Apache Kafka Kafka Security & Configuration 1 — Questions and Answers
Question 1: Which protocol is used for encrypting data in transit between Kafka clients and brokers?
- TLS (Transport Layer Security) (Correct answer)
- SSL v3
- IPSec
- SASL/GSSAPI alone
Correct answer: TLS (Transport Layer Security)
TLS (formerly SSL) encrypts the network traffic between Kafka clients and brokers, preventing eavesdropping and man-in-the-middle attacks.
Question 2: What does SASL/PLAIN authentication in Kafka use for credentials?
- Username and password sent over the wire (should be used with TLS) (Correct answer)
- Kerberos tickets
- OAuth tokens
- Client X.509 certificates
Correct answer: Username and password sent over the wire (should be used with TLS)
SASL/PLAIN authenticates clients using a username and password; it transmits credentials in cleartext, so it must be combined with TLS for security.
Question 3: What Kafka configuration property specifies the security protocol for a listener?
- listener.security.protocol.map (Correct answer)
- security.inter.broker.protocol
- ssl.keystore.location
- sasl.mechanism
Correct answer: listener.security.protocol.map
listener.security.protocol.map maps each named listener to its security protocol (PLAINTEXT, SSL, SASL_PLAINTEXT, or SASL_SSL).
Question 4: What is the purpose of ACLs in Kafka?
- Define which principals (users/clients) are authorized to perform specific operations on resources (Correct answer)
- Encrypt messages at rest
- Manage SSL certificate rotation
- Configure network firewall rules
Correct answer: Define which principals (users/clients) are authorized to perform specific operations on resources
Kafka ACLs (Access Control Lists) specify which operations (Read, Write, Create, etc.) a given principal is allowed or denied on topics, consumer groups, and other resources.
Question 5: Which CLI tool is used to manage Kafka ACLs?
- kafka-acls.sh (Correct answer)
- kafka-configs.sh
- kafka-topics.sh
- kafka-security-manager.sh
Correct answer: kafka-acls.sh
kafka-acls.sh is the built-in tool for adding, listing, and removing ACL entries in a Kafka cluster.
Question 6: What does SASL/OAUTHBEARER allow in Kafka authentication?
- Clients authenticate using OAuth 2.0 bearer tokens obtained from an external authorization server (Correct answer)
- Clients use Kerberos tickets from an Active Directory
- Clients authenticate with username/password stored in ZooKeeper
- Clients use mutual TLS certificates
Correct answer: Clients authenticate using OAuth 2.0 bearer tokens obtained from an external authorization server
SASL/OAUTHBEARER enables Kafka clients to authenticate using short-lived OAuth 2.0 tokens, integrating with modern identity providers.
Apache Kafka Kafka Security & Configuration 1
Which protocol is used for encrypting data in transit between Kafka clients and brokers?