A company has an existing Kafka cluster running without SSL/TLS enabled.

To support gradual migration to SSL, Kafka supports configuring multiple listeners. You can run both a PLAINTEXT listener (for legacy clients) and an SSL listener (for new clients), allowing dual access.

From Kafka documentation:

“You can configure multiple listeners on a broker with different security protocols. This allows rolling out SSL while supporting legacy connections.”

A → Incorrect: Modifying the current listener breaks current clients.

B → Misleading: Changing advertised listeners affects how clients connect, which breaks backward compatibility.

C → Correct: Dual listeners allow phased SSL migration.

D → SSL must be configured on both ends to be effective.

Page Reference:

Kafka: The Definitive Guide, 1st Edition, Chapter 10, p. 305

Apache Kafka Documentation: Configuring Multiple Listeners

‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾