Zabbix Certified Specialist - Observability &
Automation Platform - Complete Certification
Guide 2026/2027
Exam 5/5 | Mastery Level | 50 Next-Gen Scenario Questions
Domain 1 – Predictive Analytics & Anomaly Detection (12 Q)
Q1. Your e-commerce platform’s checkout latency SLO is 300 ms. Every Friday 20:00
traffic spikes 4×. You must open a scaling ticket before latency breaches 250 ms. Which
integrated solution predicts the breach 10 min early?
A. Static trigger {Checkout:api.latency.last()}>250
B. Calculated item avg(//api.latency,5m) + trigger >250
C. Dependent item → JavaScript (Holt-Winters) → forecast(10m,250) → trigger on
forecast breach
D. Export data to Grafana → alert via webhook
Answer: C
Rationale: C leverages Zabbix-native preprocessing (Holt-Winters) and forecast() for
predictive alerting inside the platform. A is reactive; B is smoothed but still lagging; D
externalizes the logic, fragmenting the observability stack.
Q2. A microservice emits no metric during idle. You must detect anomalous zero at
03:00 when zero is normal. Best native approach:
,A. nodata(5m)=1
B. band(api.calls,1h,0,0) + time shift 03:00-04:00
C. forecast() with fit=1h and deviation=3
D. change(0)=0
Answer: C
Rationale: forecast() learns historical pattern (including nightly zeros) and flags
deviation outside 3-sigma band. A fires every night; B is manual band; D fires on any
flatline.
Q3. You need per-customer anomaly on error rate (1k customers). Which design scales
inside Zabbix?
A. 1k calculated items using foreach + band()
B. Prometheus exporter histogram + histogram_quantile
C. LLD rule → customer prototype → band() trigger
D. Export to Kafka → Flink ML → alert back via sender
Answer: C
Rationale: LLD keeps anomaly logic inside Zabbix and scales horizontally. A creates 1k
heavy items; B externalizes; D is complex pipeline.
Q4. A seasonal metric (daily+weekly) needs dynamic threshold. Which preprocessing
first?
, A. JavaScript: deseasonalize = value -
forecast(//metric,1d,fit=1w)
B. Regex: @^\d+@RESULT@value
C. Prometheus pattern
D. CSV to JSON
Answer: A
Rationale: Deseasonalization enables fixed-band anomaly on residual. Others are
parsing steps.
Q5. You want 95 %ile forecast for disk usage 7 days ahead. Which formula?
A. forecast(//vfs.fs.size[pused],7d,95)
B. percentile(//vfs.fs.size[pused],7d,95)
C. timeleft(//vfs.fs.size[pused],7d,95)
D. band(//vfs.fs.size[pused],7d,95)
Answer: A
Rationale: forecast() accepts percentile parameter. B is historical percentile; C
estimates time to threshold; D is static band.
Q6. A microservice emits Prometheus histogram. You need forecast on 99.9 %ile. Steps:
A. Prometheus pattern → histogram_quantile → forecast()
B. JSONPath → percentile(99.9) → band()
Automation Platform - Complete Certification
Guide 2026/2027
Exam 5/5 | Mastery Level | 50 Next-Gen Scenario Questions
Domain 1 – Predictive Analytics & Anomaly Detection (12 Q)
Q1. Your e-commerce platform’s checkout latency SLO is 300 ms. Every Friday 20:00
traffic spikes 4×. You must open a scaling ticket before latency breaches 250 ms. Which
integrated solution predicts the breach 10 min early?
A. Static trigger {Checkout:api.latency.last()}>250
B. Calculated item avg(//api.latency,5m) + trigger >250
C. Dependent item → JavaScript (Holt-Winters) → forecast(10m,250) → trigger on
forecast breach
D. Export data to Grafana → alert via webhook
Answer: C
Rationale: C leverages Zabbix-native preprocessing (Holt-Winters) and forecast() for
predictive alerting inside the platform. A is reactive; B is smoothed but still lagging; D
externalizes the logic, fragmenting the observability stack.
Q2. A microservice emits no metric during idle. You must detect anomalous zero at
03:00 when zero is normal. Best native approach:
,A. nodata(5m)=1
B. band(api.calls,1h,0,0) + time shift 03:00-04:00
C. forecast() with fit=1h and deviation=3
D. change(0)=0
Answer: C
Rationale: forecast() learns historical pattern (including nightly zeros) and flags
deviation outside 3-sigma band. A fires every night; B is manual band; D fires on any
flatline.
Q3. You need per-customer anomaly on error rate (1k customers). Which design scales
inside Zabbix?
A. 1k calculated items using foreach + band()
B. Prometheus exporter histogram + histogram_quantile
C. LLD rule → customer prototype → band() trigger
D. Export to Kafka → Flink ML → alert back via sender
Answer: C
Rationale: LLD keeps anomaly logic inside Zabbix and scales horizontally. A creates 1k
heavy items; B externalizes; D is complex pipeline.
Q4. A seasonal metric (daily+weekly) needs dynamic threshold. Which preprocessing
first?
, A. JavaScript: deseasonalize = value -
forecast(//metric,1d,fit=1w)
B. Regex: @^\d+@RESULT@value
C. Prometheus pattern
D. CSV to JSON
Answer: A
Rationale: Deseasonalization enables fixed-band anomaly on residual. Others are
parsing steps.
Q5. You want 95 %ile forecast for disk usage 7 days ahead. Which formula?
A. forecast(//vfs.fs.size[pused],7d,95)
B. percentile(//vfs.fs.size[pused],7d,95)
C. timeleft(//vfs.fs.size[pused],7d,95)
D. band(//vfs.fs.size[pused],7d,95)
Answer: A
Rationale: forecast() accepts percentile parameter. B is historical percentile; C
estimates time to threshold; D is static band.
Q6. A microservice emits Prometheus histogram. You need forecast on 99.9 %ile. Steps:
A. Prometheus pattern → histogram_quantile → forecast()
B. JSONPath → percentile(99.9) → band()
