Security best practices in Kafka - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Kafka ACL command?

Consider the following Kafka ACL command to allow a user to produce to a topic:

kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:Alice --operation Write --topic sales-data

What will be the result when Alice tries to produce messages to the topic sales-data?

Kafka

kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:Alice --operation Write --topic sales-data

A Alice can successfully produce messages to the topic sales-data.

B Alice will get a permission denied error when producing to sales-data.

C The command will fail due to missing consumer permission.

D Alice can only consume messages from sales-data, not produce.

💡 Hint

Think about what the --operation Write permission allows.

The command explicitly grants Alice the Write operation on the topic sales-data, so she can produce messages to it.

🧠 Conceptual

intermediate

Which Kafka security feature encrypts data in transit?

Kafka supports several security features. Which one specifically ensures that data sent between clients and brokers is encrypted to prevent eavesdropping?

A SASL (Simple Authentication and Security Layer)

B Kerberos Authentication

C ACLs (Access Control Lists)

D SSL/TLS (Secure Sockets Layer / Transport Layer Security)

💡 Hint

Encryption protects data while it moves over the network.

SSL/TLS encrypts data in transit, protecting it from being read by unauthorized parties.

🔧 Debug

advanced

Why does this Kafka client fail to authenticate?

A Kafka client configured with SASL/PLAIN authentication fails to connect to the broker. The client config snippet is:

security.protocol=SASL_PLAINTEXT
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user1" password="wrongpass";

The broker expects username "user1" with password "correctpass".
What is the cause of the failure?

A The client is missing the SSL truststore configuration.

B The client uses SASL_PLAINTEXT instead of SASL_SSL, causing encryption failure.

C The password in sasl.jaas.config is incorrect, causing authentication failure.

D The client is using the wrong SASL mechanism; it should be SCRAM-SHA-256.

💡 Hint

Check the username and password values carefully.

The client provides the wrong password, so the broker rejects the authentication.

📝 Syntax

advanced

Which Kafka ACL command syntax correctly removes all ACLs for a user?

You want to remove all ACLs for user Bob. Which command is syntactically correct?

A kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --remove --principal User:Bob

B kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --delete --principal User:Bob

C kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --remove --allow-principal User:Bob

D kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --remove --principal Bob

💡 Hint

The correct flag to remove ACLs is --remove and the principal must be specified correctly.

Option B uses the correct --remove flag and specifies the principal as User:Bob, which is the correct syntax.

🚀 Application

expert

How to securely configure Kafka brokers for multi-tenant environment?

You manage a Kafka cluster used by multiple teams. You want to ensure:
1. Each team can only access their own topics.
2. Data in transit is encrypted.
3. Clients authenticate securely.

Which combination of Kafka security features should you enable?

A Enable SSL encryption, configure SASL authentication, and set ACLs restricting topic access per team.

B Enable only ACLs for topic restrictions; encryption and authentication are optional.

C Use plaintext communication with SASL authentication and no ACLs.

D Enable SSL encryption and ACLs but allow anonymous access without authentication.

💡 Hint

Think about encryption, authentication, and authorization all together.

To secure a multi-tenant Kafka cluster, you need encryption (SSL), authentication (SASL), and authorization (ACLs) to restrict access.