ZABBIX CERTIFIED SPECIALIST EXAM 2 2026/2027
| 150 Questions | Grade A | Pass Guaranteed - A+
Graded
SECTION 1: Zabbix Architecture & Data Flow (Q1-Q18)
Q1: Which default TCP port does the Zabbix Agent listen on for passive checks?
A. 10051
B. 10050 [CORRECT]
C. 10052
D. 8080
Correct Answer: B
Rationale: The Zabbix Agent uses port 10050 for passive checks, while the Zabbix
Server uses port 10051 for incoming connections. Port 10052 is used by the Zabbix
Trapper, and 8080 is a common HTTP port unrelated to Zabbix Agent operations.
Q2: In the standard Zabbix data flow, which component directly writes collected item
values into the database?
A. Zabbix Frontend
B. Zabbix Proxy
C. Zabbix Server [CORRECT]
D. Zabbix Agent
Correct Answer: C
Rationale: The Zabbix Server is responsible for processing collected data and writing
history and trends into the database. The Frontend only displays data, the Proxy buffers
and forwards data, and the Agent only collects and sends data without database
access.
Q3: Which database backends are officially supported by Zabbix Server in production
deployments?
,A. MySQL, PostgreSQL, Oracle, MongoDB
B. MySQL, PostgreSQL, Oracle, SQLite [CORRECT]
C. MySQL, PostgreSQL, Oracle, Microsoft SQL Server
D. MySQL, PostgreSQL, Oracle, Redis
Correct Answer: B
Rationale: Zabbix Server officially supports MySQL, PostgreSQL, and Oracle for
production use. SQLite is supported only for Zabbix Proxy, not Server. MongoDB,
Microsoft SQL Server, and Redis are not supported database backends for Zabbix
Server.
Q4: What is the primary function of the Zabbix Trapper process?
A. To discover network devices automatically
B. To receive data sent by Zabbix Sender and active agents [CORRECT]
C. To execute remote commands on monitored hosts
D. To preprocess item values before storage
Correct Answer: B
Rationale: Trapper processes handle incoming connections from Zabbix Sender, active
agents, and proxies that push data to the server. Discovery is handled by Discoverer
processes, remote commands by task managers, and preprocessing by Preprocessor
processes.
Q5: Which component serves as the web interface for Zabbix administrators and
operators?
A. Zabbix Server
B. Zabbix Frontend [CORRECT]
C. Zabbix Proxy
D. Zabbix Agent
Correct Answer: B
Rationale: The Zabbix Frontend is the PHP-based web interface that provides
visualization, configuration, and reporting capabilities. The Server handles backend
processing, the Proxy handles distributed monitoring, and the Agent collects host
metrics.
Q6: In a standard Zabbix architecture, how does the Zabbix Server communicate with
passive Zabbix Agents?
,A. The Agent initiates connections to the Server on port 10051
B. The Server initiates connections to the Agent on port 10050 [CORRECT]
C. Both communicate through the Zabbix Proxy exclusively
D. Communication occurs via shared memory on the local host
Correct Answer: B
Rationale: In passive mode, the Zabbix Server actively connects to the Zabbix Agent on
port 10050 to request data. Active mode is the reverse: the Agent connects to the
Server on port 10051. Proxy is optional, and shared memory is not used for this
communication.
Q7: A Zabbix administrator notices that trigger events are being generated, but no
actions are executed. The action configuration appears correct. Which component
should be investigated first?
A. Zabbix Proxy buffer overflow
B. Zabbix Server escalator process [CORRECT]
C. Zabbix Agent timeout
D. Database replication lag
Correct Answer: B
Rationale: The Escalator process on the Zabbix Server is responsible for processing
actions and escalations. If events are generated but actions fail, the escalator may be
stalled or misconfigured. Proxy buffers affect data collection, agent timeouts affect
item collection, and replication lag affects data visibility but not action execution
directly.
Q8: An organization deploys Zabbix with 10,000 monitored items and observes that the
history syncer processes are constantly at 100% utilization. Which parameter should be
adjusted to resolve this bottleneck?
A. StartPollers
B. StartHistorySyncers [CORRECT]
C. StartTrappers
D. StartDiscoverers
Correct Answer: B
Rationale: StartHistorySyncers controls the number of processes responsible for writing
history data to the database. When history syncers are overloaded, increasing this
, parameter distributes the database write load. StartPollers handles active checks,
StartTrappers handles incoming data, and StartDiscoverers handles network discovery.
Q9: A company monitors remote branch offices with limited bandwidth. Which
architectural component should be deployed at each branch to minimize WAN traffic
while maintaining full monitoring capabilities?
A. Zabbix Sender
B. Zabbix Proxy [CORRECT]
C. Additional Zabbix Server
D. Zabbix Get
Correct Answer: B
Rationale: Zabbix Proxy collects data locally from agents and devices, stores it in a local
database, and forwards consolidated data to the central Server. This reduces WAN
traffic significantly compared to direct Server polling. Zabbix Sender only sends data, a
second Server creates data fragmentation, and Zabbix Get is a troubleshooting utility.
Q10: A Zabbix administrator observes that trends data is available for the past 6
months, but history data is only available for 30 days. Which configuration parameter
controls this behavior?
A. TrendCacheSize
B. HistoryStoragePeriod [CORRECT]
C. HousekeepingFrequency
D. CacheSize
Correct Answer: B
Rationale: HistoryStoragePeriod (or HousekeeperHistory in older versions) defines how
long raw history data is retained before being purged by the housekeeper. Trends are
aggregated and stored longer. TrendCacheSize affects memory caching, CacheSize
affects configuration cache, and HousekeepingFrequency controls how often cleanup
runs.
Q11: During a security audit, an administrator discovers that Zabbix Frontend sessions
are being transmitted over plain HTTP. Which architectural change is required to secure
these communications?
A. Enable Zabbix Agent encryption only
B. Configure TLS/SSL on the web server hosting Zabbix Frontend [CORRECT]
| 150 Questions | Grade A | Pass Guaranteed - A+
Graded
SECTION 1: Zabbix Architecture & Data Flow (Q1-Q18)
Q1: Which default TCP port does the Zabbix Agent listen on for passive checks?
A. 10051
B. 10050 [CORRECT]
C. 10052
D. 8080
Correct Answer: B
Rationale: The Zabbix Agent uses port 10050 for passive checks, while the Zabbix
Server uses port 10051 for incoming connections. Port 10052 is used by the Zabbix
Trapper, and 8080 is a common HTTP port unrelated to Zabbix Agent operations.
Q2: In the standard Zabbix data flow, which component directly writes collected item
values into the database?
A. Zabbix Frontend
B. Zabbix Proxy
C. Zabbix Server [CORRECT]
D. Zabbix Agent
Correct Answer: C
Rationale: The Zabbix Server is responsible for processing collected data and writing
history and trends into the database. The Frontend only displays data, the Proxy buffers
and forwards data, and the Agent only collects and sends data without database
access.
Q3: Which database backends are officially supported by Zabbix Server in production
deployments?
,A. MySQL, PostgreSQL, Oracle, MongoDB
B. MySQL, PostgreSQL, Oracle, SQLite [CORRECT]
C. MySQL, PostgreSQL, Oracle, Microsoft SQL Server
D. MySQL, PostgreSQL, Oracle, Redis
Correct Answer: B
Rationale: Zabbix Server officially supports MySQL, PostgreSQL, and Oracle for
production use. SQLite is supported only for Zabbix Proxy, not Server. MongoDB,
Microsoft SQL Server, and Redis are not supported database backends for Zabbix
Server.
Q4: What is the primary function of the Zabbix Trapper process?
A. To discover network devices automatically
B. To receive data sent by Zabbix Sender and active agents [CORRECT]
C. To execute remote commands on monitored hosts
D. To preprocess item values before storage
Correct Answer: B
Rationale: Trapper processes handle incoming connections from Zabbix Sender, active
agents, and proxies that push data to the server. Discovery is handled by Discoverer
processes, remote commands by task managers, and preprocessing by Preprocessor
processes.
Q5: Which component serves as the web interface for Zabbix administrators and
operators?
A. Zabbix Server
B. Zabbix Frontend [CORRECT]
C. Zabbix Proxy
D. Zabbix Agent
Correct Answer: B
Rationale: The Zabbix Frontend is the PHP-based web interface that provides
visualization, configuration, and reporting capabilities. The Server handles backend
processing, the Proxy handles distributed monitoring, and the Agent collects host
metrics.
Q6: In a standard Zabbix architecture, how does the Zabbix Server communicate with
passive Zabbix Agents?
,A. The Agent initiates connections to the Server on port 10051
B. The Server initiates connections to the Agent on port 10050 [CORRECT]
C. Both communicate through the Zabbix Proxy exclusively
D. Communication occurs via shared memory on the local host
Correct Answer: B
Rationale: In passive mode, the Zabbix Server actively connects to the Zabbix Agent on
port 10050 to request data. Active mode is the reverse: the Agent connects to the
Server on port 10051. Proxy is optional, and shared memory is not used for this
communication.
Q7: A Zabbix administrator notices that trigger events are being generated, but no
actions are executed. The action configuration appears correct. Which component
should be investigated first?
A. Zabbix Proxy buffer overflow
B. Zabbix Server escalator process [CORRECT]
C. Zabbix Agent timeout
D. Database replication lag
Correct Answer: B
Rationale: The Escalator process on the Zabbix Server is responsible for processing
actions and escalations. If events are generated but actions fail, the escalator may be
stalled or misconfigured. Proxy buffers affect data collection, agent timeouts affect
item collection, and replication lag affects data visibility but not action execution
directly.
Q8: An organization deploys Zabbix with 10,000 monitored items and observes that the
history syncer processes are constantly at 100% utilization. Which parameter should be
adjusted to resolve this bottleneck?
A. StartPollers
B. StartHistorySyncers [CORRECT]
C. StartTrappers
D. StartDiscoverers
Correct Answer: B
Rationale: StartHistorySyncers controls the number of processes responsible for writing
history data to the database. When history syncers are overloaded, increasing this
, parameter distributes the database write load. StartPollers handles active checks,
StartTrappers handles incoming data, and StartDiscoverers handles network discovery.
Q9: A company monitors remote branch offices with limited bandwidth. Which
architectural component should be deployed at each branch to minimize WAN traffic
while maintaining full monitoring capabilities?
A. Zabbix Sender
B. Zabbix Proxy [CORRECT]
C. Additional Zabbix Server
D. Zabbix Get
Correct Answer: B
Rationale: Zabbix Proxy collects data locally from agents and devices, stores it in a local
database, and forwards consolidated data to the central Server. This reduces WAN
traffic significantly compared to direct Server polling. Zabbix Sender only sends data, a
second Server creates data fragmentation, and Zabbix Get is a troubleshooting utility.
Q10: A Zabbix administrator observes that trends data is available for the past 6
months, but history data is only available for 30 days. Which configuration parameter
controls this behavior?
A. TrendCacheSize
B. HistoryStoragePeriod [CORRECT]
C. HousekeepingFrequency
D. CacheSize
Correct Answer: B
Rationale: HistoryStoragePeriod (or HousekeeperHistory in older versions) defines how
long raw history data is retained before being purged by the housekeeper. Trends are
aggregated and stored longer. TrendCacheSize affects memory caching, CacheSize
affects configuration cache, and HousekeepingFrequency controls how often cleanup
runs.
Q11: During a security audit, an administrator discovers that Zabbix Frontend sessions
are being transmitted over plain HTTP. Which architectural change is required to secure
these communications?
A. Enable Zabbix Agent encryption only
B. Configure TLS/SSL on the web server hosting Zabbix Frontend [CORRECT]
