Study Confluent CCAC Incident Response: key concepts, common traps, and exam decision cues.
On this page
Incident questions reward discipline. CCAC wants you to reduce the problem first: is this a reachability issue, an authorization issue, a replication or throughput issue, a limit problem, or a recent-change problem? Strong operators do not jump straight to random tuning.
Incident-triage order
Step
What to test first
Why
1
scope of impact
tells you whether this is local or platform-wide
2
recent changes
many incidents are self-inflicted
3
path, auth, and health signals
narrows the fault lane quickly
4
lag, throughput, or limit pressure
confirms whether capacity or service boundaries are involved
What the exam is really testing
If the scenario shows…
Strong reading
cross-cluster delay
link health, source load, and expectation mismatch are under test
sudden failure after configuration updates
recent-change discipline is under test
broad slowdown with quota language
limit or capacity pressure may be central
one connector or client failing while others remain healthy
local path or identity issue may be stronger than cluster-wide panic
Decision order that usually wins
Scope the blast radius first.
Check recent changes second.
Classify the fault lane: path, auth, health, lag, or limits.
Confirm whether the symptom is local or platform-wide before tuning anything.
Use replication or throughput signals as clues, not as proof of one root cause.
Incident-response questions reward disciplined narrowing. CCAC wants the operator who reduces uncertainty first, not the one who jumps to random tuning or destructive changes.
Scenario triage
Scenario
Better first move
one client fails while others stay healthy
inspect local identity or path first
lag appears across linked clusters
inspect link health, source load, and limits
incident started right after a change
elevate timeline and rollback thinking
quotas or service-boundary language appears
investigate limit pressure explicitly
Common traps
Trap
Better rule
treating lag as proof that brokers are broken
first determine whether the cause is path, auth, source load, or limit pressure
ignoring recent credential or route changes
incident timelines matter
trying to solve every slowdown with more partitions
capacity symptoms can come from several different lanes