Zabbix Certified Specialist Exam (Version 4) Question
Bank (Latest 2026/2027 Edition) – Questions, Answers &
Detailed Rationales
──────────────────────────────
SECTION 1: Zabbix Architecture and High Availability
──────────────────────────────
Question 1
A multinational corporation requires monitoring 50,000 devices across 12 regional
offices with varying network reliability. The central Zabbix server must maintain
operational visibility even when regional WAN links experience intermittent outages.
Which architectural design best ensures continuous monitoring and data integrity?
A. Deploy Zabbix proxies in active mode at each regional office with local SQLite
databases, enabling store-and-forward buffering during WAN outages
B. Install independent Zabbix servers at each regional office with manual database
synchronization scripts running hourly
C. Configure all devices to use Zabbix Agent 2 in active mode with 72-hour data
buffering and direct server connection over VPN tunnels
D. Implement a single centralized Zabbix server with 10 Gbps dedicated WAN links and
no regional infrastructure
Correct Answer:
A — Deploy Zabbix proxies in active mode at each regional office with local SQLite
databases, enabling store-and-forward buffering during WAN outages
Rationale:
Zabbix proxies in active mode with local SQLite databases buffer data during
connectivity interruptions and forward it when connectivity resumes, ensuring no data
,loss. Option B creates fragmented monitoring islands with synchronization challenges.
Option C concentrates all network risk on VPN tunnel stability. Option D fails completely
during any WAN outage.
Question 2
In a Zabbix 7.0 high-availability configuration with three server nodes, which shared
component is absolutely required for all nodes to function correctly?
A. A single shared database instance accessible by all HA nodes with identical
connection parameters
B. Individual local databases on each node synchronized via custom replication scripts
C. Separate configuration files with unique NodeID values and independent database
schemas
D. Local filesystem storage for each node's history data without database sharing
Correct Answer:
A — A single shared database instance accessible by all HA nodes with identical
connection parameters
Rationale:
Zabbix HA requires all nodes to connect to the same database instance with identical
zabbix_server.conf parameters (DBHost, DBName, DBUser, DBPassword). Option B
would create data inconsistency. Option C describes non-HA independent servers.
Option D is architecturally impossible for Zabbix server operation.
Question 3
A Zabbix administrator is designing a monitoring infrastructure for a cloud-native
environment with 25,000 ephemeral containers. Which component is most critical for
handling the dynamic nature of these short-lived monitoring targets?
A. Zabbix agent 2 with active auto-registration and aggressive host removal policies for
terminated containers
,B. Static host configuration with manual IP address updates every 15 minutes
C. SNMPv3 polling with community string rotation for each container deployment
D. Passive agent checks with fixed server IP lists and no auto-registration capability
Correct Answer:
A — Zabbix agent 2 with active auto-registration and aggressive host removal policies
for terminated containers
Rationale:
Container environments require dynamic discovery and cleanup; Zabbix agent 2
auto-registration with HostMetadata and action-based host removal handles ephemeral
workloads. Option B is impossible at container scale. Option C introduces unnecessary
complexity and security rotation overhead. Option D cannot adapt to dynamic container
IP assignments.
Question 4
Which Zabbix server process is responsible for executing scheduled checks and
ensuring items are polled at their configured intervals?
A. The timer process managing time-based trigger calculations and scheduled item
polling
B. The poller process handling all passive agent and simple check requests
C. The trapper process receiving active agent and incoming trap data
D. The self-monitoring process tracking internal server performance metrics
Correct Answer:
A — The timer process managing time-based trigger calculations and scheduled item
polling
Rationale:
The timer process handles time-based functions including nodata() triggers, scheduled
checks, and ensuring items are evaluated at proper intervals. The poller process (Option
, B) executes checks but does not schedule them. The trapper process (Option C)
receives incoming data. The self-monitoring process (Option D) tracks internal metrics.
Question 5
A Zabbix proxy is configured to monitor a DMZ network segment with 800 devices. The
proxy must operate without any inbound connections from the corporate network.
Which proxy configuration parameter ensures this security posture?
A. ProxyMode=1 (active mode) with Server configured to point to the central Zabbix
server IP
B. ProxyMode=0 (passive mode) with Server configured to accept connections from the
central server
C. StartTrappers=0 to disable all incoming data reception on the proxy
D. TLSConnect=unencrypted to simplify firewall rule configuration
Correct Answer:
A — ProxyMode=1 (active mode) with Server configured to point to the central Zabbix
server IP
Rationale:
ProxyMode=1 (active) configures the proxy to initiate all connections to the central
server, requiring no inbound firewall rules. Option B requires inbound connections from
the server. Option C disables trapper functionality but does not change proxy
connection direction. Option D creates a security vulnerability.
Question 6
Which database configuration is most appropriate for a Zabbix 7.0 server handling
100,000 new values per second with 1-year data retention?
A. PostgreSQL 16 with partitioning by time range, TimescaleDB extension, and
dedicated NVMe storage for tablespaces
B. MySQL 5.7 with MyISAM storage engine and standard HDD configuration
Bank (Latest 2026/2027 Edition) – Questions, Answers &
Detailed Rationales
──────────────────────────────
SECTION 1: Zabbix Architecture and High Availability
──────────────────────────────
Question 1
A multinational corporation requires monitoring 50,000 devices across 12 regional
offices with varying network reliability. The central Zabbix server must maintain
operational visibility even when regional WAN links experience intermittent outages.
Which architectural design best ensures continuous monitoring and data integrity?
A. Deploy Zabbix proxies in active mode at each regional office with local SQLite
databases, enabling store-and-forward buffering during WAN outages
B. Install independent Zabbix servers at each regional office with manual database
synchronization scripts running hourly
C. Configure all devices to use Zabbix Agent 2 in active mode with 72-hour data
buffering and direct server connection over VPN tunnels
D. Implement a single centralized Zabbix server with 10 Gbps dedicated WAN links and
no regional infrastructure
Correct Answer:
A — Deploy Zabbix proxies in active mode at each regional office with local SQLite
databases, enabling store-and-forward buffering during WAN outages
Rationale:
Zabbix proxies in active mode with local SQLite databases buffer data during
connectivity interruptions and forward it when connectivity resumes, ensuring no data
,loss. Option B creates fragmented monitoring islands with synchronization challenges.
Option C concentrates all network risk on VPN tunnel stability. Option D fails completely
during any WAN outage.
Question 2
In a Zabbix 7.0 high-availability configuration with three server nodes, which shared
component is absolutely required for all nodes to function correctly?
A. A single shared database instance accessible by all HA nodes with identical
connection parameters
B. Individual local databases on each node synchronized via custom replication scripts
C. Separate configuration files with unique NodeID values and independent database
schemas
D. Local filesystem storage for each node's history data without database sharing
Correct Answer:
A — A single shared database instance accessible by all HA nodes with identical
connection parameters
Rationale:
Zabbix HA requires all nodes to connect to the same database instance with identical
zabbix_server.conf parameters (DBHost, DBName, DBUser, DBPassword). Option B
would create data inconsistency. Option C describes non-HA independent servers.
Option D is architecturally impossible for Zabbix server operation.
Question 3
A Zabbix administrator is designing a monitoring infrastructure for a cloud-native
environment with 25,000 ephemeral containers. Which component is most critical for
handling the dynamic nature of these short-lived monitoring targets?
A. Zabbix agent 2 with active auto-registration and aggressive host removal policies for
terminated containers
,B. Static host configuration with manual IP address updates every 15 minutes
C. SNMPv3 polling with community string rotation for each container deployment
D. Passive agent checks with fixed server IP lists and no auto-registration capability
Correct Answer:
A — Zabbix agent 2 with active auto-registration and aggressive host removal policies
for terminated containers
Rationale:
Container environments require dynamic discovery and cleanup; Zabbix agent 2
auto-registration with HostMetadata and action-based host removal handles ephemeral
workloads. Option B is impossible at container scale. Option C introduces unnecessary
complexity and security rotation overhead. Option D cannot adapt to dynamic container
IP assignments.
Question 4
Which Zabbix server process is responsible for executing scheduled checks and
ensuring items are polled at their configured intervals?
A. The timer process managing time-based trigger calculations and scheduled item
polling
B. The poller process handling all passive agent and simple check requests
C. The trapper process receiving active agent and incoming trap data
D. The self-monitoring process tracking internal server performance metrics
Correct Answer:
A — The timer process managing time-based trigger calculations and scheduled item
polling
Rationale:
The timer process handles time-based functions including nodata() triggers, scheduled
checks, and ensuring items are evaluated at proper intervals. The poller process (Option
, B) executes checks but does not schedule them. The trapper process (Option C)
receives incoming data. The self-monitoring process (Option D) tracks internal metrics.
Question 5
A Zabbix proxy is configured to monitor a DMZ network segment with 800 devices. The
proxy must operate without any inbound connections from the corporate network.
Which proxy configuration parameter ensures this security posture?
A. ProxyMode=1 (active mode) with Server configured to point to the central Zabbix
server IP
B. ProxyMode=0 (passive mode) with Server configured to accept connections from the
central server
C. StartTrappers=0 to disable all incoming data reception on the proxy
D. TLSConnect=unencrypted to simplify firewall rule configuration
Correct Answer:
A — ProxyMode=1 (active mode) with Server configured to point to the central Zabbix
server IP
Rationale:
ProxyMode=1 (active) configures the proxy to initiate all connections to the central
server, requiring no inbound firewall rules. Option B requires inbound connections from
the server. Option C disables trapper functionality but does not change proxy
connection direction. Option D creates a security vulnerability.
Question 6
Which database configuration is most appropriate for a Zabbix 7.0 server handling
100,000 new values per second with 1-year data retention?
A. PostgreSQL 16 with partitioning by time range, TimescaleDB extension, and
dedicated NVMe storage for tablespaces
B. MySQL 5.7 with MyISAM storage engine and standard HDD configuration
