Kafka Security & Configuration Flashcards

Which protocol is used for encrypting data in transit between Kafka clients and brokers?

Answer: TLS (Transport Layer Security)

TLS (formerly SSL) encrypts the network traffic between Kafka clients and brokers, preventing eavesdropping and man-in-the-middle attacks.

What does SASL/PLAIN authentication in Kafka use for credentials?

Answer: Username and password sent over the wire (should be used with TLS)

SASL/PLAIN authenticates clients using a username and password; it transmits credentials in cleartext, so it must be combined with TLS for security.

What Kafka configuration property specifies the security protocol for a listener?

Answer: listener.security.protocol.map

listener.security.protocol.map maps each named listener to its security protocol (PLAINTEXT, SSL, SASL_PLAINTEXT, or SASL_SSL).

What is the purpose of ACLs in Kafka?

Answer: Define which principals (users/clients) are authorized to perform specific operations on resources

Kafka ACLs (Access Control Lists) specify which operations (Read, Write, Create, etc.) a given principal is allowed or denied on topics, consumer groups, and other resources.

Which CLI tool is used to manage Kafka ACLs?

Answer: kafka-acls.sh

kafka-acls.sh is the built-in tool for adding, listing, and removing ACL entries in a Kafka cluster.

What does SASL/OAUTHBEARER allow in Kafka authentication?

Answer: Clients authenticate using OAuth 2.0 bearer tokens obtained from an external authorization server

SASL/OAUTHBEARER enables Kafka clients to authenticate using short-lived OAuth 2.0 tokens, integrating with modern identity providers.