ACL-based authorization in Kafka - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Kafka ACL command?

Given the following Kafka ACL command, what will be the result when trying to produce to topic 'orders' as user 'alice'?

Kafka

kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 \
  --add --allow-principal User:alice --operation Write --topic orders

A The command will fail due to missing consumer permission.

B Alice will get a 'Not authorized' error when producing to 'orders'.

C Alice can produce messages to the 'orders' topic successfully.

D The ACL will allow Alice to consume but not produce to 'orders'.

💡 Hint

The command explicitly grants write permission to Alice on the 'orders' topic.

The command adds an ACL that allows user 'alice' to perform the Write operation on the 'orders' topic. This means Alice can produce messages to that topic.

❓ Predict Output

intermediate

What error occurs with this ACL command?

What error will this command produce when executed?

Kafka

kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 \
  --add --allow-principal User:bob --operation Read --topic

A Error: Missing topic name argument.

B Error: Invalid principal format.

C Error: Unknown operation 'Read'.

D No error, ACL added successfully.

💡 Hint

Check if all required arguments are provided.

The command is missing the topic name after --topic, so it will fail with a missing argument error.

🔧 Debug

advanced

Why does this ACL not allow user 'carol' to consume?

User 'carol' cannot consume from topic 'payments' despite this ACL. Identify the issue.

Kafka

kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 \
  --add --allow-principal User:carol --operation Write --topic payments

A The ACL only grants Write permission, not Read, so Carol cannot consume.

B The principal format 'User:carol' is incorrect.

C Zookeeper connection string is invalid.

D The topic name 'payments' is misspelled.

💡 Hint

Check the operation type granted by the ACL.

The ACL grants only Write permission, which allows producing messages. To consume, Read permission is required.

🧠 Conceptual

advanced

What is the effect of this ACL wildcard?

What does this ACL command do?

Kafka

kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 \
  --add --allow-principal User:dave --operation Read --topic '*'

A Allows user 'dave' to read only from a topic literally named '*'.

B Allows user 'dave' to read from all topics.

C Denies user 'dave' from reading any topic.

D Causes a syntax error due to invalid wildcard usage.

💡 Hint

The '*' wildcard matches all topics.

Using '*' as the topic name grants the permission on all topics in the cluster.

❓ Predict Output

expert

How many ACL entries exist after these commands?

After running these commands, how many ACL entries are present for user 'eve'?

Kafka

kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:eve --operation Read --topic logs
kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:eve --operation Write --topic logs
kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --remove --allow-principal User:eve --operation Read --topic logs

A Three ACL entries exist including the removed one.

B Two ACL entries remain: Read and Write permissions on 'logs'.

C No ACL entries remain for user 'eve'.

D One ACL entry remains: Write permission on 'logs' for user 'eve'.

💡 Hint

Removing an ACL deletes only the specified permission.

The Read permission ACL was removed, leaving only the Write permission ACL for user 'eve' on 'logs'.