Confluent Certified Administrator for Apache Kafka (CCAAK) Exam Questions

Domain 1: Apache Kafka Fundamentals (15%)

In a Kafka 4.x cluster, which component stores the cluster metadata (topics, partitions, configurations and ACLs)?

⬜ A ZooKeeper ensemble that runs next to the brokers
⬜ The KRaft controller quorum, in the replicated __cluster_metadata log
⬜ The __consumer_offsets topic
⬜ Each broker’s server.properties file

A cluster runs Kafka 3.6 in ZooKeeper mode. The team wants to upgrade to Kafka 4.1. What must happen first?

⬜ Upgrade straight to 4.1; the brokers migrate the metadata on first start.
⬜ Migrate the cluster from ZooKeeper to KRaft on a 3.x release (3.9 is the bridge release), then upgrade to 4.x.
⬜ Copy the ZooKeeper data directory into each broker’s log.dirs.
⬜ Run 4.1 controllers against the existing ZooKeeper ensemble.

What does the process.roles setting control on a KRaft node?

⬜ Which topics the node may host
⬜ Whether the node acts as a broker, a controller, or both
⬜ Whether the node accepts SSL or plaintext connections
⬜ The node’s rack for replica placement

Which statements about a partition’s in-sync replica set (ISR) are true? (select two)

⬜ The leader is always a member of the ISR.
⬜ A follower stays in the ISR as long as its broker process is running.
⬜ A follower is removed from the ISR if it hasn’t caught up with the leader within replica.lag.time.max.ms.
⬜ The ISR always contains every replica of the partition.

What is the high watermark of a partition?

⬜ The largest offset the leader has written to its log
⬜ The offset up to which records are replicated to all in-sync replicas, and therefore visible to consumers
⬜ The maximum number of records a partition can hold
⬜ The offset of the oldest record still kept by retention

Which internal topic stores the offsets committed by consumer groups?

⬜ __cluster_metadata
⬜ __consumer_offsets
⬜ __transaction_state
⬜ _schemas

A topic uses cleanup.policy=delete. When can the broker delete a log segment?

⬜ As soon as each record is older than retention.ms
⬜ Once the segment is closed (rolled) and either its newest record is older than retention.ms or the partition is over retention.bytes
⬜ Only when the disk is full
⬜ Only after every consumer group has read it

Which topic setting keeps both time-based deletion and log compaction?

⬜ cleanup.policy=compact
⬜ cleanup.policy=delete
⬜ cleanup.policy=compact,delete
⬜ cleanup.policy=none

A producer uses the default settings of a Kafka 4.x client. Which delivery behavior does it get?

⬜ At-most-once, because acks=1 is the default
⬜ Idempotent writes with acks=all, because idempotence is enabled by default
⬜ Exactly-once across topics, because transactions are on by default
⬜ No retries, because retries=0 is the default

Which broker handles a consumer group’s join, heartbeat and offset-commit requests?

⬜ The active controller
⬜ The group coordinator: the leader of the __consumer_offsets partition that the group ID hashes to
⬜ Whichever broker the consumer connected to first
⬜ The leader of the topic partition being consumed

Kafka guarantees record ordering at which level?

⬜ Across all partitions of a topic
⬜ Within a single partition
⬜ Across all topics written by one producer
⬜ Within a consumer group, across partitions

Which statements about Kafka’s storage model are true? (select two)

⬜ Records are appended to a partition’s log; they can’t be modified in place.
⬜ Brokers delete a record as soon as all consumer groups have read it.
⬜ Brokers rely on the operating system’s page cache instead of a large in-JVM cache.
⬜ Each record is stored once per consumer group.

Which statement describes the controller in a KRaft cluster?

⬜ Every broker is a controller, and they take turns.
⬜ The controller is the broker that hosts the most partition leaders.
⬜ One controller in the quorum is the active controller (the Raft leader); the others are hot standbys.
⬜ There is one controller per topic.

What does a consumer’s committed offset for a partition mean?

⬜ The offset of the last record the consumer read
⬜ The offset of the next record the group should read after a restart or rebalance
⬜ The high watermark at the time of the commit
⬜ The offset where retention will start deleting

A topic has 6 partitions and replication factor 3 on a 6-broker cluster. How many partition replicas exist in total?

⬜ 6
⬜ 9
⬜ 18
⬜ 36

What happens to the existing data in a topic when you increase its number of partitions?

⬜ It stays in the original partitions; only new records can go to the new partitions.
⬜ It is spread evenly across all partitions.
⬜ It is deleted and the topic starts empty.
⬜ It is copied to every new partition.

Which Confluent Platform component provides a REST API to produce and consume records over HTTP?

⬜ Schema Registry
⬜ REST Proxy
⬜ Kafka Connect
⬜ ksqlDB

Which statements about consumer groups are true? (select two)

⬜ Each partition is read by at most one consumer in a group.
⬜ Each consumer in a group reads every partition.
⬜ Different groups read the same topic independently, each with its own offsets.
⬜ A group can have at most as many consumers as there are brokers.

---

Domain 2: Apache Kafka Security (15%)

Clients must authenticate with a username and password, and all traffic must be encrypted. Which security protocol should the client listener use?

⬜ PLAINTEXT
⬜ SSL
⬜ SASL_PLAINTEXT
⬜ SASL_SSL

Which SASL mechanisms are supported by Apache Kafka brokers? (select three)

⬜ SCRAM-SHA-512
⬜ GSSAPI (Kerberos)
⬜ OAUTHBEARER
⬜ SAML
⬜ LDAP-BIND

How do you create SCRAM credentials for user alice on a running KRaft cluster?

⬜ Add alice to a JAAS file on every broker and restart them
⬜ kafka-configs.sh --bootstrap-server broker:9092 --alter --add-config 'SCRAM-SHA-256=[password=alice-secret]' --entity-type users --entity-name alice
⬜ kafka-acls.sh --add --user alice --password alice-secret
⬜ Store the password in the topic __scram_users

Brokers should require every client to present a valid TLS certificate (mutual TLS). Which broker setting enables this on an SSL listener?

⬜ ssl.endpoint.identification.algorithm=https
⬜ ssl.client.auth=required
⬜ security.inter.broker.protocol=SSL
⬜ ssl.enabled.protocols=TLSv1.3

Which authorizer class do you configure on a KRaft cluster to enable ACLs?

⬜ kafka.security.authorizer.AclAuthorizer
⬜ org.apache.kafka.metadata.authorizer.StandardAuthorizer
⬜ org.apache.kafka.common.security.ZkAuthorizer
⬜ No class is needed; ACLs are always on

An authorizer is configured, and a topic has no ACLs at all. allow.everyone.if.no.acl.found is left at its default. What happens when a normal user tries to read the topic?

⬜ Access is allowed because no ACL forbids it.
⬜ Access is denied.
⬜ Access is allowed only for consumers in the default group.
⬜ The broker creates an allow ACL automatically.

User bob runs a consumer in group billing that reads topic invoices. Which ACLs does he need? (select two)

⬜ Read on topic invoices
⬜ Read on group billing
⬜ Write on topic invoices
⬜ Alter on the cluster

An ALLOW ACL and a DENY ACL both match the same principal, operation and resource. What is the result?

⬜ The ALLOW ACL wins.
⬜ The DENY ACL wins.
⬜ The most recently created ACL wins.
⬜ The request is allowed only for super users of that topic.

Which kafka-acls.sh option adds the ACLs a producer usually needs (Write, Describe and Create) on a topic in one step?

⬜ --consumer
⬜ --producer
⬜ --operation All
⬜ --cluster

Brokers authenticate clients with TLS certificates. ACLs are written for principals like User:orders-app, but the broker sees User:CN=orders-app,OU=Payments,O=Acme. How do you map the certificate to the short name?

⬜ Rename the topic to match the distinguished name
⬜ Set ssl.principal.mapping.rules on the brokers, for example RULE:^CN=([^,]+),.*$/$1/,DEFAULT
⬜ Set sasl.kerberos.principal.to.local.rules
⬜ Set client.id=orders-app on the client

What does the broker setting super.users=User:admin;User:ops do?

⬜ Gives these users higher produce quotas
⬜ Lets these principals bypass all ACL checks
⬜ Makes these users the only ones allowed to connect
⬜ Creates the users with default passwords

Which data protection does Apache Kafka provide out of the box?

⬜ Encryption in transit with TLS
⬜ Transparent encryption of log segments on disk
⬜ Field-level encryption of record values
⬜ Automatic masking of sensitive fields

A broker has listeners=INTERNAL://:9092,EXTERNAL://:9093. How does it know which security protocol each listener uses?

⬜ From listener.security.protocol.map, for example INTERNAL:SSL,EXTERNAL:SASL_SSL
⬜ From the port number: 9092 is always PLAINTEXT and 9093 always SSL
⬜ From security.protocol in each client’s configuration
⬜ From advertised.listeners

A Java client connects over TLS and fails with No subject alternative names matching IP address. The broker certificate was issued for kafka1.acme.local, but the client uses the broker’s IP address. What is the correct fix?

⬜ Set ssl.endpoint.identification.algorithm= (empty) on all clients
⬜ Connect with the hostname that is in the certificate, or reissue the certificate with the right SAN entries
⬜ Set ssl.client.auth=none on the broker
⬜ Switch the listener to PLAINTEXT

Where does a Java client put its SASL login settings (login module, username and password) without a separate JAAS file?

⬜ In sasl.mechanism
⬜ In sasl.jaas.config
⬜ In security.protocol
⬜ In ssl.keystore.password

Which statement about SASL/PLAIN is true?

⬜ It encrypts the password before sending it.
⬜ It sends the username and password in clear text, so it should be used only with TLS (SASL_SSL).
⬜ It requires a Kerberos KDC.
⬜ It can’t be used in production.

How do you list all ACLs that apply to the topic payments?

⬜ kafka-acls.sh --bootstrap-server broker:9092 --list --topic payments
⬜ kafka-topics.sh --bootstrap-server broker:9092 --describe --topic payments --acls
⬜ kafka-configs.sh --bootstrap-server broker:9092 --describe --entity-type topics --entity-name payments
⬜ kafka-acls.sh --zookeeper zk:2181 --list --topic payments

You want one ACL that lets User:etl write to every topic whose name starts with raw.. How?

⬜ Create a topic named raw.* and give etl Write on it
⬜ Add the ACL with --resource-pattern-type prefixed --topic raw.
⬜ Give etl Write on the cluster resource
⬜ Add etl to super.users

---

Domain 3: Deployment Architecture (12%)

How many KRaft controllers are typically recommended for a production cluster that must survive one controller failure?

⬜ 1
⬜ 2
⬜ 3
⬜ 4

Why is combined mode (process.roles=broker,controller) not recommended for critical production clusters?

⬜ Combined nodes can’t store data.
⬜ Controllers can’t be isolated from broker load, and they can’t be scaled or restarted separately from the brokers.
⬜ Combined mode doesn’t support TLS.
⬜ Combined mode allows only one partition per topic.

Which command prepares the storage directories of a new KRaft node before its first start?

⬜ kafka-topics.sh --create --topic __cluster_metadata
⬜ kafka-storage.sh format -t <cluster-id> -c server.properties
⬜ kafka-configs.sh --alter --entity-type brokers
⬜ kafka-server-start.sh --init

Brokers run in a private network, and clients connect from outside through a load balancer address kafka.acme.com. Clients reach the bootstrap address but then fail to connect. What is the usual cause?

⬜ The topic has too few partitions.
⬜ The brokers’ advertised.listeners return internal hostnames that external clients can’t resolve or reach.
⬜ The clients use the wrong serializer.
⬜ auto.create.topics.enable is false.

Which operating-system settings are recommended for Kafka brokers? (select two)

⬜ Raise the open-file limit (for example to 100,000 or more)
⬜ Give the JVM as much heap as possible, for example 75% of RAM
⬜ Keep vm.swappiness very low (for example 1)
⬜ Disable the page cache

Which Java version do Kafka 4.x brokers require?

⬜ Java 8
⬜ Java 11
⬜ Java 17 or later
⬜ Any Java version from 8 onwards

A broker has several data disks. How do you let it use all of them for partitions?

⬜ RAID 0 is required; Kafka can only use one directory.
⬜ List them in log.dirs, comma-separated (JBOD)
⬜ Create one broker per disk on the same node.id
⬜ Set num.partitions to the number of disks

You run a cluster across three availability zones. How do you make sure each partition’s replicas are spread across the zones?

⬜ Create one topic per zone
⬜ Set broker.rack on every broker to its zone
⬜ Set client.rack on producers
⬜ Set replication.factor to the number of zones on each broker

Consumers in each availability zone should read from a replica in their own zone to cut cross-zone traffic costs. What do you configure? (select two)

⬜ On brokers: replica.selector.class=org.apache.kafka.common.replica.RackAwareReplicaSelector
⬜ On consumers: client.rack set to the consumer’s zone
⬜ On producers: acks=0
⬜ On topics: min.insync.replicas=1

A company needs a disaster-recovery copy of its topics in another region, about 100 ms away. What is the usual approach with Apache Kafka?

⬜ Stretch one cluster across both regions with synchronous replication
⬜ Run a separate cluster in each region and replicate topics with MirrorMaker 2
⬜ Point the second region’s consumers at the first region’s brokers
⬜ Raise replication.factor to 6

Tiered storage is enabled on the brokers. What does remote.storage.enable=true do on a topic?

⬜ Moves the whole topic to object storage immediately
⬜ Copies closed log segments to remote storage, while recent data stays on local disk for local.retention.ms/local.retention.bytes
⬜ Replicates the topic to another cluster
⬜ Disables replication on local disks

How do you perform a rolling restart of the brokers with no client impact?

⬜ Restart one broker at a time and wait until under-replicated partitions are back to 0 before the next
⬜ Stop all brokers, then start them all together
⬜ Restart the active controller first, then all brokers at once
⬜ Restart brokers in parallel in each rack

After every node of a KRaft cluster has been upgraded to new Kafka binaries, what final step enables the new metadata features?

⬜ Nothing; they’re enabled automatically on restart.
⬜ Upgrade the metadata.version feature with kafka-features.sh
⬜ Delete and recreate the __cluster_metadata log
⬜ Format the storage directories again

Which statement about running Kafka on Kubernetes is true?

⬜ Brokers can run as stateless Deployments because Kafka keeps no local data.
⬜ Brokers run as stateful workloads with persistent volumes, usually managed by an operator such as Confluent for Kubernetes or Strimzi.
⬜ Kafka can’t run on Kubernetes.
⬜ Each broker restart must use a new node.id.

---

Domain 4: Kafka Connect (12%)

Which statements about Kafka Connect distributed mode are true? (select two)

⬜ Workers with the same group.id form one Connect cluster and share connectors and tasks.
⬜ Each worker keeps connector configurations in a local file.
⬜ Connector configurations, offsets and status are stored in Kafka topics.
⬜ Distributed mode can’t be scaled beyond one worker.

Which requirements apply to the Connect config.storage.topic? (select two)

⬜ It must have exactly one partition.
⬜ It should be a compacted topic with a high replication factor (for example 3).
⬜ It must use cleanup.policy=delete.
⬜ It needs one partition per worker.

On which port does the Kafka Connect REST API listen by default?

⬜ 8081
⬜ 8082
⬜ 8083
⬜ 9092

Which REST call changes the configuration of an existing connector named jdbc-orders?

⬜ POST /connectors/jdbc-orders
⬜ PUT /connectors/jdbc-orders/config with the full new configuration
⬜ PATCH /connectors with the changed keys
⬜ DELETE /connectors/jdbc-orders and wait for it to restart

A connector’s status shows the connector RUNNING but one of its tasks FAILED. How do you restart only the failed parts?

⬜ Restart every worker in the Connect cluster
⬜ POST /connectors/{name}/restart?includeTasks=true&onlyFailed=true
⬜ Delete and recreate the connector topics
⬜ PUT /connectors/{name}/pause

A sink connector keeps failing on a few malformed records. You want it to skip them and keep them for later analysis. Which settings do you use? (select two)

⬜ errors.tolerance=all
⬜ errors.deadletterqueue.topic.name=dlq-orders
⬜ errors.tolerance=none
⬜ max.poll.records=1

How do you install a new connector plugin on Connect workers?

⬜ Upload the JAR to a Kafka topic
⬜ Put the plugin directory or JAR under a folder listed in plugin.path on every worker, then restart the workers
⬜ Add it to the brokers’ log.dirs
⬜ POST /connector-plugins with the JAR file

What decides how many tasks a connector actually runs?

⬜ Always exactly tasks.max
⬜ The connector splits its work into at most tasks.max tasks; it may create fewer
⬜ One task per worker
⬜ One task per broker

A Connect worker crashes. What happens to its connectors and tasks in distributed mode?

⬜ They stop until the worker comes back.
⬜ After a rebalance, they are reassigned to the remaining workers and resume from the stored offsets.
⬜ They are deleted from the configuration topic.
⬜ They restart on the brokers.

Which statement about Single Message Transforms (SMTs) is true?

⬜ They can join records from two topics.
⬜ They modify one record at a time, for example renaming a field or routing to a different topic, and can be chained.
⬜ They run on the brokers.
⬜ They are needed to convert data to Avro.

MirrorMaker 2 replicates topic orders from a cluster with alias us-east to another cluster, using the default replication policy. What is the topic called in the target cluster?

⬜ orders
⬜ us-east.orders
⬜ orders-mirror
⬜ mm2-orders

Which MirrorMaker 2 component translates and syncs consumer group offsets to the target cluster, so consumers can fail over?

⬜ MirrorSourceConnector
⬜ MirrorCheckpointConnector
⬜ MirrorHeartbeatConnector
⬜ FileStreamSinkConnector

An operator needs to stop a connector for maintenance without deleting it, and later start it again. Which REST calls fit? (select two)

⬜ PUT /connectors/{name}/pause
⬜ PUT /connectors/{name}/resume
⬜ DELETE /connectors/{name}/tasks
⬜ POST /connectors/{name}/offsets

Which settings in a Connect worker configuration decide how record keys and values are turned into bytes? (select two)

⬜ key.converter
⬜ value.converter
⬜ key.serializer
⬜ transforms

---

Domain 5: Apache Kafka Cluster Configuration (22%)

You change log.retention.hours for one broker with kafka-configs.sh --entity-type brokers --entity-name 2, and also set a cluster-wide default with --entity-default. server.properties on broker 2 has a third value. Which value does broker 2 use?

⬜ The per-broker dynamic value
⬜ The cluster-wide dynamic default
⬜ The value in server.properties
⬜ Kafka’s built-in default

How do you change retention.ms for an existing topic audit without restarting anything?

⬜ kafka-configs.sh --bootstrap-server broker:9092 --alter --entity-type topics --entity-name audit --add-config retention.ms=604800000
⬜ Edit log.retention.ms in every broker’s server.properties
⬜ kafka-topics.sh --alter --topic audit --retention 7d
⬜ Recreate the topic with the new setting

Which broker defaults apply to a new topic created without its own settings? (select two)

⬜ num.partitions (default 1)
⬜ default.replication.factor (default 1)
⬜ offsets.topic.replication.factor
⬜ min.insync.replicas (default 2)

What is the default size at which a broker rolls a new log segment?

⬜ 100 MB
⬜ 1 GiB (log.segment.bytes=1073741824)
⬜ 10 GiB
⬜ There is no size limit; segments roll only by time

A low-traffic topic has retention.ms of 1 day, but data stays on disk for several days. What is the most likely reason?

⬜ The log cleaner thread has died.
⬜ The active segment hasn’t rolled, and only closed segments are deleted; lower segment.ms for the topic.
⬜ min.insync.replicas is too high.
⬜ Consumers haven’t read the data yet.

Producers must send records up to 5 MB to topic images. Which settings must allow 5 MB? (select three)

⬜ Topic max.message.bytes (or broker message.max.bytes)
⬜ Producer max.request.size
⬜ Consumer max.partition.fetch.bytes and fetch.max.bytes, high enough to fetch a 5 MB batch
⬜ Broker num.network.threads
⬜ Topic segment.bytes set to 5 MB

Which settings protect committed consumer offsets against a broker failure? (select two)

⬜ offsets.topic.replication.factor=3
⬜ offsets.topic.num.partitions=1
⬜ Enough brokers that __consumer_offsets can be created with 3 replicas
⬜ offsets.retention.minutes=0

How do you move some partitions of topic orders from brokers 1, 2, 3 to brokers 4, 5, 6?

⬜ Change broker.rack and restart
⬜ Generate a plan with kafka-reassign-partitions.sh --generate, run it with --execute, then check it with --verify
⬜ kafka-topics.sh --alter --topic orders --brokers 4,5,6
⬜ Delete the topic on brokers 1–3; it is recreated on the others

A large partition reassignment is saturating the network and slowing producers. What limits its impact?

⬜ Lower num.partitions
⬜ Run the reassignment with --throttle <bytes/sec> (sets the leader/follower replication throttles)
⬜ Set unclean.leader.election.enable=true
⬜ Stop all consumers until it finishes

You add two new brokers to a cluster. What happens to existing partitions?

⬜ They are automatically spread to the new brokers.
⬜ Nothing; the new brokers get only partitions of newly created topics until you reassign existing ones.
⬜ Half the partitions move to the new brokers at the next restart.
⬜ The topics are rebuilt with more partitions.

How do you safely decommission broker 5 from a KRaft cluster? (select two)

⬜ First reassign all of its partition replicas to other brokers
⬜ Stop it; Kafka moves its replicas automatically
⬜ After shutting it down, unregister it with kafka-cluster.sh unregister --id 5
⬜ Delete its log directory while it’s running

After a rolling restart, broker 1 leads far more partitions than the others. How do you move leadership back to the preferred replicas right away?

⬜ kafka-leader-election.sh --bootstrap-server broker:9092 --election-type preferred --all-topic-partitions
⬜ kafka-reassign-partitions.sh --execute with the current assignment
⬜ Restart broker 1 again
⬜ Set unclean.leader.election.enable=true

All partitions of a topic are offline because every in-sync replica is gone; only an out-of-sync replica survives. The business accepts possible data loss to restore service now. What do you run?

⬜ kafka-leader-election.sh --election-type preferred
⬜ kafka-leader-election.sh --election-type unclean --topic <topic> --all-partitions (or enable unclean.leader.election.enable for the topic)
⬜ kafka-reassign-partitions.sh --verify
⬜ kafka-storage.sh format

How do you limit client reporting-app to 2 MB/s of consumption on each broker?

⬜ kafka-configs.sh --alter --add-config consumer_byte_rate=2097152 --entity-type clients --entity-name reporting-app
⬜ Set fetch.max.bytes=2097152 on the consumer
⬜ Set max.poll.records=2 on the consumer
⬜ Set num.io.threads=2 on the brokers

Which statement about the broker setting auto.create.topics.enable is true?

⬜ It applies only to topics created with kafka-topics.sh.
⬜ When true, a request for a missing topic creates it with the broker defaults; many production clusters set it to false.
⬜ It must be true for Kafka Streams to work.
⬜ It controls whether consumer groups are created automatically.

Can you lower the number of partitions of an existing topic from 12 to 6?

⬜ Yes, with kafka-topics.sh --alter --partitions 6
⬜ Yes, with kafka-configs.sh
⬜ No; you must create a new topic with 6 partitions and copy the data
⬜ Yes, by removing brokers

Which broker setting controls how long a follower can lag before it is removed from the ISR?

⬜ replica.fetch.wait.max.ms
⬜ replica.lag.time.max.ms (default 30 seconds)
⬜ session.timeout.ms
⬜ log.flush.interval.ms

Which broker thread pools handle client requests? (select two)

⬜ Network threads (num.network.threads), which read requests and send responses
⬜ I/O request handler threads (num.io.threads), which process requests, including disk I/O
⬜ Log cleaner threads (log.cleaner.threads)
⬜ Replica fetcher threads (num.replica.fetchers)

How does Kafka make data durable by default?

⬜ It calls fsync after every record.
⬜ It writes to the OS page cache and relies on replication across brokers; explicit flushes (log.flush.interval.messages, log.flush.interval.ms) are off by default.
⬜ It keeps every record in JVM memory until consumers read it.
⬜ It writes every record to two disks on the same broker.

A compacted topic must remove a deleted key’s tombstone 1 day after compaction. Which topic setting controls this?

⬜ retention.ms
⬜ delete.retention.ms
⬜ min.compaction.lag.ms
⬜ segment.ms

Producers write to a compacted topic, and consumers must always see every update for at least 1 hour before older values for a key can be compacted away. Which topic setting do you use?

⬜ delete.retention.ms=3600000
⬜ min.compaction.lag.ms=3600000
⬜ max.compaction.lag.ms=3600000
⬜ retention.ms=3600000

Which statements about min.insync.replicas are true? (select two)

⬜ It can be set on a topic or as a broker default.
⬜ It makes followers acknowledge reads.
⬜ It’s enforced only for producers using acks=all.
⬜ It sets how many replicas a topic is created with.

Which topic-level setting makes the broker store records with the time it received them instead of the producer’s timestamp?

⬜ message.timestamp.type=LogAppendTime
⬜ message.timestamp.type=CreateTime
⬜ log.roll.ms=0
⬜ segment.index.bytes

How do you check which configuration overrides are set on topic orders?

⬜ kafka-topics.sh --list --topic orders
⬜ kafka-configs.sh --bootstrap-server broker:9092 --describe --entity-type topics --entity-name orders
⬜ kafka-consumer-groups.sh --describe --topic orders
⬜ kafka-log-dirs.sh --describe --topic orders

You want to delete topic old-events. Which statement is true in Kafka 4.x?

⬜ Topic deletion is impossible once data has been written.
⬜ kafka-topics.sh --delete --topic old-events removes it, as long as delete.topic.enable is true (the default).
⬜ The topic must be emptied with retention first.
⬜ Deletion requires restarting every broker.

The consumers of a large group are restarted one by one during every deployment, and each restart triggers a full rebalance. Which client feature reduces these rebalances?

⬜ Use assign() with auto.offset.reset=earliest
⬜ Static group membership: give each consumer a unique, stable group.instance.id
⬜ Lower session.timeout.ms to 1 second
⬜ Increase num.partitions

---

Domain 6: Observability (10%)

Which broker metric should be 0 in a healthy cluster and is the first to check for replication problems?

⬜ BytesInPerSec
⬜ UnderReplicatedPartitions (kafka.server:type=ReplicaManager)
⬜ RequestsPerSec
⬜ LeaderCount

In a healthy KRaft cluster, what should the active controller count be when summed across all controllers?

⬜ 0
⬜ Exactly 1
⬜ One per broker
⬜ Equal to the number of controllers

Which metric counts partitions that have no active leader and so can’t be read or written?

⬜ UnderReplicatedPartitions
⬜ OfflinePartitionsCount
⬜ UnderMinIsrPartitionCount
⬜ IsrShrinksPerSec

RequestHandlerAvgIdlePercent on a broker has dropped to about 5%. What does that indicate?

⬜ The broker is mostly idle.
⬜ The I/O request handler threads are almost always busy, so the broker is close to saturation.
⬜ The network threads are idle.
⬜ The disk is full.

How are Kafka broker metrics usually collected into Prometheus and shown in Grafana?

⬜ Kafka pushes metrics to Prometheus natively
⬜ Brokers expose metrics over JMX, and a JMX exporter (for example the Prometheus JMX exporter Java agent) publishes them for Prometheus to scrape
⬜ Prometheus reads the __metrics topic
⬜ Grafana connects to port 9092

How do you enable remote JMX access when starting a broker with the standard scripts?

⬜ Set the JMX_PORT environment variable before running kafka-server-start.sh
⬜ Add jmx.enabled=true to server.properties
⬜ Start the broker with --jmx
⬜ JMX is always open on port 9999

Which metrics show replicas repeatedly leaving and rejoining the ISR (“ISR flapping”)? (select two)

⬜ IsrShrinksPerSec
⬜ IsrExpandsPerSec
⬜ MessagesInPerSec
⬜ ActiveControllerCount

Which metric shows how long produce requests take end to end on a broker, so you can see where time is spent?

⬜ kafka.network:type=RequestMetrics,name=TotalTimeMs,request=Produce
⬜ kafka.server:type=BrokerTopicMetrics,name=BytesOutPerSec
⬜ kafka.log:type=LogFlushStats,name=LogFlushRateAndTimeMs
⬜ kafka.controller:type=KafkaController,name=OfflinePartitionsCount

Which tool shows the status of the KRaft controller quorum, including the leader and how far each voter and observer lags behind?

⬜ kafka-topics.sh --describe --topic __cluster_metadata
⬜ kafka-metadata-quorum.sh --bootstrap-server broker:9092 describe --status (and --replication)
⬜ kafka-consumer-groups.sh --describe --all-groups
⬜ kafka-log-dirs.sh --describe

Which value tells you how far a consumer group is behind on a partition?

⬜ The log end offset minus the group’s committed offset (the lag)
⬜ The high watermark minus the log start offset
⬜ The number of consumers in the group
⬜ The partition’s replication factor

Which metric warns that acks=all producers on a partition will start failing even though the partition still has a leader?

⬜ OfflinePartitionsCount
⬜ UnderMinIsrPartitionCount
⬜ LeaderElectionRateAndTimeMs
⬜ BytesRejectedPerSec

Which per-broker metric helps you spot an uneven spread of partition leadership across brokers?

⬜ UnderReplicatedPartitions
⬜ LeaderCount (kafka.server:type=ReplicaManager)
⬜ ActiveControllerCount
⬜ NetworkProcessorAvgIdlePercent

---

Domain 7: Troubleshooting (15%)

A consumer group must reprocess topic orders from the beginning. What do you do?

⬜ Run kafka-consumer-groups.sh --reset-offsets --to-earliest while the consumers are running
⬜ Stop all consumers in the group, then run kafka-consumer-groups.sh --bootstrap-server broker:9092 --group billing --topic orders --reset-offsets --to-earliest --execute
⬜ Delete the __consumer_offsets topic
⬜ Set auto.offset.reset=earliest on the running consumers

Producers using acks=all fail with NotEnoughReplicasException on one topic, while consumers still read it. What is the likely cause?

⬜ The topic has been deleted.
⬜ The partition’s ISR has fallen below the topic’s min.insync.replicas, for example because brokers are down or followers are lagging.
⬜ The producer’s max.request.size is too low.
⬜ Consumer lag is too high.

A broker stops with errors about a log directory after its disk filled up. What should you do?

⬜ Delete the oldest .log files by hand while the broker is running
⬜ Free or add disk space (or move partitions to other brokers), fix retention for the large topics, then restart the broker
⬜ Run kafka-storage.sh format on the broker
⬜ Set unclean.leader.election.enable=true cluster-wide

A broker log shows java.io.IOException: Too many open files. What is the usual fix?

⬜ Raise the operating system’s open-file limit (ulimit -n or the service’s LimitNOFILE) for the Kafka user
⬜ Lower num.partitions
⬜ Increase the JVM heap
⬜ Disable compression

Followers on one broker keep dropping out of the ISR, and its GC logs show pauses of several seconds. What helps most?

⬜ Increase the heap to 64 GB
⬜ Use a moderate heap (around 6 GB) with the G1 collector, and find what is creating memory pressure
⬜ Disable replication for the affected topics
⬜ Lower replica.lag.time.max.ms

A compacted topic keeps growing and old values for keys are never removed. The broker’s log-cleaner.log shows the cleaner thread stopped after an error. What do you check and do? (select two)

⬜ Check the cleaner metrics, such as time-since-last-run-ms and uncleanable-partitions-count, and the cleaner logs for the cause
⬜ Fix the cause (for example log.cleaner.dedupe.buffer.size too small for the segments, or a corrupt segment) and restart the broker so the cleaner starts again
⬜ Change the topic to cleanup.policy=delete
⬜ Increase retention.ms

You need to see the records and batch metadata inside a specific segment file on a broker. Which tool do you use?

⬜ kafka-console-consumer.sh --file
⬜ kafka-dump-log.sh --files 00000000000000000000.log --print-data-log
⬜ kafka-log-dirs.sh --describe
⬜ kafka-metadata-shell.sh

Which tool shows how much disk each partition replica uses on each broker and log directory?

⬜ kafka-topics.sh --describe
⬜ kafka-log-dirs.sh --bootstrap-server broker:9092 --describe
⬜ kafka-get-offsets.sh
⬜ kafka-configs.sh --describe

Consumer lag for a group grows steadily. The topic has 6 partitions and the group has 6 consumers, all busy. What can increase throughput?

⬜ Add more consumers to the group
⬜ Increase the topic’s partitions and then add consumers, or make each consumer process records faster
⬜ Restart the brokers
⬜ Lower fetch.min.bytes to 1

A consumer is repeatedly kicked out of its group and logs CommitFailedException because the group has already rebalanced. Processing each batch takes longer than 5 minutes. What fixes it? (select two)

⬜ Increase max.poll.interval.ms
⬜ Lower max.poll.records so each poll() batch is processed faster
⬜ Increase heartbeat.interval.ms
⬜ Set enable.auto.commit=true

Producers report TimeoutException: Expiring N records ... has passed since batch creation. What does it mean?

⬜ The topic doesn’t exist.
⬜ Records couldn’t be acknowledged within delivery.timeout.ms, for example because the leader was unreachable or the brokers were too slow.
⬜ The record was larger than max.request.size.
⬜ The consumer group timed out.

After a planned restart, one broker leads no partitions, and the others are overloaded. auto.leader.rebalance.enable was set to false. What restores the balance?

⬜ Restart the overloaded brokers
⬜ Run a preferred leader election with kafka-leader-election.sh --election-type preferred
⬜ Add partitions to all topics
⬜ Reassign every topic to the restarted broker

A new KRaft broker won’t start and logs that its cluster ID doesn’t match the controllers’ cluster ID. What went wrong?

⬜ The broker’s node.id is the same as a controller’s.
⬜ Its storage was formatted with a different cluster ID than the rest of the cluster.
⬜ Its log.dirs is on a different disk type.
⬜ auto.create.topics.enable differs from the other brokers.

A partition shows Leader: none in kafka-topics.sh --describe, and all its replicas were on two brokers that are both down. What is the safest way to restore it?

⬜ Bring at least one of those brokers back so an in-sync replica can become leader
⬜ Run an unclean leader election on another broker
⬜ Delete and recreate the topic
⬜ Reassign the partition to healthy brokers while the old ones are down

A client gets TOPIC_AUTHORIZATION_FAILED when producing to orders. Which steps diagnose it? (select two)

⬜ List the ACLs for the topic with kafka-acls.sh --list --topic orders
⬜ Confirm which principal the client authenticates as (for example the certificate DN or SASL username) and check the broker’s authorizer log
⬜ Increase the producer’s retries
⬜ Restart the controllers

A partition reassignment finished hours ago, but the moved replicas are still replicating slowly. What was most likely missed?

⬜ Running a preferred leader election
⬜ Running kafka-reassign-partitions.sh --verify, which removes the replication throttle
⬜ Restarting the consumers
⬜ Increasing num.partitions

Which tool shows the earliest or latest offsets of each partition of a topic?

⬜ kafka-consumer-groups.sh --list
⬜ kafka-get-offsets.sh --bootstrap-server broker:9092 --topic orders --time -1 (latest; -2 for earliest)
⬜ kafka-dump-log.sh --offsets
⬜ kafka-features.sh describe

After a few quiet minutes, clients’ first request often hangs until it times out. A firewall between clients and brokers silently drops TCP sessions that are idle for 5 minutes. What fixes it?

⬜ Raise connections.max.idle.ms to 1 hour on the brokers
⬜ Set the brokers’ connections.max.idle.ms (default 10 minutes) and the clients’ setting below the firewall’s idle timeout, so Kafka closes idle connections first
⬜ Disable TLS
⬜ Increase num.network.threads

---