Kafka Security & Configuration Flashcards

Which Kafka configuration enables SSL mutual authentication (mTLS)?

Answer: ssl.client.auth=required on the broker side

Setting ssl.client.auth=required forces the broker to request and validate a client certificate, enabling mutual TLS authentication.

What is the purpose of `zookeeper.connect` in a Kafka broker's server.properties?

Answer: Specifies the ZooKeeper ensemble address Kafka uses for cluster coordination (pre-KRaft)

zookeeper.connect tells the Kafka broker where to find its ZooKeeper ensemble for storing cluster metadata (not needed in KRaft mode).

What does `num.partitions` in server.properties control?

Answer: The default number of partitions for newly created topics when no partition count is specified

num.partitions sets the default partition count applied to new topics created via auto-creation or without an explicit --partitions flag.

What does the `advertised.listeners` broker configuration do?

Answer: Publishes the listener addresses that clients should use to connect to the broker

advertised.listeners tells Kafka what addresses to publish in cluster metadata so clients can reach the broker, critical in containerized or cloud environments.

Which Kafka tool applies dynamic broker configuration changes without a restart?

Answer: kafka-configs.sh --alter --entity-type brokers

kafka-configs.sh with --alter --entity-type brokers can update certain broker configs dynamically (e.g., log retention, quotas) without requiring a broker restart.

What does setting `ssl.endpoint.identification.algorithm=` (empty string) do on a Kafka client?

Answer: Disables hostname verification, allowing connections to brokers whose certificate doesn't match the hostname

An empty ssl.endpoint.identification.algorithm disables hostname verification, which is sometimes needed in development but reduces security by allowing certificate mismatches.