Confluent · CCAAK
Validates expertise in managing Apache Kafka clusters in production, covering Kafka fundamentals, cluster configuration, security, deployment architecture, Kafka Connect administration, observability, and troubleshooting.
Practice Questions
624
≈ 10 practice exams
Duration
90 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
Use this CCAAK practice exam to prepare for Confluent Certified Administrator for Apache Kafka (CCAAK) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 624 questions for Confluent CCAAK, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to patterns in your missed answers. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
The Confluent Certified Administrator for Apache Kafka (CCAAK) is a professional certification that validates the skills required to deploy, configure, monitor, and maintain Apache Kafka clusters in production environments. It covers a broad spectrum of administrative competencies, including broker and topic configuration, ZooKeeper management, security implementation (SSL/TLS, SASL, ACLs), Kafka Connect administration, Schema Registry, observability practices, and production troubleshooting. The certification is offered by Confluent, the company founded by the original creators of Apache Kafka, and is recognized across the industry as a credible benchmark for Kafka operations expertise.
The exam tests both conceptual understanding and scenario-based knowledge, requiring candidates to demonstrate proficiency with real-world challenges such as managing consumer group rebalances, diagnosing replication health, configuring listener protocols correctly, and resolving consumer lag. Candidates must understand the roles of brokers, leaders, group coordinators, and how components like Kafka Streams and ksqlDB interact within the broader ecosystem. The certification expires after two years, requiring recertification to remain current.
The CCAAK is designed for professionals who are responsible for the day-to-day administration and operation of Apache Kafka clusters. This includes platform engineers, site reliability engineers (SREs), DevOps engineers, and infrastructure administrators who manage Kafka in self-managed, Kubernetes-based, or cloud-hosted environments. Candidates typically have hands-on experience with Kafka CLI tooling and configuration files, and are comfortable diagnosing issues such as replication lag, consumer timeouts, and partition imbalances.
The certification is well-suited for professionals who want to formalize their Kafka administration skills and distinguish themselves in the job market. It is not intended for developers building Kafka-based applications (who would be better served by the CCDAK developer certification), but rather for those responsible for the health, security, and operational performance of Kafka infrastructure.
Confluent does not enforce formal prerequisites to register for the CCAAK exam. However, candidates are strongly recommended to have practical, hands-on experience running Kafka in a production or production-like environment before attempting the exam. This includes comfort with broker configuration files, CLI tools (kafka-topics, kafka-consumer-groups, kafka-configs, etc.), and experience troubleshooting common operational issues such as under-replicated partitions, consumer lag, and connectivity errors.
Familiarity with Kafka's core components — brokers, producers, consumers, consumer groups, ZooKeeper (or KRaft mode), Kafka Connect, and Schema Registry — is essential. Confluent recommends reviewing the official online study guide and, optionally, completing their formal training courses (available in live and self-paced formats) prior to sitting the exam. Most candidates report studying between 30 and 120 hours depending on their existing Kafka experience.
The CCAAK is a 90-minute, proctored, multiple-choice exam delivered online or at authorized testing centers worldwide. The exam consists of multiple-choice and multi-select questions, with the total question count reported at approximately 40–60 questions depending on the exam version. Remote delivery requires a webcam for proctor monitoring throughout the session. The exam is administered in English only, and results are displayed immediately upon completion.
The passing score is 70%, and the cost per attempt is $150 USD. The certification is valid for two years, after which recertification is required. Upon passing, candidates receive a Confluent digital badge and certificate and are authorized to use the certification title and logo in professional materials.
Earning the CCAAK demonstrates verified expertise in Apache Kafka administration, a skill set in high demand as organizations across financial services, e-commerce, telecommunications, and technology sectors scale their event streaming infrastructure. Kafka administrators and platform engineers with this credential are well-positioned for roles such as Senior Kafka Administrator, Platform Engineer, Data Infrastructure Engineer, and Site Reliability Engineer. The certification serves as a credible differentiator in both salary negotiations with current employers and job applications with new ones.
Apache Kafka skills consistently command above-average compensation in the data engineering and platform engineering space, with experienced Kafka administrators in North America typically earning $130,000–$180,000+ USD annually. The CCAAK pairs well with cloud certifications (AWS, GCP, Azure) and complements the Confluent Certified Developer for Apache Kafka (CCDAK) for professionals seeking full-stack Kafka expertise. As organizations increasingly adopt event-driven architectures, demand for credentialed Kafka operators continues to grow.
5 sample questions with answers and explanations. The full bank has 624 questions, enough for 10 full-length practice exams.
Preview — answers shown1. A security audit requires implementing mutual TLS authentication for all broker-to-broker and client-to-broker communications. The administrator configures listeners=SSL://0.0.0.0:9093, ssl.keystore.location=/var/ssl/kafka.server.keystore.jks, ssl.truststore.location=/var/ssl/kafka.server.truststore.jks, and security.inter.broker.protocol=SSL. After restart, clients can connect but brokers fail to communicate with each other. Which configuration must be added to enable broker-to-broker mutual TLS? (Select one!)
Explanation
The ssl.client.auth parameter controls whether clients must present certificates for authentication. Setting ssl.client.auth=required enables mutual TLS by requiring all connecting clients, including other brokers, to present valid certificates from the truststore. Without this setting, SSL provides encryption only without client authentication, and brokers cannot authenticate each other. Since security.inter.broker.protocol=SSL is configured, brokers will attempt SSL connections but fail authentication without ssl.client.auth=required. The inter.broker.listener.name is only necessary when multiple listeners exist and you need to specify which one brokers should use; with a single SSL listener, this is implicit. The endpoint identification algorithm is for hostname verification, not certificate requirement. Listener-specific ssl.client.auth configuration is valid syntax but the global ssl.client.auth applies to all SSL listeners by default.
2. A financial services company uses MirrorMaker 2 to replicate topics from a source cluster to a destination cluster. Which internal topic stores the offset mappings between source and destination clusters? (Select one!)
Explanation
MirrorMaker 2 uses mm2-offset-syncs with the source cluster name appended to store the mapping between source cluster offsets and destination cluster offsets. This topic is critical for offset translation when consumers need to switch from reading the source cluster to reading the replicated data on the destination cluster. The checkpoints internal topic stores consumer group offset mappings for consumer failover. Config and status topics store connector and task metadata but not offset translations.
3. A data pipeline uses Kafka Connect to replicate data from multiple source databases. Each database table should be written to a Kafka topic with the naming pattern 'db_<database_name>_<table_name>'. The source connector outputs topics named only as '<table_name>'. Which SMT should the administrator configure to achieve the required topic naming? (Select one!)
Explanation
RegexRouter SMT modifies the destination topic name using regular expression patterns and replacement templates, making it ideal for adding prefixes or restructuring topic names based on patterns. TimestampRouter is specifically for routing records to time-based topics using timestamp values, not for adding static prefixes. InsertField adds fields to record data, not topic names. ReplaceField operates on record field names and values, not topic routing.
4. A media company stores video metadata in a compacted topic with cleanup.policy=compact. An administrator needs to delete all records for a specific video identified by key video-12345. What record must the producer send to mark this key for deletion? (Select one!)
Explanation
Log compaction uses tombstone records to mark keys for deletion. A tombstone is a record with a non-null key and null value. When the log cleaner processes compacted topics, it retains the tombstone for delete.retention.ms duration (default 24 hours), allowing consumers to observe the deletion. After the retention period expires, the cleaner removes both the tombstone and all previous records for that key. Consumers must process the topic within the tombstone retention window to detect deletions. Using null key creates an unkeyed record that cannot participate in compaction. Headers are not used for deletion markers in log compaction. An empty string is a valid value distinct from null and does not trigger deletion behavior.
5. A security team implements SSL/TLS encryption for a Kafka cluster with ssl.client.auth=requested on brokers. After deployment, the team discovers that some clients connect with certificates while others connect without certificates, both successfully establishing connections. What security risk does this configuration present? (Select one!)
Explanation
When ssl.client.auth is set to requested, client certificates are optional rather than mandatory. Clients that provide certificates are authenticated with a principal like User:CN=clientname, while clients without certificates connect as ANONYMOUS or an undefined principal. This creates inconsistent ACL enforcement because the broker cannot reliably identify which client is connecting. This configuration is discouraged as it provides a false sense of security. Clients without certificates have the same read and write capabilities subject to ACLs for their principal (or lack thereof). Connection performance is not significantly different whether certificates are presented or not. The configuration is valid per TLS specifications where client certificates are optional in some authentication modes.
$17.99
One-time access to this exam