Option 3 correctly addresses both requirements. Using SASL_SSL on the listeners encrypts data in transit between clients and brokers. Configuring the `log.dir` to point to an encrypted volume (like LUKS on Linux) ensures data at rest encryption, handled by the operating system or storage layer, which is the standard Kafka approach. Option 1 is partially correct but vague on the at-rest method. Option 2’s custom LogCleaner is not a standard or practical solution. Option 3 references non-standard Confluent properties and REST Proxy, which doesn’t directly handle broker disk encryption.

When `security.protocol` is set to `SASL_SSL`, it implies a two-layer protocol: SSL/TLS for encryption and certificate-based broker authentication, *then* SASL for client authentication. Even for SASL/SCRAM, the SSL layer requires the client to trust the broker’s certificate, typically configured via a truststore. The other options are incorrect: SCRAM-SHA-256 is correct if the broker uses it, client certificates are not required for SASL/SCRAM, and JAAS config can be set programmatically or via a file.

Option 2 is correct. It uses the modern `–bootstrap-server` syntax (for the Confluent Server Authorizer/Kafka ≥ 2.0), specifies a literal topic resource (`–resource-pattern-type LITERAL`), and grants only the WRITE operation to the specific principal, adhering to least privilege. Option 1 uses the deprecated ZooKeeper connection. Option 3 incorrectly adds an `–allow-host` filter, which is not a standard ACL capability. Option 4 uses the old ZooKeeper command and tries to use a deny rule for all other users, which is not how simple allow-ACLs work; you simply don’t grant them permission.

The `kafka-acls –list` command, when pointed to a bootstrap server using the standard authorizer, is the direct and intended method for listing all configured ACLs in a human-readable format for audit. Option 2 is incorrect; the `_confluent-command` topic is an internal implementation detail, not a stable API for audits. Option 3 lists role bindings for Confluent RBAC, not standard Kafka ACLs. Option 4 inspects raw ZooKeeper data, which is low-level, not human-friendly, and not applicable for brokers using the KIP-500 KRaft mode without ZooKeeper.

For mTLS (client certificate authentication), the `security.protocol` must be `SSL` (or `SASL_SSL` if also using SASL, which it isn’t here). The client must provide its own certificate via a keystore (`ssl.keystore.location`) and trust the broker’s certificate via a truststore. This configuration is correctly scoped for the producer clients spawned by the worker using the `producer.` prefix. Option 2 is for SASL, not mTLS. Option 3 is for OAuth, not mTLS. Option 4 is false; the producer clients need explicit configuration.

RBAC is designed for this use case. The correct method is to define a role with the necessary permissions (`Create`, `Delete` on `Topic`) and bind it to a principal (like a LDAP group) for a specific resource pattern (`teamx.*`). This is scalable and manageable. Option 2 grants excessive privilege. Option 3 describes the legacy ACL method, not RBAC. Option 4 is incorrect; the built-in `DeveloperRead/Write` roles do not grant topic management permissions like `Create` or `Delete`.

The `kafka-acls –list` command, when filtered by a specific topic (`–topic`) and operation (`–operation READ`), will list all ACLs that grant (or deny) the READ permission on that exact topic. Option 1 with `–resource-pattern-type MATCH` would also show ACLs on wildcard patterns that match the topic, which is useful but slightly broader than the direct question. Option 2 is for dynamic broker/config changes, not ACLs. Option 3 is not a valid flag for `kafka-topics`.

The error clearly states the principal is denied the `Write` operation. This is an authorization failure, not an authentication failure. The client has authenticated successfully (its Kerberos principal is known), but it lacks the necessary permission. The solution is to grant the permission via an ACL. Option 0 addresses authentication renewal, which isn’t the problem. Option 2 would change the security protocol, not fix the ACL. Option 3 also addresses a potential auth/connection issue, not the explicit authorization error.

Option 0 correctly defines two distinct listeners with different security protocol maps. The INTERNAL listener uses `SASL_PLAINTEXT` (authentication via SASL/PLAIN over an unencrypted channel), suitable for the trusted VPC. The EXTERNAL listener uses `SASL_SSL`, requiring both encryption and authentication for external clients. Option 1 uses `PLAINTEXT` and `SSL` protocols, which do not support SASL/PLAIN authentication. Option 2 forces SASL on both, but the question allows internal plaintext. Option 4 is insecure; you cannot force `SASL_SSL` to accept plaintext connections.

Option 3 correctly addresses both requirements. Using SASL_SSL on the listeners encrypts data in transit between clients and brokers. Configuring the `log.dir` to point to an encrypted volume (like LUKS on Linux) ensures data at rest encryption, handled by the operating system or storage layer, which is the standard Kafka approach. Option 1 is partially correct but vague on the at-rest method. Option 2’s custom LogCleaner is not a standard or practical solution. Option 3 references non-standard Confluent properties and REST Proxy, which doesn’t directly handle broker disk encryption.0