Zabbix Certified Specialist Exam (4)
(2026/2027 Update) Questions and Verified
Answers | Grade A
EXAM OVERVIEW
Total Questions: EXACTLY 50
Table
Domain Question Count Format Distribution
1. High Availability (HA) & Platform Resiliency 10 6 MC, 3 SATA, 1 T/F
2. Advanced Dashboards & Widget Configuration 12 7 MC, 4 SATA, 1 T/F
3. Scheduled Reporting & Compliance Auditing 10 6 MC, 3 SATA, 1 T/F
4. Business Service Monitoring & SLA Metrics 8 5 MC, 2 SATA, 1 T/F
5. Platform Security & TLS/PSK Encryption 10 6 MC, 3 SATA, 1 T/F
TOTAL 50 30 MC, 15 SATA, 5 T/F
DOMAIN 1: HIGH AVAILABILITY (HA) & PLATFORM RESILIENCY
(10 Questions)
Sub-Topic 1.1: HA Cluster Node Roles (4 Questions)
,Question 1 (Multiple Choice)
In a native Zabbix Server HA cluster, which process is responsible for monitoring the
health of the active node and initiating failover to a standby node?
A) zabbix_server: configuration syncer B) zabbix_server: ha manager C) zabbix_server:
service manager D) zabbix_server: alert manager
Answer: B) zabbix_server: ha manager
Rationale [CORRECT]: The ha_manager process runs on every HA cluster node (both
active and standby) and is responsible for checking the high availability node status in
the database every 5 seconds. It monitors the active node's heartbeat and initiates
takeover if the active node fails to update its status within the configured failover delay.
This process is the core of Zabbix's native HA failover logic, ensuring automatic
detection of node failures and seamless transition to standby nodes without external
orchestration tools.
Question 2 (Multiple Choice)
A Zabbix administrator has configured a three-node HA cluster. Node A is active, Node
B is in standby, and Node C has been shut down gracefully. What is the status of Node C
in the cluster?
A) Unavailable B) Stopped C) Offline D) Decommissioned
Answer: B) Stopped
Rationale [CORRECT]: When an HA node is shut down gracefully, it reports its status as
"stopped" (status code 1) to the database before terminating. This is distinct from
"unavailable" (status code 2), which is assigned when a node is lost without a proper
shutdown signal. The "stopped" status allows the remaining standby node to take over
within 5 seconds, whereas an "unavailable" node triggers the failover delay (default 60
seconds) plus 5 seconds before takeover occurs.
Question 3 (Select-All-That-Apply)
,Which of the following statements accurately describe the roles of nodes in a Zabbix
native HA cluster? (Select all that apply.)
A) Only one node can be active at any given time. B) Standby nodes perform data
collection and processing at reduced capacity. C) The active node runs all standard
Zabbix server processes including pollers, trappers, and history syncers. D) Standby
nodes update their last access time in the database every 5 seconds. E) A standby node
listens on port 10051 for incoming agent connections.
Answer: A, C, D
Rationale [CORRECT]: In Zabbix native HA, only one node is active at a time (A). The
active node runs all standard server processes including data collectors, pollers,
trappers, and history syncers (C). Both active and standby nodes update their last access
time every 5 seconds (D). Standby nodes do NOT perform data collection or processing
(B is incorrect) — they run only the ha_manager process. Standby nodes do not listen on
any ports (E is incorrect) — only the active node listens on port 10051 for agent and
proxy connections.
Question 4 (True/False)
In a Zabbix HA cluster, the NodeAddress parameter in zabbix_server.conf is used by the
Zabbix frontend to determine which active node to connect to, and it must match the IP
or FQDN of the server node.
Answer: TRUE
Rationale [CORRECT]: The NodeAddress parameter specifies the IP or hostname that the
frontend uses to connect to the active node. Without this parameter, the frontend
cannot display status, queue information, or other real-time data from the active server.
The frontend autodetects the active node by reading settings from the ha_node table in
the Zabbix database, and uses the NodeAddress of the active node for all connections.
This parameter is critical for frontend functionality in HA mode.
, Sub-Topic 1.2: Failover Trigger Conditions (3 Questions)
Question 5 (Multiple Choice)
An active Zabbix HA node crashes unexpectedly without being able to update its status
in the database. The failover delay is set to the default value. How long will it take for a
standby node to take over?
A) 5 seconds B) 60 seconds C) 65 seconds D) 120 seconds
Answer: C) 65 seconds
Rationale [CORRECT]: When the active node crashes without updating its status,
standby nodes monitor the active node's last access time. The default failover delay is 60
seconds. Standby nodes check the active node status every 5 seconds. Therefore, the
standby node will wait for the failover delay (60s) plus one check interval (5s) to confirm
the active node is truly unavailable before initiating takeover. If the node shuts down
gracefully and reports "stopped" status, takeover occurs within 5 seconds.
Question 6 (Select-All-That-Apply)
Which of the following conditions will trigger an automatic failover in a Zabbix native
HA cluster? (Select all that apply.)
A) The active node's zabbix_server process is killed with kill -9. B) An administrator
executes zabbix_server -R ha_remove_node on the active node. C) The active node
loses database connectivity for more than failover_delay - 5 seconds. D) An
administrator gracefully stops the active node using systemctl stop zabbix-server. E)
The active node's disk reaches 100% utilization.
Answer: A, C, D, E
Rationale [CORRECT]: Automatic failover triggers when: (A) the active node process
crashes unexpectedly (cannot update status); (C) the active node loses database
connectivity for more than failover_delay - 5 seconds (the active node self-monitors
and will stop processing); (D) graceful shutdown reports "stopped" status, triggering
(2026/2027 Update) Questions and Verified
Answers | Grade A
EXAM OVERVIEW
Total Questions: EXACTLY 50
Table
Domain Question Count Format Distribution
1. High Availability (HA) & Platform Resiliency 10 6 MC, 3 SATA, 1 T/F
2. Advanced Dashboards & Widget Configuration 12 7 MC, 4 SATA, 1 T/F
3. Scheduled Reporting & Compliance Auditing 10 6 MC, 3 SATA, 1 T/F
4. Business Service Monitoring & SLA Metrics 8 5 MC, 2 SATA, 1 T/F
5. Platform Security & TLS/PSK Encryption 10 6 MC, 3 SATA, 1 T/F
TOTAL 50 30 MC, 15 SATA, 5 T/F
DOMAIN 1: HIGH AVAILABILITY (HA) & PLATFORM RESILIENCY
(10 Questions)
Sub-Topic 1.1: HA Cluster Node Roles (4 Questions)
,Question 1 (Multiple Choice)
In a native Zabbix Server HA cluster, which process is responsible for monitoring the
health of the active node and initiating failover to a standby node?
A) zabbix_server: configuration syncer B) zabbix_server: ha manager C) zabbix_server:
service manager D) zabbix_server: alert manager
Answer: B) zabbix_server: ha manager
Rationale [CORRECT]: The ha_manager process runs on every HA cluster node (both
active and standby) and is responsible for checking the high availability node status in
the database every 5 seconds. It monitors the active node's heartbeat and initiates
takeover if the active node fails to update its status within the configured failover delay.
This process is the core of Zabbix's native HA failover logic, ensuring automatic
detection of node failures and seamless transition to standby nodes without external
orchestration tools.
Question 2 (Multiple Choice)
A Zabbix administrator has configured a three-node HA cluster. Node A is active, Node
B is in standby, and Node C has been shut down gracefully. What is the status of Node C
in the cluster?
A) Unavailable B) Stopped C) Offline D) Decommissioned
Answer: B) Stopped
Rationale [CORRECT]: When an HA node is shut down gracefully, it reports its status as
"stopped" (status code 1) to the database before terminating. This is distinct from
"unavailable" (status code 2), which is assigned when a node is lost without a proper
shutdown signal. The "stopped" status allows the remaining standby node to take over
within 5 seconds, whereas an "unavailable" node triggers the failover delay (default 60
seconds) plus 5 seconds before takeover occurs.
Question 3 (Select-All-That-Apply)
,Which of the following statements accurately describe the roles of nodes in a Zabbix
native HA cluster? (Select all that apply.)
A) Only one node can be active at any given time. B) Standby nodes perform data
collection and processing at reduced capacity. C) The active node runs all standard
Zabbix server processes including pollers, trappers, and history syncers. D) Standby
nodes update their last access time in the database every 5 seconds. E) A standby node
listens on port 10051 for incoming agent connections.
Answer: A, C, D
Rationale [CORRECT]: In Zabbix native HA, only one node is active at a time (A). The
active node runs all standard server processes including data collectors, pollers,
trappers, and history syncers (C). Both active and standby nodes update their last access
time every 5 seconds (D). Standby nodes do NOT perform data collection or processing
(B is incorrect) — they run only the ha_manager process. Standby nodes do not listen on
any ports (E is incorrect) — only the active node listens on port 10051 for agent and
proxy connections.
Question 4 (True/False)
In a Zabbix HA cluster, the NodeAddress parameter in zabbix_server.conf is used by the
Zabbix frontend to determine which active node to connect to, and it must match the IP
or FQDN of the server node.
Answer: TRUE
Rationale [CORRECT]: The NodeAddress parameter specifies the IP or hostname that the
frontend uses to connect to the active node. Without this parameter, the frontend
cannot display status, queue information, or other real-time data from the active server.
The frontend autodetects the active node by reading settings from the ha_node table in
the Zabbix database, and uses the NodeAddress of the active node for all connections.
This parameter is critical for frontend functionality in HA mode.
, Sub-Topic 1.2: Failover Trigger Conditions (3 Questions)
Question 5 (Multiple Choice)
An active Zabbix HA node crashes unexpectedly without being able to update its status
in the database. The failover delay is set to the default value. How long will it take for a
standby node to take over?
A) 5 seconds B) 60 seconds C) 65 seconds D) 120 seconds
Answer: C) 65 seconds
Rationale [CORRECT]: When the active node crashes without updating its status,
standby nodes monitor the active node's last access time. The default failover delay is 60
seconds. Standby nodes check the active node status every 5 seconds. Therefore, the
standby node will wait for the failover delay (60s) plus one check interval (5s) to confirm
the active node is truly unavailable before initiating takeover. If the node shuts down
gracefully and reports "stopped" status, takeover occurs within 5 seconds.
Question 6 (Select-All-That-Apply)
Which of the following conditions will trigger an automatic failover in a Zabbix native
HA cluster? (Select all that apply.)
A) The active node's zabbix_server process is killed with kill -9. B) An administrator
executes zabbix_server -R ha_remove_node on the active node. C) The active node
loses database connectivity for more than failover_delay - 5 seconds. D) An
administrator gracefully stops the active node using systemctl stop zabbix-server. E)
The active node's disk reaches 100% utilization.
Answer: A, C, D, E
Rationale [CORRECT]: Automatic failover triggers when: (A) the active node process
crashes unexpectedly (cannot update status); (C) the active node loses database
connectivity for more than failover_delay - 5 seconds (the active node self-monitors
and will stop processing); (D) graceful shutdown reports "stopped" status, triggering
