kafka Connect Overview

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

The kafka-consumer-groups.sh script is used to monitor consumer group offsets and lag. It shows the current offset, log end offset, and lag for each partition consumed by a consumer group.

From Kafka documentation:

“You can use kafka-consumer-groups.sh with the --describe flag to get the offset lag per consumer group.”

A → Incorrect: No such built-in script.

B → Correct: Official script for viewing consumer group lag.

C → Incorrect: Does not exist as a built-in Kafka tool.

D → Incorrect: Used for partition reassignment, unrelated to lag monitoring.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 308

Apache Kafka Documentation: kafka-consumer-groups.sh usage

Kafka Replicator does not preserve source cluster offsets. Offsets in the destination DR cluster are generated independently, and there is no guarantee they match those from the source cluster.

From Confluent Replicator documentation:

“Replicator does not guarantee preservation of message offsets between source and destination. Offsets in the destination cluster are newly assigned.”

C → Correct: Offsets may differ even for the same data.

A → Incorrect: Lag is not the issue if offsets inherently differ.

B → Misleading: Kafka does not overwrite committed messages.

D → Invalid: Kafka messages are immutable; no "update" happens.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 313

Confluent Replicator Documentation: “Offset Mapping and Limitations”

Kafka uses a pull model for consumers. The consumer polls the broker for available data. This contrasts with push models (used in traditional messaging systems), where the server pushes messages to consumers.

From Kafka documentation:

“Kafka’s consumers use a pull model, where the consumer requests messages from the broker at its own pace.”

A → Incorrect: Kafka does not push messages.

B → Incorrect: Kafka is a publish-subscribe system, but not the model used for message delivery to consumers.

C → Correct: Consumers explicitly pull messages.

D → Invalid in Kafka terminology.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 4, p. 126

Apache Kafka Documentation: Consumer Design Overview

The linger.ms property defines how long the producer will wait to fill up a batch before sending it. Combined with batch.size, it allows the producer to accumulate more messages, thus improving throughput.

From Kafka documentation:

“If batch.size is not yet reached, linger.ms causes the producer to wait for additional messages before sending the batch.”

A → send.buffer.bytes affects TCP socket size.

B → Correct: Improves batching by adding intentional delay.

C → Reduces bandwidth but not directly batching.

D → A timeout for message delivery, not related to batching.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 5, p. 162

Apache Kafka Documentation: Producer Config – linger.ms

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka follows a specific sequence for evaluating permissions:

If a user is listed as a Super User → Access granted.

Otherwise, Kafka checks if there's an explicit Allow ACL → Grants access.

If not allowed, it checks for an explicit Deny ACL → Denies access.

If no ACL matches → Denied by default.

From Apache Kafka documentation:

“The evaluation order is: Superuser → Allow ACL → Deny ACL → Default deny.”

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 9, p. 286

Apache Kafka Documentation: “Kafka Authorization – Evaluation Order”

Kafka relies on ZooKeeper heartbeats to track broker health. If the broker JVM is unresponsive due to long GC pauses, ZooKeeper won’t receive timely heartbeats and will mark the broker as dead.

From Kafka Documentation:

“If the garbage collection pause is too long, the broker will not send heartbeats to ZooKeeper and will be considered dead. Leadership and partition reassignments will then occur.”

B → Correct: Broker marked dead, causes partition leadership transfers.

A → Incorrect: Log cleaner thread is unrelated to JVM pauses.

C → Incorrect: Clients may be impacted, but this is not the first result.

D → Incorrect: This is a normal OS function, not caused by GC issues.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 305

Kafka Official Docs: "ZooKeeper Timeout and Broker Health"

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

To ensure that duplicate messages are not processed and no messages are skipped, ksqlDB’s persistent queries must be configured to provide exactly-once processing guarantees. This is achieved by setting the processing.guarantee property to exactly_once. This configuration ensures that messages are neither lost nor processed more than once in the event of failures or restarts.

As per the official Confluent documentation:

“ksqlDB persistent queries can be configured for either at-least-once or exactly-once processing semantics by setting the processing.guarantee configuration property.”

“When processing.guarantee is set to exactly_once, ksqlDB ensures that messages are processed only once, even in failure scenarios. This eliminates duplicates and guarantees strong message delivery semantics.”

Other options:

Option B and C (ksql.streams.auto.offset.reset) only control the starting offset for new consumers, and do not enforce exactly-once semantics.

Option D (ksql.fail.on.production.error) controls whether errors during message production should fail the query, and does not affect exactly-once processing.

Page Reference:

Confluent Kafka: The Definitive Guide, 1st Edition, Chapter 11 (Stream Processing with ksqlDB), p. 365.

Confluent Documentation, “ksqlDB Configuration Properties” (processing.guarantee).

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

In Kafka, a Leader ID of -1 indicates that no broker is currently the leader for that partition. This typically happens when the only replica for the partition (broker 1 in this case) is offline or unavailable.

From Kafka documentation:

“If the leader for a partition is not available, the leader ID will be reported as -1.”

A → Correct: The broker hosting the sole replica is down.

B/C/D → Incorrect and unrelated to leader election behavior.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 6, p. 191

Apache Kafka Documentation: Topic Description Output and Leader Election

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾