SSL/TLS encryption in Kafka - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Kafka SSL configuration snippet?

Consider the following Kafka client SSL configuration in a properties file format. What will be the value of ssl.endpoint.identification.algorithm after loading this configuration?

Kafka

ssl.endpoint.identification.algorithm=
ssl.keystore.location=/var/private/ssl/kafka.client.keystore.jks
ssl.keystore.password=keystorepass
ssl.key.password=keypass
ssl.truststore.location=/var/private/ssl/kafka.client.truststore.jks
ssl.truststore.password=truststorepass

A "https"

B null (not set)

C "SSL"

D "" (empty string)

💡 Hint

Look carefully at the value assigned to ssl.endpoint.identification.algorithm.

The configuration explicitly sets ssl.endpoint.identification.algorithm to an empty value, which disables hostname verification in Kafka SSL connections.

🧠 Conceptual

intermediate

Which Kafka SSL property enables client authentication?

In Kafka SSL encryption, which configuration property must be set to enable the broker to authenticate clients using SSL certificates?

A ssl.client.auth=required

B ssl.keystore.location=/path/to/keystore.jks

C ssl.truststore.location=/path/to/truststore.jks

D ssl.enabled.protocols=TLSv1.2

💡 Hint

Think about the property that controls client certificate requirements.

The ssl.client.auth property set to required forces the broker to require and verify client certificates for authentication.

🔧 Debug

advanced

What error does this Kafka SSL producer configuration cause?

Given this Kafka producer SSL configuration snippet, what error will occur when the producer tries to connect to the broker?

Kafka

security.protocol=SSL
ssl.keystore.location=/etc/kafka/producer.keystore.jks
ssl.keystore.password=producerpass
ssl.key.password=wrongpass
ssl.truststore.location=/etc/kafka/producer.truststore.jks
ssl.truststore.password=trustpass

A AuthenticationException due to missing client certificate

B TimeoutException due to unreachable broker

C SSLHandshakeException due to incorrect key password

D No error, connection succeeds

💡 Hint

Check the password used for the private key in the keystore.

The ssl.key.password is incorrect, so the producer cannot access the private key, causing an SSL handshake failure.

📝 Syntax

advanced

Which Kafka SSL configuration snippet is syntactically correct?

Identify the syntactically correct Kafka SSL configuration snippet from the options below.

A

ssl.keystore.location=/etc/kafka/keystore.jks
ssl.keystore.password=pass
ssl.key.password
ssl.truststore.location=/etc/kafka/truststore.jks
ssl.truststore.password=pass

B

ssl.keystore.location=/etc/kafka/keystore.jks
ssl.keystore.password=pass
ssl.key.password=pass
ssl.truststore.location=/etc/kafka/truststore.jks
ssl.truststore.password=pass

C

ssl.keystore.location=/etc/kafka/keystore.jks
ssl.keystore.password
ssl.key.password=pass
ssl.truststore.location=/etc/kafka/truststore.jks
ssl.truststore.password=pass

D

ssl.keystore.location=/etc/kafka/keystore.jks
ssl.keystore.password=pass
ssl.key.password=pass
ssl.truststore.location
ssl.truststore.password=pass

💡 Hint

Look for missing values after the equals sign.

Option B has all properties correctly assigned with values. Other options have missing values causing syntax errors.

🚀 Application

expert

How many SSL handshake attempts will occur with this Kafka client config?

A Kafka client is configured with the following SSL properties: security.protocol=SSL ssl.keystore.location=/client/keystore.jks ssl.keystore.password=clientpass ssl.key.password=clientkeypass ssl.truststore.location=/client/truststore.jks ssl.truststore.password=trustpass ssl.endpoint.identification.algorithm=https If the broker's certificate hostname does not match the broker's DNS name, how many SSL handshake attempts will the client make before failing?

A 1 handshake attempt, then failure due to hostname verification

B 3 handshake attempts with retries before failure

C No handshake attempts because client rejects config

D Infinite handshake attempts until manual stop

💡 Hint

Consider how hostname verification affects SSL handshake in Kafka clients.

With ssl.endpoint.identification.algorithm=https, Kafka client verifies hostname. If it doesn't match, the handshake fails immediately after one attempt.