Confluent Confluent Certified Administrator for Apache Kafka CCAAK Exam Dumps: Updated Questions & Answers (September 2025)

The Kafka REST Proxy, provided as part of Confluent Platform, allows clients to interact with Kafka over REST APIs. When securing communication between REST Proxy and REST clients, it uses TLS (HTTPS).

As per the official Confluent documentation for REST Proxy security:

“The REST Proxy supports HTTPS to encrypt communication between REST clients and the REST Proxy.”

TLS/SSL encryption ensures that data in transit is secure and private.

Other options listed, such as MD5 (a hashing algorithm), SCRAM (an authentication mechanism), and Kerberos (an authentication protocol), do not provide direct encryption of the communication channel itself for REST Proxy. They can be part of broader security configurations (e.g., SCRAM for Kafka brokers, Kerberos for SASL authentication), butTLS (HTTPS)is the explicit mechanism for encrypting data between the REST Proxy and its clients.

Page Reference:

Confluent Kafka: The Definitive Guide, 1st Edition, Chapter 9 (“Kafka Security”), Section “REST Proxy Security” (p. 288–289).

Confluent Platform REST Proxy Documentation, “Encryption (HTTPS)”.

Kafka does not enforce a single compression format per topic or partition. Each producer can independently choose whether to compress its messages and what compression type to use (e.g., gzip, snappy, lz4). These compressed messages coexist with uncompressed ones in the same topic.

From Kafka documentation:

“Producers can individually configure compression settings. Kafka stores messages in the format they are received, so compressed and uncompressed messages can exist in the same partition.”

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 5, p. 164–165

Apache Kafka Documentation: Producer Config – compression.type

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka supports multiple listeners, allowing you to configure different security settings for internal and external traffic. For example, one listener can use PLAINTEXT for internal replication traffic, and another can use SASL_SSL for external client traffic.

From Kafka documentation:

“Kafka allows configuration of multiple listeners to segregate internal and external traffic, each with its own security protocol.”

B → Correct: Enables secure and isolated communication channels.

A → Unnecessary and inefficient.

C → Invalid: A single listener supports only one protocol.

D → Not a Kafka-level configuration.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 305

Apache Kafka Documentation: Security Configuration – Multiple Listeners

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

A message (also referred to as a record or event) is the smallest unit of data in Kafka. Each message consists of a key, value, timestamp, and metadata. Messages are stored in partitions and are identified by their offsets.

From Kafka documentation:

“The atomic unit of data in Kafka is a message, which includes a key, value, and headers.”

A → Logical grouping of messages.

B → Correct: Base-level data structure.

C → A topic holds partitions, not messages directly.

D → Refers to the position of a message, not the message itself.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 4, p. 120

Apache Kafka Documentation: Message Structure

Apache Kafka's built-in ACL mechanism (SimpleAclAuthorizer) stores ACL data in ZooKeeper. ACLs are propagated to brokers from ZooKeeper and cached in memory for fast lookup.

From Kafka documentation:

“ACLs are stored in ZooKeeper under /kafka-acl and are loaded into each broker at startup and on updates.”

B → Correct: ZooKeeper stores ACLs centrally.

A → Brokers load ACLs but don’t persist them.

C & D → Do not store or manage ACLs.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 9, p. 285

Apache Kafka Documentation: Authorizer Configuration

Kafka Connect is a framework for connecting Kafka with external systems like databases, key-value stores, file systems, etc. It handles ingestion and egress of data using scalable and fault-tolerant connectors.

From Kafka documentation:

“Kafka Connect is a scalable and fault-tolerant component for efficiently streaming data between Kafka and other systems.”

A → Correct: Purpose-built for data integration.

B → For stream processing, not integration.

C → Manages schemas, not data movement.

D → For HTTP-based Kafka interaction.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 8, p. 239–241

Apache Kafka Documentation: Kafka Connect Overview

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

In Kafka, a partition is a fundamental unit of parallelism and storage. Each topic in Kafka consists of one or more partitions, which are ordered, immutable sequences of records. Importantly, partitions themselves are broken down into segments on the disk. According to the official Kafka documentation:

“A partition is made up of one or more segment files on disk. Each segment is a continuous sequence of messages and each segment file is named after the offset of the first message it contains.”(Apache Kafka Documentation, "Log Basics" section).

Each partition resides in its own directory under the log.dirs configuration on the broker. The documentation states:“The log for each topic partition is stored in its own directory under the log.dirs configuration.”

Given these official clarifications:

Option A is incorrectbecause a partition is not represented by a single segment; rather, it can have multiple segments (as log segments are created to manage file sizes and facilitate compaction or deletion).

Option B is correctas it accurately states that a partition consists of multiple segments.

Option C is correctas all segments for a partition reside in a single directory.

Option D is incorrectbecause partition size is determined by the sum of all its segments, not just the largest one.

With min.insync.replicas=3 and acks=all, a partition must have at least 3 in-sync replicas (ISRs) for the producer to succeed. With one broker down (broker 0), only 2 ISRs remain → not enough to meet the requirement. Therefore, producers cannot write to affected partitions.

However, for some partitions where the leader and replicas are on brokers 1 and 2, the full ISR (3) may still be present (if broker 0 was not a replica). In this scenario, exactly 6 of the 9 partitions may still have ISR=3 depending on replica distribution.

From Kafka documentation:

“When acks=all and min.insync.replicas is not met, the broker will reject the produce request with an exception.”

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 5, p. 159–161

Apache Kafka Documentation: Topic Config – min.insync.replicas

By default, Kafka does not enable any security mechanism. This means:

Communication is done over PLAINTEXT (unencrypted).

No authentication is configured.

No authorization is enforced.

From Apache Kafka documentation:

“By default, Kafka has no security. All network communication is done in plaintext, and there is no client authentication or authorization.”

This means that:

Option A is correct.

Option B is incorrect because encryption is not enabled by default.

Option C is incorrect because authentication is not provided unless SASL is configured.

Option D is incorrect as neither encryption nor authentication is enabled by default.

Page Reference:

Confluent Kafka: The Definitive Guide, 1st Edition, Chapter 9, p. 275

Apache Kafka Documentation: “Security Overview” section

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾

Kafka Replicator does not preserve source cluster offsets. Offsets in the destination DR cluster are generated independently, and there is no guarantee they match those from the source cluster.

From Confluent Replicator documentation:

“Replicator does not guarantee preservation of message offsets between source and destination. Offsets in the destination cluster are newly assigned.”

C → Correct: Offsets may differ even for the same data.

A → Incorrect: Lag is not the issue if offsets inherently differ.

B → Misleading: Kafka does not overwrite committed messages.

D → Invalid: Kafka messages are immutable; no "update" happens.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 313

Confluent Replicator Documentation: “Offset Mapping and Limitations”