Encryption at rest in Kafka - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Kafka configuration snippet?

Given the following Kafka broker configuration snippet for encryption at rest, what will be the value of log.dirs after parsing?

Kafka

log.dirs=/var/lib/kafka/data,/mnt/kafka/storage
log.dirs=/var/lib/kafka/data

A /var/lib/kafka/data

B /mnt/kafka/storage

C null

D /var/lib/kafka/data,/mnt/kafka/storage

💡 Hint

Later configuration lines override earlier ones in Kafka properties files.

In Kafka configuration files, if a property is defined multiple times, the last definition takes precedence. Here, log.dirs is first set to two directories, then overridden by a single directory.

🧠 Conceptual

intermediate

Which Kafka feature directly supports encryption at rest?

Which Kafka feature is designed to encrypt data stored on disk to ensure encryption at rest?

A Broker-side disk encryption using the <code>log.dirs</code> encrypted filesystem

B SSL encryption for client-broker communication

C SASL authentication

D Kafka Streams API

💡 Hint

Encryption at rest means data is encrypted when stored on disk, not during transmission.

Kafka does not natively encrypt data at rest but supports using encrypted filesystems for log.dirs. SSL and SASL secure data in transit or authenticate clients, not encrypt data on disk.

🔧 Debug

advanced

Why does this Kafka broker fail to start with encryption at rest enabled?

A Kafka broker is configured to use an encrypted filesystem for log.dirs. The broker fails to start with the error: java.io.IOException: Permission denied. What is the most likely cause?

A Kafka topic configuration is incorrect

B Kafka configuration file syntax error

C Kafka broker is missing SSL certificates

D Kafka broker user lacks read/write permissions on the encrypted <code>log.dirs</code> directory

💡 Hint

Permission denied errors usually relate to filesystem access rights.

When using encrypted filesystems for Kafka logs, the Kafka process must have proper permissions to read and write to the encrypted directories. Missing permissions cause startup failures.

📝 Syntax

advanced

Which Kafka configuration snippet correctly enables encryption at rest using a mounted encrypted volume?

Select the valid Kafka broker configuration snippet that points to an encrypted volume for storing logs.

A log.dirs: /mnt/encrypted_volume/kafka_logs

B log.dirs = /mnt/encrypted_volume/kafka_logs

C log.dirs=/mnt/encrypted_volume/kafka_logs

D log.dirs => /mnt/encrypted_volume/kafka_logs

💡 Hint

Kafka configuration files use key=value pairs without spaces around the equals sign.

Kafka configuration files require the format key=value without spaces around the equals sign. Options A, B, and D use invalid syntax.

🚀 Application

expert

How to verify Kafka data is encrypted at rest on a Linux system?

You have configured Kafka to store logs on an encrypted filesystem. Which command sequence best verifies that the Kafka log directory is encrypted at rest?

A openssl enc -d -aes-256-cbc -in /mnt/encrypted_volume/kafka_logs

B mount | grep kafka_logs && lsattr /mnt/encrypted_volume/kafka_logs

C cat /etc/kafka/server.properties | grep log.dirs

D kafka-topics.sh --describe --topic test

💡 Hint

Check the mounted filesystem type and attributes of the directory.

The mount command shows if the directory is on an encrypted filesystem (e.g., LUKS). lsattr shows filesystem attributes. Other options check Kafka configs or topics but do not verify encryption at rest.