Zabbix Certified Specialist Exam (1) (2026/2027
Update)
Questions and Verified Answers | Grade A
Domain 1: Zabbix Architecture & Installation (10 Questions)
Sub-Topic 1.1: Zabbix Server Components and Communication Ports (4 Questions)
Question 1 (Multiple-Choice) A Zabbix administrator is deploying a distributed monitoring
environment. The Zabbix Server needs to collect data from a passive Zabbix Agent installed on a
remote Linux host. Which TCP port and connection direction are used for this communication?
A. Port 10051, agent initiates connection to server
B. Port 10050, server initiates connection to agent
C. Port 10052, server initiates connection to Java Gateway
D. Port 161, server initiates SNMP GetRequest to agent
Answer: B [CORRECT]
Rationale: The Zabbix server polls passive agents on TCP port 10050, with the server acting as
the connection initiator (pull model). Port 10051 is used for active agents and proxy
communication (push model), port 10052 is reserved for the Zabbix Java Gateway, and port 161
is the standard SNMP port. The practical operational consequence is that firewall rules must
allow inbound TCP 10050 on monitored hosts from the Zabbix server/proxy IP addresses.
Question 2 (Multiple-Choice) In a Zabbix architecture with an active proxy deployed in a remote
DMZ, which component listens on TCP port 10051 to receive data from the active proxy?
A. Zabbix Agent on the monitored host
B. Zabbix Frontend (web interface)
C. Zabbix Server Trapper process
D. Zabbix Database backend
Answer: C [CORRECT]
Rationale: The Zabbix Server's Trapper process listens on TCP port 10051 to receive data from
active agents, active proxies, and Zabbix senders. The agent listens on port 10050 (passive
mode), the frontend uses HTTP/HTTPS ports (80/443), and the database backend communicates
,over its own protocol (e.g., 3306 for MySQL, 5432 for PostgreSQL). In DMZ deployments, only
outbound TCP 10051 from the proxy to the server is required, eliminating the need for inbound
firewall holes at the remote site.
Question 3 (SATA - Select All That Apply) Which of the following Zabbix components use TCP
port 10051 for communication? (Select all that apply.)
A. Zabbix Agent (active mode) sending collected metrics
B. Zabbix Proxy (active mode) forwarding preprocessed data
C. Zabbix Server polling passive agents
D. Zabbix Trapper items receiving external data
E. Zabbix Java Gateway processing JMX metrics
Answer: A, B, D [CORRECT]
Rationale: TCP port 10051 is the listening port for the Zabbix Server's Trapper process, which
handles incoming connections from active agents (A), active proxies (B), and external
applications sending trapper data (D). Passive agent polling uses port 10050 (C is incorrect). The
Zabbix Java Gateway operates on port 10052 (E is incorrect). Understanding this port allocation
is critical for firewall configuration and network segmentation in enterprise environments.
Question 4 (Multiple-Choice) An organization is designing a high-availability Zabbix
deployment. The Zabbix Frontend, Zabbix Server, and database are on separate hosts. Which
statement correctly describes the communication flow between these components?
A. The Frontend connects directly to the Zabbix Agent on port 10050 to display real-time data
B. The Zabbix Server writes collected metrics directly to the Frontend via HTTP
C. The Frontend queries the database to render dashboards; the Server writes metrics to the
database
D. The Zabbix Server sends alert notifications directly to the Frontend's notification bar
Answer: C [CORRECT]
Rationale: The Zabbix Frontend is a PHP-based web application that reads configuration and
historical data from the database to render dashboards and configuration pages. The Zabbix
Server processes collected data and writes it to the database (history, trends, events tables).
The Frontend never communicates directly with agents or the Server daemon; all data flows
through the database. This three-tier architecture allows independent scaling of the frontend
(multiple web servers behind a load balancer) and server components.
, Sub-Topic 1.2: Database Backend Requirements and Partitioning (3 Questions)
Question 5 (Multiple-Choice) A Zabbix administrator is configuring a new installation with
TimescaleDB to handle high-volume time-series data. Which tables are converted to
hypertables to enable automatic partitioning and compression?
A. Only the hosts and items configuration tables
B. The history, history_uint, trends, and trends_uint tables
C. The users and usrgrp authentication tables
D. The actions and operations alert configuration tables
Answer: B [CORRECT]
Rationale: TimescaleDB hypertables are created for time-series data tables including history
(float), history_uint (integer), history_log, history_text, history_str, history_bin, trends, and
trends_uint — all partitioned by the clock (timestamp) column. Configuration tables like hosts,
items, users, and actions remain regular PostgreSQL tables. The chunk_time_interval is set to
86400 seconds (1 day) for history tables and 2592000 seconds (30 days) for trends tables,
enabling efficient data retention and compression policies.
Question 6 (SATA - Select All That Apply) Which of the following are supported database
backends for Zabbix Server 7.0? (Select all that apply.)
A. MySQL 8.0 or newer
B. PostgreSQL 13 or newer
C. Oracle Database 19c
D. TimescaleDB (as PostgreSQL extension)
E. Microsoft SQL Server 2022
Answer: A, B, D [CORRECT]
Rationale: Zabbix Server 7.0 officially supports MySQL 8.0+ (A), PostgreSQL 13+ (B), and
TimescaleDB as a PostgreSQL extension (D) for enhanced time-series performance. Oracle
Database and Microsoft SQL Server are not supported backends for Zabbix Server. TimescaleDB
provides hypertable partitioning, native compression (up to 90% disk savings), and continuous
aggregation for trends data, making it the recommended choice for large-scale deployments.
Update)
Questions and Verified Answers | Grade A
Domain 1: Zabbix Architecture & Installation (10 Questions)
Sub-Topic 1.1: Zabbix Server Components and Communication Ports (4 Questions)
Question 1 (Multiple-Choice) A Zabbix administrator is deploying a distributed monitoring
environment. The Zabbix Server needs to collect data from a passive Zabbix Agent installed on a
remote Linux host. Which TCP port and connection direction are used for this communication?
A. Port 10051, agent initiates connection to server
B. Port 10050, server initiates connection to agent
C. Port 10052, server initiates connection to Java Gateway
D. Port 161, server initiates SNMP GetRequest to agent
Answer: B [CORRECT]
Rationale: The Zabbix server polls passive agents on TCP port 10050, with the server acting as
the connection initiator (pull model). Port 10051 is used for active agents and proxy
communication (push model), port 10052 is reserved for the Zabbix Java Gateway, and port 161
is the standard SNMP port. The practical operational consequence is that firewall rules must
allow inbound TCP 10050 on monitored hosts from the Zabbix server/proxy IP addresses.
Question 2 (Multiple-Choice) In a Zabbix architecture with an active proxy deployed in a remote
DMZ, which component listens on TCP port 10051 to receive data from the active proxy?
A. Zabbix Agent on the monitored host
B. Zabbix Frontend (web interface)
C. Zabbix Server Trapper process
D. Zabbix Database backend
Answer: C [CORRECT]
Rationale: The Zabbix Server's Trapper process listens on TCP port 10051 to receive data from
active agents, active proxies, and Zabbix senders. The agent listens on port 10050 (passive
mode), the frontend uses HTTP/HTTPS ports (80/443), and the database backend communicates
,over its own protocol (e.g., 3306 for MySQL, 5432 for PostgreSQL). In DMZ deployments, only
outbound TCP 10051 from the proxy to the server is required, eliminating the need for inbound
firewall holes at the remote site.
Question 3 (SATA - Select All That Apply) Which of the following Zabbix components use TCP
port 10051 for communication? (Select all that apply.)
A. Zabbix Agent (active mode) sending collected metrics
B. Zabbix Proxy (active mode) forwarding preprocessed data
C. Zabbix Server polling passive agents
D. Zabbix Trapper items receiving external data
E. Zabbix Java Gateway processing JMX metrics
Answer: A, B, D [CORRECT]
Rationale: TCP port 10051 is the listening port for the Zabbix Server's Trapper process, which
handles incoming connections from active agents (A), active proxies (B), and external
applications sending trapper data (D). Passive agent polling uses port 10050 (C is incorrect). The
Zabbix Java Gateway operates on port 10052 (E is incorrect). Understanding this port allocation
is critical for firewall configuration and network segmentation in enterprise environments.
Question 4 (Multiple-Choice) An organization is designing a high-availability Zabbix
deployment. The Zabbix Frontend, Zabbix Server, and database are on separate hosts. Which
statement correctly describes the communication flow between these components?
A. The Frontend connects directly to the Zabbix Agent on port 10050 to display real-time data
B. The Zabbix Server writes collected metrics directly to the Frontend via HTTP
C. The Frontend queries the database to render dashboards; the Server writes metrics to the
database
D. The Zabbix Server sends alert notifications directly to the Frontend's notification bar
Answer: C [CORRECT]
Rationale: The Zabbix Frontend is a PHP-based web application that reads configuration and
historical data from the database to render dashboards and configuration pages. The Zabbix
Server processes collected data and writes it to the database (history, trends, events tables).
The Frontend never communicates directly with agents or the Server daemon; all data flows
through the database. This three-tier architecture allows independent scaling of the frontend
(multiple web servers behind a load balancer) and server components.
, Sub-Topic 1.2: Database Backend Requirements and Partitioning (3 Questions)
Question 5 (Multiple-Choice) A Zabbix administrator is configuring a new installation with
TimescaleDB to handle high-volume time-series data. Which tables are converted to
hypertables to enable automatic partitioning and compression?
A. Only the hosts and items configuration tables
B. The history, history_uint, trends, and trends_uint tables
C. The users and usrgrp authentication tables
D. The actions and operations alert configuration tables
Answer: B [CORRECT]
Rationale: TimescaleDB hypertables are created for time-series data tables including history
(float), history_uint (integer), history_log, history_text, history_str, history_bin, trends, and
trends_uint — all partitioned by the clock (timestamp) column. Configuration tables like hosts,
items, users, and actions remain regular PostgreSQL tables. The chunk_time_interval is set to
86400 seconds (1 day) for history tables and 2592000 seconds (30 days) for trends tables,
enabling efficient data retention and compression policies.
Question 6 (SATA - Select All That Apply) Which of the following are supported database
backends for Zabbix Server 7.0? (Select all that apply.)
A. MySQL 8.0 or newer
B. PostgreSQL 13 or newer
C. Oracle Database 19c
D. TimescaleDB (as PostgreSQL extension)
E. Microsoft SQL Server 2022
Answer: A, B, D [CORRECT]
Rationale: Zabbix Server 7.0 officially supports MySQL 8.0+ (A), PostgreSQL 13+ (B), and
TimescaleDB as a PostgreSQL extension (D) for enhanced time-series performance. Oracle
Database and Microsoft SQL Server are not supported backends for Zabbix Server. TimescaleDB
provides hypertable partitioning, native compression (up to 90% disk savings), and continuous
aggregation for trends data, making it the recommended choice for large-scale deployments.
