, Question 1
A Zabbix server is configured with a proxy in active mode. The proxy collects
data from 5,000 hosts using active agent checks. After a network partition
isolates the proxy from the server for 15 minutes, which statement accurately
describes the proxy's behavior upon reconnection?
A. The proxy discards all buffered data and resumes monitoring from the
current time to avoid stale metrics.
B. The proxy sends all buffered data to the server in chronological order,
and the server processes it with original timestamps, potentially
triggering historical events.
C. The proxy sends only the most recent value per item to the server,
overwriting intermediate values to conserve bandwidth.
D. The proxy enters an error state and requires manual restart to
re-establish communication with the server.
Correct Answer: B - The proxy sends all buffered data to the
server in chronological order, and the server processes it with
original timestamps, potentially triggering historical events.
RATIONALE
Active proxies buffer collected data locally and, upon reconnection,
forward it to the server in the order collected. The server processes
these values with their original timestamps, which can generate events
for past time periods. Options A, C, and D misrepresent the proxy's
store-and-forward design and data integrity guarantees.
Question 2
In a trigger expression, the function `count(#10, 1, eq)` is used on an item that
returns values 1, 0, 1, 1, 0, 1, 1, 1, 0, 1 (most recent last). Which expression
evaluates to TRUE given this sequence?
A. count(#10,1,eq) > 5
B. count(#10,1,eq) = 6
Page 2
, C. count(#10,1,eq) >= 7
D. count(#10,1,eq) < 5
Correct Answer: C - count(#10,1,eq) >= 7
RATIONALE
The sequence contains seven 1s (positions 1,3,4,6,7,8,10). Thus
`count(#10,1,eq)` returns 7. Only `>= 7` is TRUE. The other
comparisons are false because 7 is not greater than 5, not equal to 6,
and not less than 5.
Question 3
A Zabbix administrator needs to monitor a REST API that returns JSON with a
nested array of service statuses. The goal is to create one item per service
without writing individual item definitions. Which combination of features is
MOST appropriate?
A. HTTP agent item with a JSONPath preprocessing step and a
dependent item prototype using LLD macros.
B. SNMP walk with a custom OID and a calculated item that iterates over
the array.
C. Zabbix trapper item and a scheduled script that sends each service
status separately.
D. External check script that parses the JSON and returns a single
aggregated value.
Correct Answer: A - HTTP agent item with a JSONPath
preprocessing step and a dependent item prototype using LLD
macros.
Page 3
, RATIONALE
HTTP agent items can retrieve JSON, and JSONPath preprocessing
can extract the array. Low-level discovery (LLD) with item prototypes
then creates individual items per array element using macros. Options
B, C, and D do not provide dynamic item creation from JSON arrays
without manual intervention.
Question 4
A template is linked to a host. The template defines an item
`vfs.fs.size[/,pfree]` with a trigger. The host has a user macro
`{$LOW_SPACE_LIMIT}` defined as 10, while the template trigger uses
`{$LOW_SPACE_LIMIT}` with a default of 20. What threshold will be used
for this host?
A. 10, because host-level macros override template macros.
B. 20, because template macros take precedence over host macros.
C. The trigger will fail to evaluate due to macro conflict.
D. Both thresholds are evaluated in parallel, and the trigger fires if either
is breached.
Correct Answer: A - 10, because host-level macros override
template macros.
RATIONALE
In Zabbix, host-level user macros override template-level macros of
the same name. Therefore, the host's value 10 is used. Options B, C,
and D incorrectly describe macro resolution or trigger evaluation
behavior.
Page 4
A Zabbix server is configured with a proxy in active mode. The proxy collects
data from 5,000 hosts using active agent checks. After a network partition
isolates the proxy from the server for 15 minutes, which statement accurately
describes the proxy's behavior upon reconnection?
A. The proxy discards all buffered data and resumes monitoring from the
current time to avoid stale metrics.
B. The proxy sends all buffered data to the server in chronological order,
and the server processes it with original timestamps, potentially
triggering historical events.
C. The proxy sends only the most recent value per item to the server,
overwriting intermediate values to conserve bandwidth.
D. The proxy enters an error state and requires manual restart to
re-establish communication with the server.
Correct Answer: B - The proxy sends all buffered data to the
server in chronological order, and the server processes it with
original timestamps, potentially triggering historical events.
RATIONALE
Active proxies buffer collected data locally and, upon reconnection,
forward it to the server in the order collected. The server processes
these values with their original timestamps, which can generate events
for past time periods. Options A, C, and D misrepresent the proxy's
store-and-forward design and data integrity guarantees.
Question 2
In a trigger expression, the function `count(#10, 1, eq)` is used on an item that
returns values 1, 0, 1, 1, 0, 1, 1, 1, 0, 1 (most recent last). Which expression
evaluates to TRUE given this sequence?
A. count(#10,1,eq) > 5
B. count(#10,1,eq) = 6
Page 2
, C. count(#10,1,eq) >= 7
D. count(#10,1,eq) < 5
Correct Answer: C - count(#10,1,eq) >= 7
RATIONALE
The sequence contains seven 1s (positions 1,3,4,6,7,8,10). Thus
`count(#10,1,eq)` returns 7. Only `>= 7` is TRUE. The other
comparisons are false because 7 is not greater than 5, not equal to 6,
and not less than 5.
Question 3
A Zabbix administrator needs to monitor a REST API that returns JSON with a
nested array of service statuses. The goal is to create one item per service
without writing individual item definitions. Which combination of features is
MOST appropriate?
A. HTTP agent item with a JSONPath preprocessing step and a
dependent item prototype using LLD macros.
B. SNMP walk with a custom OID and a calculated item that iterates over
the array.
C. Zabbix trapper item and a scheduled script that sends each service
status separately.
D. External check script that parses the JSON and returns a single
aggregated value.
Correct Answer: A - HTTP agent item with a JSONPath
preprocessing step and a dependent item prototype using LLD
macros.
Page 3
, RATIONALE
HTTP agent items can retrieve JSON, and JSONPath preprocessing
can extract the array. Low-level discovery (LLD) with item prototypes
then creates individual items per array element using macros. Options
B, C, and D do not provide dynamic item creation from JSON arrays
without manual intervention.
Question 4
A template is linked to a host. The template defines an item
`vfs.fs.size[/,pfree]` with a trigger. The host has a user macro
`{$LOW_SPACE_LIMIT}` defined as 10, while the template trigger uses
`{$LOW_SPACE_LIMIT}` with a default of 20. What threshold will be used
for this host?
A. 10, because host-level macros override template macros.
B. 20, because template macros take precedence over host macros.
C. The trigger will fail to evaluate due to macro conflict.
D. Both thresholds are evaluated in parallel, and the trigger fires if either
is breached.
Correct Answer: A - 10, because host-level macros override
template macros.
RATIONALE
In Zabbix, host-level user macros override template-level macros of
the same name. Therefore, the host's value 10 is used. Options B, C,
and D incorrectly describe macro resolution or trigger evaluation
behavior.
Page 4
