ZABBIX CERTIFIED SPECIALIST EXAM 3 2026/2027 | Latest
Update | Questions & Verified Answers | 100% Correct |
Grade A | Pass Guaranteed - A+ Graded
Section 1: Advanced Item & Trigger Logic—Calculated Items, Aggregates,
and Intelligent Monitoring
Q1: You've got a server cluster where you need to monitor the average CPU load across
12 web frontends. You want to create a single calculated item on your Zabbix proxy that
references all these hosts without creating individual items on each. Which function
combination handles this correctly?
A. last(/host/cpu.load) with a host group filter
B. avg(/WebCluster/*/cpu.load) using the wildcards and aggregate syntax
[CORRECT]
C. trendavg(/host/cpu.load,1h) across multiple hosts
D. count(/host/cpu.load,5m) with a trigger expression
Correct Answer: B
Rationale: That's the right call because Zabbix 6.0+ supports wildcard syntax with
aggregate functions like avg(), sum(), min(), max() using patterns like
/WebCluster/*/cpu.load to pull data from multiple hosts dynamically. The last()
function doesn't support cross-host aggregation natively, trendavg() works on
,historical trends not real-time aggregation, and count() just tallies values rather than
averaging them.
Q2: Your database team needs a trigger that fires when disk space will run out in less
than 7 days based on current growth trends. Which trigger function expression fits this
forecasting requirement?
A. last(/db01/vfs.fs.size[/data,free])<10G
B. timeleft(/db01/vfs.fs.size[/data,free],0,7d)<7d [CORRECT]
C. forecast(/db01/vfs.fs.size[/data,free],1h)<0
D. trendavg(/db01/vfs.fs.size[/data,free],7d)<10G
Correct Answer: B
Rationale: You'd use timeleft() here because it's specifically designed to calculate
how long until a value reaches a threshold based on trend analysis—perfect for capacity
planning alerts. The parameters specify the item, the threshold (0 bytes free), and the
lookback period for trend calculation. forecast() predicts values at a future time
rather than time until threshold, and trendavg() just gives historical averages without
predictive power.
Q3: You've configured a dependent item that parses JSON from a master item using
preprocessing. The master item polls every 60 seconds, but your dependent item shows
"Not supported" intermittently. What's the most likely cause?
A. The dependent item interval is set to 30 seconds [CORRECT]
,B. The preprocessing step uses the wrong regular expression
C. The master item type should be Zabbix trapper
D. The dependent item needs its own polling interval independent of the master
Correct Answer: A
Rationale: That's a classic gotcha—dependent items must have an update interval of 0
(meaning they update when the master updates) or match the master's interval. Setting
a shorter interval causes "Not supported" because the dependent tries to calculate
before fresh master data arrives. The preprocessing regex would cause consistent
failures, not intermittent ones, and dependent items by definition rely on master item
timing.
Q4: You need a trigger with hysteresis to avoid flapping on a temperature sensor. The
alert should fire above 80°C but only recover below 75°C. Which expression implements
this correctly?
A. last(/sensor/temp)>80 with recovery expression last(/sensor/temp)<80
B. last(/sensor/temp)>80 with recovery expression last(/sensor/temp)<75
[CORRECT]
C. avg(/sensor/temp,5m)>80 with recovery avg(/sensor/temp,5m)<75
D. max(/sensor/temp,10m)>80 with recovery min(/sensor/temp,10m)<75
Correct Answer: B
Rationale: Trigger hysteresis requires different thresholds for problem and recovery
states—fire at 80°C, recover at 75°C creates that 5-degree dead band preventing rapid
, state changes. Using the same threshold in recovery expression (option A) gives no
hysteresis, while averaging or min/max functions add smoothing but don't create the
asymmetric threshold behavior needed for true hysteresis.
Q5: You're monitoring a high-throughput trading application where you need to alert on
the 95th percentile response time over a 15-minute window. Which trigger function
handles percentile calculations?
A. percentile(/app/response.time,15m,95) [CORRECT]
B. avg(/app/response.time,15m)*1.95
C. max(/app/response.time,15m) with a multiplier
D. median(/app/response.time,15m,95)
Correct Answer: A
Rationale: Zabbix 6.0 introduced percentile() specifically for this use case—it takes
the item, time period, and percentile value as arguments. The manual calculation in
option B doesn't account for distribution shape, max() gives you the worst case not the
95th percentile, and median() calculates the 50th percentile regardless of the third
parameter you might try to pass.
Q6: Your calculated item needs to sum values from three specific hosts: web01, web02,
and web03. The syntax sum(/web*/cpu.load) grabs too many hosts. What's the
cleanest solution?
A. Create three separate calculated items and add them in a fourth
Update | Questions & Verified Answers | 100% Correct |
Grade A | Pass Guaranteed - A+ Graded
Section 1: Advanced Item & Trigger Logic—Calculated Items, Aggregates,
and Intelligent Monitoring
Q1: You've got a server cluster where you need to monitor the average CPU load across
12 web frontends. You want to create a single calculated item on your Zabbix proxy that
references all these hosts without creating individual items on each. Which function
combination handles this correctly?
A. last(/host/cpu.load) with a host group filter
B. avg(/WebCluster/*/cpu.load) using the wildcards and aggregate syntax
[CORRECT]
C. trendavg(/host/cpu.load,1h) across multiple hosts
D. count(/host/cpu.load,5m) with a trigger expression
Correct Answer: B
Rationale: That's the right call because Zabbix 6.0+ supports wildcard syntax with
aggregate functions like avg(), sum(), min(), max() using patterns like
/WebCluster/*/cpu.load to pull data from multiple hosts dynamically. The last()
function doesn't support cross-host aggregation natively, trendavg() works on
,historical trends not real-time aggregation, and count() just tallies values rather than
averaging them.
Q2: Your database team needs a trigger that fires when disk space will run out in less
than 7 days based on current growth trends. Which trigger function expression fits this
forecasting requirement?
A. last(/db01/vfs.fs.size[/data,free])<10G
B. timeleft(/db01/vfs.fs.size[/data,free],0,7d)<7d [CORRECT]
C. forecast(/db01/vfs.fs.size[/data,free],1h)<0
D. trendavg(/db01/vfs.fs.size[/data,free],7d)<10G
Correct Answer: B
Rationale: You'd use timeleft() here because it's specifically designed to calculate
how long until a value reaches a threshold based on trend analysis—perfect for capacity
planning alerts. The parameters specify the item, the threshold (0 bytes free), and the
lookback period for trend calculation. forecast() predicts values at a future time
rather than time until threshold, and trendavg() just gives historical averages without
predictive power.
Q3: You've configured a dependent item that parses JSON from a master item using
preprocessing. The master item polls every 60 seconds, but your dependent item shows
"Not supported" intermittently. What's the most likely cause?
A. The dependent item interval is set to 30 seconds [CORRECT]
,B. The preprocessing step uses the wrong regular expression
C. The master item type should be Zabbix trapper
D. The dependent item needs its own polling interval independent of the master
Correct Answer: A
Rationale: That's a classic gotcha—dependent items must have an update interval of 0
(meaning they update when the master updates) or match the master's interval. Setting
a shorter interval causes "Not supported" because the dependent tries to calculate
before fresh master data arrives. The preprocessing regex would cause consistent
failures, not intermittent ones, and dependent items by definition rely on master item
timing.
Q4: You need a trigger with hysteresis to avoid flapping on a temperature sensor. The
alert should fire above 80°C but only recover below 75°C. Which expression implements
this correctly?
A. last(/sensor/temp)>80 with recovery expression last(/sensor/temp)<80
B. last(/sensor/temp)>80 with recovery expression last(/sensor/temp)<75
[CORRECT]
C. avg(/sensor/temp,5m)>80 with recovery avg(/sensor/temp,5m)<75
D. max(/sensor/temp,10m)>80 with recovery min(/sensor/temp,10m)<75
Correct Answer: B
Rationale: Trigger hysteresis requires different thresholds for problem and recovery
states—fire at 80°C, recover at 75°C creates that 5-degree dead band preventing rapid
, state changes. Using the same threshold in recovery expression (option A) gives no
hysteresis, while averaging or min/max functions add smoothing but don't create the
asymmetric threshold behavior needed for true hysteresis.
Q5: You're monitoring a high-throughput trading application where you need to alert on
the 95th percentile response time over a 15-minute window. Which trigger function
handles percentile calculations?
A. percentile(/app/response.time,15m,95) [CORRECT]
B. avg(/app/response.time,15m)*1.95
C. max(/app/response.time,15m) with a multiplier
D. median(/app/response.time,15m,95)
Correct Answer: A
Rationale: Zabbix 6.0 introduced percentile() specifically for this use case—it takes
the item, time period, and percentile value as arguments. The manual calculation in
option B doesn't account for distribution shape, max() gives you the worst case not the
95th percentile, and median() calculates the 50th percentile regardless of the third
parameter you might try to pass.
Q6: Your calculated item needs to sum values from three specific hosts: web01, web02,
and web03. The syntax sum(/web*/cpu.load) grabs too many hosts. What's the
cleanest solution?
A. Create three separate calculated items and add them in a fourth
