Confluent · CCAAK
Confluent Certified Administrator for Apache Kafka (CCAAK) Practice Tests
Validates expertise in managing Apache Kafka clusters in production, covering Kafka fundamentals, cluster configuration, security, deployment architecture, Kafka Connect administration, observability, and troubleshooting.
Exam Details
Practice Questions
624
≈ 10 practice exams
Duration
90 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
Confluent Certified Administrator for Apache Kafka (CCAAK) Practice Exam Preparation
Use this CCAAK practice exam to prepare for Confluent Certified Administrator for Apache Kafka (CCAAK) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 624 questions for Confluent CCAAK, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to patterns in your missed answers. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Domain Breakdown
Apache Kafka Cluster Configuration22%
Apache Kafka Fundamentals15%
Apache Kafka Security15%
Troubleshooting15%
Kafka Connect Administration12%
Deployment Architecture12%
Observability10%
Exam Overview
The Confluent Certified Administrator for Apache Kafka (CCAAK) is a professional certification that validates the skills required to deploy, configure, monitor, and maintain Apache Kafka clusters in production environments. It covers a broad spectrum of administrative competencies, including broker and topic configuration, ZooKeeper management, security implementation (SSL/TLS, SASL, ACLs), Kafka Connect administration, Schema Registry, observability practices, and production troubleshooting. The certification is offered by Confluent, the company founded by the original creators of Apache Kafka, and is recognized across the industry as a credible benchmark for Kafka operations expertise.
The exam tests both conceptual understanding and scenario-based knowledge, requiring candidates to demonstrate proficiency with real-world challenges such as managing consumer group rebalances, diagnosing replication health, configuring listener protocols correctly, and resolving consumer lag. Candidates must understand the roles of brokers, leaders, group coordinators, and how components like Kafka Streams and ksqlDB interact within the broader ecosystem. The certification expires after two years, requiring recertification to remain current.
Who Should Take This Exam
The CCAAK is designed for professionals who are responsible for the day-to-day administration and operation of Apache Kafka clusters. This includes platform engineers, site reliability engineers (SREs), DevOps engineers, and infrastructure administrators who manage Kafka in self-managed, Kubernetes-based, or cloud-hosted environments. Candidates typically have hands-on experience with Kafka CLI tooling and configuration files, and are comfortable diagnosing issues such as replication lag, consumer timeouts, and partition imbalances.
The certification is well-suited for professionals who want to formalize their Kafka administration skills and distinguish themselves in the job market. It is not intended for developers building Kafka-based applications (who would be better served by the CCDAK developer certification), but rather for those responsible for the health, security, and operational performance of Kafka infrastructure.
Prerequisites
Confluent does not enforce formal prerequisites to register for the CCAAK exam. However, candidates are strongly recommended to have practical, hands-on experience running Kafka in a production or production-like environment before attempting the exam. This includes comfort with broker configuration files, CLI tools (kafka-topics, kafka-consumer-groups, kafka-configs, etc.), and experience troubleshooting common operational issues such as under-replicated partitions, consumer lag, and connectivity errors.
Familiarity with Kafka's core components — brokers, producers, consumers, consumer groups, ZooKeeper (or KRaft mode), Kafka Connect, and Schema Registry — is essential. Confluent recommends reviewing the official online study guide and, optionally, completing their formal training courses (available in live and self-paced formats) prior to sitting the exam. Most candidates report studying between 30 and 120 hours depending on their existing Kafka experience.
Exam Format
The CCAAK is a 90-minute, proctored, multiple-choice exam delivered online or at authorized testing centers worldwide. The exam consists of multiple-choice and multi-select questions, with the total question count reported at approximately 40–60 questions depending on the exam version. Remote delivery requires a webcam for proctor monitoring throughout the session. The exam is administered in English only, and results are displayed immediately upon completion.
The passing score is 70%, and the cost per attempt is $150 USD. The certification is valid for two years, after which recertification is required. Upon passing, candidates receive a Confluent digital badge and certificate and are authorized to use the certification title and logo in professional materials.
Skills Measured
- 1.Apache Kafka Cluster Configuration (22%): Covers broker configuration parameters, topic creation and management, partition assignment strategies, replication factor settings, log retention and compaction policies, and producer/consumer configuration tuning including acks, min.insync.replicas, and offset management.
- 2.Apache Kafka Fundamentals (15%): Tests understanding of core Kafka architecture including brokers, topics, partitions, offsets, producers, consumers, consumer groups, leader election, and the role of ZooKeeper or KRaft in cluster coordination.
- 3.Apache Kafka Security (15%): Covers securing Kafka clusters using SSL/TLS for encryption in transit, SASL mechanisms (PLAIN, SCRAM, GSSAPI) for authentication, ACL-based authorization, and ZooKeeper-stored ACL management. Includes listener configuration and security protocol mapping.
- 4.Troubleshooting (15%): Focuses on diagnosing and resolving common Kafka operational issues including under-replicated partitions, consumer lag, ISR shrinkage, offset reset scenarios, rebalance storms, and advertised.listeners misconfigurations.
- 5.Kafka Connect Administration (12%): Covers deploying and managing Kafka Connect in standalone and distributed modes, configuring source and sink connectors, managing connector offsets, understanding worker configuration, and troubleshooting connector failures.
- 6.Deployment Architecture (12%): Addresses cluster topology design, broker placement, network configuration, hardware sizing considerations, multi-datacenter replication (MirrorMaker 2), and deployment on bare metal, VMs, Kubernetes, and managed platforms.
- 7.Observability (10%): Covers monitoring Kafka clusters using JMX metrics, key broker and consumer group metrics to track (under-replicated partitions, request latency, consumer lag), log monitoring, alerting strategies, and integration with monitoring tools.
Study Tips
- Download and thoroughly study the official Confluent CCAAK study guide from the Confluent training portal (training.confluent.io), as it defines the exact domain objectives and weights the exam is built around.
- Practice hands-on with a local Kafka cluster (Docker Compose or Confluent's community packages) to gain fluency with CLI tools like kafka-topics.sh, kafka-consumer-groups.sh, kafka-configs.sh, and kafka-acls.sh — the exam includes scenario-based questions that require operational knowledge.
- Master the interaction between acks, min.insync.replicas, and replication factor — this is a high-frequency topic on the exam and a common source of confusion. Work through failure scenarios manually to understand ISR behavior under different configurations.
- Focus significant study time on security configuration: understand how listeners and advertised.listeners are configured, the difference between SASL mechanisms (PLAIN vs. SCRAM vs. GSSAPI), how SSL keystores and truststores work, and how ACLs are applied to topics, groups, and transactional IDs.
- Use Confluent's free self-paced training courses on Confluent Training (training.confluent.io) as a structured study path — particularly the Apache Kafka Administration course — to cover all exam domains systematically.
- Practice interpreting Kafka metrics (JMX): know which metrics signal under-replication, consumer lag, high request latency, and broker instability. The observability domain tests your ability to diagnose cluster health from metric data.
- When reviewing Kafka Connect, ensure you understand the differences between standalone and distributed mode, how exactly-once semantics work with connectors, and how to troubleshoot a connector in a FAILED state using the REST API.
Career Benefits
Earning the CCAAK demonstrates verified expertise in Apache Kafka administration, a skill set in high demand as organizations across financial services, e-commerce, telecommunications, and technology sectors scale their event streaming infrastructure. Kafka administrators and platform engineers with this credential are well-positioned for roles such as Senior Kafka Administrator, Platform Engineer, Data Infrastructure Engineer, and Site Reliability Engineer. The certification serves as a credible differentiator in both salary negotiations with current employers and job applications with new ones.
Apache Kafka skills consistently command above-average compensation in the data engineering and platform engineering space, with experienced Kafka administrators in North America typically earning $130,000–$180,000+ USD annually. The CCAAK pairs well with cloud certifications (AWS, GCP, Azure) and complements the Confluent Certified Developer for Apache Kafka (CCDAK) for professionals seeking full-stack Kafka expertise. As organizations increasingly adopt event-driven architectures, demand for credentialed Kafka operators continues to grow.
Sample Questions
5 sample questions with answers and explanations. The full bank has 624 questions, enough for 10 full-length practice exams.
Preview — answers shown1. A ksqlDB application creates a windowed aggregation: CREATE TABLE user_activity AS SELECT user_id, COUNT(*) as event_count FROM events WINDOW TUMBLING (SIZE 1 HOUR) GROUP BY user_id EMIT CHANGES. The underlying Kafka Streams application is configured with commit.interval.ms=30000 and cache.max.bytes.buffering=10485760. What effect does the record cache have on result emission? (Select one!)
AResults are cached and emitted in batches every 30 seconds or when cache reaches 10 MB
BOnly final window results are emitted when windows close after 1 hour
CResults are emitted immediately for every input record to ensure real-time accuracy
DCaching is disabled for windowed aggregations to prevent result staleness
Explanation
Kafka Streams maintains a record cache to reduce downstream traffic by batching updates. With cache.max.bytes.buffering set to 10485760 bytes (10 MB), the framework caches intermediate aggregation results and forwards them downstream when the commit interval of 30 seconds elapses or when the cache fills. This batching behavior applies to all aggregations including windowed operations. Results are not emitted for every input record when caching is enabled. Caching is not automatically disabled for windowed aggregations. Windows do not need to close before emitting results; partial aggregates are forwarded based on cache behavior. This cache improves throughput by reducing redundant updates for the same key.
2. A healthcare company migrates from ZooKeeper mode to KRaft mode using kafka-metadata-quorum.sh to monitor the migration. The administrator runs kafka-metadata-quorum.sh --bootstrap-server localhost:9092 describe --status and observes that one of three controllers shows a HighWatermark value significantly behind the Leader's LogEndOffset. What does this indicate about the KRaft cluster health? (Select one!)
AThe lagging controller has lost quorum membership and will be automatically removed
BThe lagging controller is still catching up to the leader but the cluster can commit metadata changes with majority quorum
CThe migration is in dual-write phase and the lag represents uncommitted ZooKeeper metadata
DThe metadata log topic has insufficient replication factor to maintain consistency
Explanation
In a KRaft quorum with three controllers, the high watermark represents the offset up to which a majority of replicas have acknowledged. If one controller shows a HighWatermark behind the leader's LogEndOffset, that controller is lagging but the quorum can still commit new metadata changes because two out of three controllers form a majority. The lagging controller remains in the quorum and will catch up asynchronously. Controllers are not automatically removed for lag; manual intervention is required for membership changes. The metadata log is managed by the KRaft quorum itself with replication factor equal to the number of controllers in the quorum. The lag between HighWatermark and LogEndOffset on one controller is normal asynchronous replication behavior, not related to dual-write phase which would show synchronization issues between ZooKeeper and KRaft systems.
3. A Kafka administrator needs to optimize replication throughput for a cluster experiencing slow follower sync times. The cluster has 8 brokers with 500 partitions distributed evenly. CPU utilization averages 40 percent across brokers. Which configuration change should the administrator implement to improve replication performance? (Select one!)
AIncrease num.network.threads from 3 to 8 to handle more network requests
BIncrease num.replica.fetchers from 1 to 4 to enhance I/O parallelism
CIncrease num.io.threads from 8 to 16 to handle more concurrent disk operations
DIncrease socket.receive.buffer.bytes from 102400 to 1048576 for larger buffers
Explanation
Increasing num.replica.fetchers from 1 to 4 directly improves replication throughput by creating more fetcher threads per source broker, enhancing I/O parallelism for follower replication. Since CPU utilization is only 40 percent, the cluster can handle the additional threads. Increasing num.io.threads helps with general request processing but is less targeted for replication. Network threads handle connection management and request parsing, not replication specifically. Socket buffer size affects individual connection performance but does not create additional parallelism for replication operations.
4. An administrator runs kafka-consumer-groups.sh --describe for a consumer group and sees LAG values increasing over time while LOG-END-OFFSET continues growing. CURRENT-OFFSET is also increasing but at a slower rate. What does this indicate? (Select one!)
AThe partition leader is unavailable
BThe consumer is not committing offsets properly
CThe consumer has crashed and is not processing any messages
DThe consumer is processing messages but cannot keep up with the producer rate
Explanation
Growing lag combined with increasing current offset and log-end offset indicates the consumer is actively processing messages as evidenced by advancing current offset but the producer is writing messages faster than the consumer can process them. The gap between consumption rate and production rate causes lag to grow over time. If offsets were not committing, current offset would not increase. If the consumer crashed, current offset would be static. If the partition leader were unavailable, producers could not write and log-end offset would not grow.
5. An administrator configures SSL/TLS encryption for a Kafka cluster. After enabling SSL, producers can connect successfully, but the administrator wants to enforce mutual TLS authentication to verify client identities. Which configuration change on the broker is required to enforce mTLS? (Select one!)
ASet security.protocol=SSL and ssl.endpoint.identification.algorithm=https
BSet ssl.client.auth=required and configure ssl.truststore with client CA certificates
CSet ssl.client.auth=requested and enable authorizer.class.name
DSet sasl.mechanism.inter.broker.protocol=SSL and ssl.client.auth=required
Explanation
To enforce mutual TLS authentication, the broker must set ssl.client.auth=required, which mandates that clients present valid certificates during the SSL handshake. The broker's truststore must contain the Certificate Authority that signed the client certificates to validate them. The ssl.endpoint.identification.algorithm setting controls hostname verification but does not enforce client authentication. Setting ssl.client.auth=requested makes client certificates optional, not mandatory. The sasl.mechanism.inter.broker.protocol parameter is unrelated to SSL client authentication and is used for SASL configuration.
$17.99
One-time access to this exam
624 questions (10 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available