Zabbix Certified Specialist Exam (Version 2) Question
Bank (Latest 2026/2027 Edition) – Questions, Answers &
Detailed Rationales
──────────────────────────────
SECTION 1: ZABBIX ARCHITECTURE AND DEPLOYMENT
──────────────────────────────
Question 1
A systems engineer is designing a Zabbix monitoring infrastructure for a global
enterprise with 50,000 monitored devices across three continents. The requirement
specifies sub-second data collection for critical network devices and historical data
retention of three years. Which architecture best meets these requirements?
A. Single Zabbix server with default MySQL configuration and passive agents only
B. Distributed Zabbix proxy deployment with active agents, TimescaleDB partitioning,
and separate history/trends storage
C. Single Zabbix server with SQLite backend and aggressive housekeeper settings
D. Zabbix proxy-only deployment without a central server for autonomous regional
operation
Correct Answer:
B — Distributed Zabbix proxy deployment with active agents, TimescaleDB partitioning,
and separate history/trends storage
Rationale:
A distributed proxy architecture with active agents reduces WAN latency and server load
for global deployments. TimescaleDB provides hypertable partitioning for efficient
time-series storage and compression, supporting three-year retention. Single-server
architectures cannot scale to 50,000 devices. SQLite is unsuitable for production scale.
Proxy-only deployments lack centralized management and correlation capabilities.
,Question 2
An organization is migrating from Zabbix 6.0 LTS to Zabbix 7.0 LTS. The database
administrator reports that the upgrade script has been executed successfully, but the
frontend displays a version mismatch error. Which step was most likely omitted?
A. The Zabbix server binary was not restarted after the database upgrade
B. The PHP opcache was not cleared after updating the frontend files
C. The Zabbix proxy configuration files were not updated simultaneously
D. The database user privileges were not granted for the new schema tables
Correct Answer:
B — The PHP opcache was not cleared after updating the frontend files
Rationale:
The Zabbix frontend caches PHP files in opcache; failure to clear or restart the web
server after frontend updates causes persistent version mismatch errors between the
cached frontend and upgraded database schema. While server restart is necessary, the
version mismatch specifically indicates frontend caching. Proxy updates are
independent of server-frontend version checks. Database privileges would cause
connection errors, not version mismatches.
Question 3
A Zabbix administrator needs to monitor Docker containers on a host without installing
the Zabbix agent directly on each container. Which monitoring approach is most
appropriate?
A. Install Zabbix agent2 on the Docker host and use the Docker plugin with the
docker.by_item key
B. Deploy passive Zabbix agents inside each container with host network mode
C. Use the Zabbix agent classic with UserParameter scripts calling docker exec
D. Monitor containers exclusively through SNMP traps from the Docker daemon
,Correct Answer:
A — Install Zabbix agent2 on the Docker host and use the Docker plugin with the
docker.by_item key
Rationale:
Zabbix agent2 includes native Docker plugin support that discovers and monitors
containers from the host without per-container agent installation, using the Docker API.
Passive agents in each container create unnecessary overhead and network complexity.
UserParameter scripts are less efficient and harder to maintain than native plugins.
Docker daemon does not emit SNMP traps natively.
Question 4
An enterprise requires high availability for its Zabbix monitoring infrastructure with
automatic failover and no single point of failure. Which configuration satisfies these
requirements?
A. Active-passive Zabbix server pair with shared database on a single node
B. Active-active Zabbix server cluster with Galera Cluster for synchronous database
replication and HAProxy for frontend load balancing
C. Two independent Zabbix servers with asynchronous database replication and manual
failover procedures
D. Single Zabbix server with RAID 10 storage and nightly database backups
Correct Answer:
B — Active-active Zabbix server cluster with Galera Cluster for synchronous database
replication and HAProxy for frontend load balancing
Rationale:
Zabbix 7.0 supports native active-active server clustering with frontend load balancing.
Galera Cluster provides synchronous multi-master database replication, ensuring data
consistency across nodes. HAProxy distributes frontend connections. Active-passive
configurations have failover delays. Independent servers with manual failover do not
, meet automatic failover requirements. Single servers with RAID remain single points of
failure.
Question 5
A security audit requires that all Zabbix agent-to-server communications use
certificate-based authentication with TLS 1.3. Which configuration is necessary on the
Zabbix agent?
A. TLSConnect=psk and TLSPSKIdentity=shared_secret
B. TLSConnect=cert and TLSCAFile=/path/to/ca.crt with TLSCertFile and TLSKeyFile
C. TLSConnect=unencrypted and rely on IPsec tunneling between agent and server
D. TLSConnect=psk with TLSPSKFile containing a 2048-bit RSA key
Correct Answer:
B — TLSConnect=cert and TLSCAFile=/path/to/ca.crt with TLSCertFile and TLSKeyFile
Rationale:
Certificate-based authentication requires TLSConnect=cert, TLSCAFile pointing to the
CA certificate, and TLSCertFile/TLSKeyFile for the agent's certificate and private key.
PSK (pre-shared key) uses symmetric encryption, not certificates. Unencrypted
connections violate security requirements. PSK files contain symmetric keys, not RSA
certificates.
Question 6
A Zabbix administrator notices that the housekeeper process is consuming excessive
CPU and causing database lock contention during peak hours. Which optimization
strategy is most effective?
A. Disable the housekeeper entirely and rely on manual database truncation
B. Enable TimescaleDB compression and partitioning, and adjust
HousekeepingFrequency to run during off-peak hours
C. Increase the history storage period to 10 years to reduce deletion frequency
Bank (Latest 2026/2027 Edition) – Questions, Answers &
Detailed Rationales
──────────────────────────────
SECTION 1: ZABBIX ARCHITECTURE AND DEPLOYMENT
──────────────────────────────
Question 1
A systems engineer is designing a Zabbix monitoring infrastructure for a global
enterprise with 50,000 monitored devices across three continents. The requirement
specifies sub-second data collection for critical network devices and historical data
retention of three years. Which architecture best meets these requirements?
A. Single Zabbix server with default MySQL configuration and passive agents only
B. Distributed Zabbix proxy deployment with active agents, TimescaleDB partitioning,
and separate history/trends storage
C. Single Zabbix server with SQLite backend and aggressive housekeeper settings
D. Zabbix proxy-only deployment without a central server for autonomous regional
operation
Correct Answer:
B — Distributed Zabbix proxy deployment with active agents, TimescaleDB partitioning,
and separate history/trends storage
Rationale:
A distributed proxy architecture with active agents reduces WAN latency and server load
for global deployments. TimescaleDB provides hypertable partitioning for efficient
time-series storage and compression, supporting three-year retention. Single-server
architectures cannot scale to 50,000 devices. SQLite is unsuitable for production scale.
Proxy-only deployments lack centralized management and correlation capabilities.
,Question 2
An organization is migrating from Zabbix 6.0 LTS to Zabbix 7.0 LTS. The database
administrator reports that the upgrade script has been executed successfully, but the
frontend displays a version mismatch error. Which step was most likely omitted?
A. The Zabbix server binary was not restarted after the database upgrade
B. The PHP opcache was not cleared after updating the frontend files
C. The Zabbix proxy configuration files were not updated simultaneously
D. The database user privileges were not granted for the new schema tables
Correct Answer:
B — The PHP opcache was not cleared after updating the frontend files
Rationale:
The Zabbix frontend caches PHP files in opcache; failure to clear or restart the web
server after frontend updates causes persistent version mismatch errors between the
cached frontend and upgraded database schema. While server restart is necessary, the
version mismatch specifically indicates frontend caching. Proxy updates are
independent of server-frontend version checks. Database privileges would cause
connection errors, not version mismatches.
Question 3
A Zabbix administrator needs to monitor Docker containers on a host without installing
the Zabbix agent directly on each container. Which monitoring approach is most
appropriate?
A. Install Zabbix agent2 on the Docker host and use the Docker plugin with the
docker.by_item key
B. Deploy passive Zabbix agents inside each container with host network mode
C. Use the Zabbix agent classic with UserParameter scripts calling docker exec
D. Monitor containers exclusively through SNMP traps from the Docker daemon
,Correct Answer:
A — Install Zabbix agent2 on the Docker host and use the Docker plugin with the
docker.by_item key
Rationale:
Zabbix agent2 includes native Docker plugin support that discovers and monitors
containers from the host without per-container agent installation, using the Docker API.
Passive agents in each container create unnecessary overhead and network complexity.
UserParameter scripts are less efficient and harder to maintain than native plugins.
Docker daemon does not emit SNMP traps natively.
Question 4
An enterprise requires high availability for its Zabbix monitoring infrastructure with
automatic failover and no single point of failure. Which configuration satisfies these
requirements?
A. Active-passive Zabbix server pair with shared database on a single node
B. Active-active Zabbix server cluster with Galera Cluster for synchronous database
replication and HAProxy for frontend load balancing
C. Two independent Zabbix servers with asynchronous database replication and manual
failover procedures
D. Single Zabbix server with RAID 10 storage and nightly database backups
Correct Answer:
B — Active-active Zabbix server cluster with Galera Cluster for synchronous database
replication and HAProxy for frontend load balancing
Rationale:
Zabbix 7.0 supports native active-active server clustering with frontend load balancing.
Galera Cluster provides synchronous multi-master database replication, ensuring data
consistency across nodes. HAProxy distributes frontend connections. Active-passive
configurations have failover delays. Independent servers with manual failover do not
, meet automatic failover requirements. Single servers with RAID remain single points of
failure.
Question 5
A security audit requires that all Zabbix agent-to-server communications use
certificate-based authentication with TLS 1.3. Which configuration is necessary on the
Zabbix agent?
A. TLSConnect=psk and TLSPSKIdentity=shared_secret
B. TLSConnect=cert and TLSCAFile=/path/to/ca.crt with TLSCertFile and TLSKeyFile
C. TLSConnect=unencrypted and rely on IPsec tunneling between agent and server
D. TLSConnect=psk with TLSPSKFile containing a 2048-bit RSA key
Correct Answer:
B — TLSConnect=cert and TLSCAFile=/path/to/ca.crt with TLSCertFile and TLSKeyFile
Rationale:
Certificate-based authentication requires TLSConnect=cert, TLSCAFile pointing to the
CA certificate, and TLSCertFile/TLSKeyFile for the agent's certificate and private key.
PSK (pre-shared key) uses symmetric encryption, not certificates. Unencrypted
connections violate security requirements. PSK files contain symmetric keys, not RSA
certificates.
Question 6
A Zabbix administrator notices that the housekeeper process is consuming excessive
CPU and causing database lock contention during peak hours. Which optimization
strategy is most effective?
A. Disable the housekeeper entirely and rely on manual database truncation
B. Enable TimescaleDB compression and partitioning, and adjust
HousekeepingFrequency to run during off-peak hours
C. Increase the history storage period to 10 years to reduce deletion frequency
