Encryption at rest in Kafka - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Kafka configuration snippet?

Given the following Kafka broker configuration snippet for encryption at rest, what will be the value of log.dirs after parsing?

Kafka

log.dirs=/var/lib/kafka/data,/mnt/kafka/storage
log.dirs=/var/lib/kafka/data

A /var/lib/kafka/data

B /mnt/kafka/storage

C null

D /var/lib/kafka/data,/mnt/kafka/storage

💡 Hint

Later configuration lines override earlier ones in Kafka properties files.

In Kafka configuration files, if a property is defined multiple times, the last definition takes precedence. Here, log.dirs is first set to two directories, then overridden by a single directory.

🧠 Conceptual

intermediate

Which Kafka feature directly supports encryption at rest?

Which Kafka feature is designed to encrypt data stored on disk to ensure encryption at rest?

A Broker-side disk encryption using the <code>log.dirs</code> encrypted filesystem

B SSL encryption for client-broker communication

C SASL authentication

D Kafka Streams API

💡 Hint

Encryption at rest means data is encrypted when stored on disk, not during transmission.

Kafka does not natively encrypt data at rest but supports using encrypted filesystems for log.dirs. SSL and SASL secure data in transit or authenticate clients, not encrypt data on disk.

🔧 Debug

advanced

Why does this Kafka broker fail to start with encryption at rest enabled?

A Kafka broker is configured to use an encrypted filesystem for log.dirs. The broker fails to start with the error: java.io.IOException: Permission denied. What is the most likely cause?

A Kafka topic configuration is incorrect

B Kafka configuration file syntax error

C Kafka broker is missing SSL certificates

D Kafka broker user lacks read/write permissions on the encrypted <code>log.dirs</code> directory

💡 Hint

Permission denied errors usually relate to filesystem access rights.

When using encrypted filesystems for Kafka logs, the Kafka process must have proper permissions to read and write to the encrypted directories. Missing permissions cause startup failures.

📝 Syntax

advanced

Which Kafka configuration snippet correctly enables encryption at rest using a mounted encrypted volume?

Select the valid Kafka broker configuration snippet that points to an encrypted volume for storing logs.

A log.dirs: /mnt/encrypted_volume/kafka_logs

B log.dirs = /mnt/encrypted_volume/kafka_logs

C log.dirs=/mnt/encrypted_volume/kafka_logs

D log.dirs => /mnt/encrypted_volume/kafka_logs

💡 Hint

Kafka configuration files use key=value pairs without spaces around the equals sign.

Kafka configuration files require the format key=value without spaces around the equals sign. Options A, B, and D use invalid syntax.

🚀 Application

expert

How to verify Kafka data is encrypted at rest on a Linux system?

You have configured Kafka to store logs on an encrypted filesystem. Which command sequence best verifies that the Kafka log directory is encrypted at rest?

A openssl enc -d -aes-256-cbc -in /mnt/encrypted_volume/kafka_logs

B mount | grep kafka_logs && lsattr /mnt/encrypted_volume/kafka_logs

C cat /etc/kafka/server.properties | grep log.dirs

D kafka-topics.sh --describe --topic test

💡 Hint

Check the mounted filesystem type and attributes of the directory.

The mount command shows if the directory is on an encrypted filesystem (e.g., LUKS). lsattr shows filesystem attributes. Other options check Kafka configs or topics but do not verify encryption at rest.

Practice

1. What does encryption at rest mean in the context of Kafka?

easy

A. Encrypting data while it is being sent between Kafka brokers

B. Protecting stored Kafka data by making it unreadable without a key

C. Compressing Kafka messages to save disk space

D. Authenticating users before they access Kafka topics

Solution

1. Step 1: Understand encryption at rest

   Encryption at rest means data stored on disk is encrypted to prevent unauthorized reading.

2. Step 2: Differentiate from other security concepts

   Encryption in transit protects data moving between systems, not stored data.

3. Final Answer:

   Protecting stored Kafka data by making it unreadable without a key -> Option B

4. Quick Check:

   Encryption at rest = Protect stored data [OK]

Hint: Encryption at rest means stored data is unreadable without keys [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking compression is encryption
• Mixing authentication with encryption

2. Which of the following is the correct way to enable encryption at rest in Kafka?

easy

A. Use disk-level encryption or external tools since Kafka does not encrypt data on disk by default

B. Add encryption.at.rest=true in the Kafka topic configuration

C. Set ssl.enabled=true in the Kafka broker configuration

D. Configure kafka.security.encryption=true in the producer settings

Solution

1. Step 1: Check Kafka's default encryption behavior

   Kafka does not encrypt data on disk by default; it requires external disk encryption or tools.

2. Step 2: Review configuration options

   Options A, B, and D are not valid Kafka configurations for encryption at rest.

3. Final Answer:

   Use disk-level encryption or external tools since Kafka does not encrypt data on disk by default -> Option A

4. Quick Check:

   Kafka disk encryption = external tools [OK]

Hint: Kafka needs external disk encryption for data at rest [OK]

Common Mistakes:

• Assuming SSL enables encryption at rest
• Trying to set non-existent Kafka config keys
• Confusing topic or producer configs with disk encryption

3. Given the following Kafka broker configuration snippet, what is the effect on data security?

listeners=PLAINTEXT://:9092
ssl.enabled.protocols=TLSv1.2,TLSv1.3
ssl.keystore.location=/var/private/keystore.jks
ssl.keystore.password=changeit

medium

A. Data is encrypted both on disk and during transmission

B. Data is encrypted on disk but not during transmission

C. Data is encrypted during transmission but not on disk

D. No encryption is enabled

Solution

1. Step 1: Analyze the configuration

   The listeners are set to PLAINTEXT://:9092, which means connections are not encrypted (no SSL/TLS in transit). The SSL keystore settings are present but not activated for this listener.

2. Step 2: Confirm no encryption at rest

   There are no settings for disk encryption; data on disk is unencrypted.

3. Final Answer:

   Data is encrypted during transmission but not on disk -> Option C

4. Quick Check:

   PLAINTEXT listener + no disk encryption = no encryption at rest, but SSL settings indicate encryption possible if listener changed [OK]

Hint: PLAINTEXT listener means no encryption in transit or at rest [OK]

Common Mistakes:

• Assuming SSL encrypts data on disk
• Ignoring the PLAINTEXT listener setting
• Confusing keystore with disk encryption

4. You want to enable encryption at rest for Kafka data. You added the following to your broker config:

encryption.at.rest=true

But it does not work. What is the likely problem?

medium

A. You need to restart the Kafka producer, not the broker

B. The config key is case sensitive and should be Encryption.At.Rest

C. You must set ssl.enabled=true instead

D. Kafka does not support encryption.at.rest config; disk encryption must be external

Solution

1. Step 1: Verify Kafka config support

   Kafka does not have a built-in encryption.at.rest configuration option.

2. Step 2: Understand how to enable encryption at rest

   Encryption at rest requires external disk encryption tools or file system encryption.

3. Final Answer:

   Kafka does not support encryption.at.rest config; disk encryption must be external -> Option D

4. Quick Check:

   No native encryption at rest config in Kafka [OK]

Hint: Kafka needs external disk encryption, no native config key [OK]

Common Mistakes:

• Trying to use non-existent Kafka config keys
• Restarting wrong components
• Confusing SSL with encryption at rest

5. You want to ensure Kafka data is encrypted at rest on a Linux server. Which approach correctly applies encryption at rest while keeping Kafka running smoothly?

hard

A. Use Linux LUKS disk encryption on the Kafka data directory and configure Kafka normally

B. Enable SSL in Kafka broker config to encrypt data on disk

C. Set Kafka topic config encryption.enabled=true to encrypt data at rest

D. Use Kafka producer encryption settings to encrypt data before writing to disk

Solution

1. Step 1: Identify how to encrypt data at rest on Linux

   Linux LUKS provides full disk encryption, protecting Kafka data on disk transparently.

2. Step 2: Confirm Kafka compatibility

   Kafka works normally on encrypted disks without special config; SSL and topic configs do not encrypt at rest.

3. Final Answer:

   Use Linux LUKS disk encryption on the Kafka data directory and configure Kafka normally -> Option A

4. Quick Check:

   Disk encryption tool + normal Kafka = encryption at rest [OK]

Hint: Use OS-level disk encryption for Kafka data at rest [OK]

Common Mistakes:

• Thinking SSL encrypts data on disk
• Expecting Kafka topic configs to encrypt data at rest
• Trying to encrypt data only at producer level