, Question 1
A monitored host is reachable only through a Zabbix proxy operating in active
mode. The proxy loses its connection to the server for 45 minutes, then
reconnects. Which statement correctly describes the data-handling behavior
during and after the outage?
A. The proxy buffers collected values locally and forwards them to the
server upon reconnection; the server timestamps them at original
collection time, subject to the proxy's local buffer configuration.
B. The proxy discards all values collected during the outage because
active proxies cannot store data without a live server connection.
C. The server retrieves the buffered values only if the proxy is configured
with a passive mode fallback; otherwise data is permanently lost.
D. Values are forwarded but re-timestamped at reconnection time, causing
all trigger events to fire simultaneously in a burst.
Correct Answer: A - The proxy buffers collected values locally
and forwards them to the server upon reconnection; the server
timestamps them at original collection time, subject to the proxy's
local buffer configuration.
RATIONALE
Active proxies buffer unsent data locally and transmit it on
reconnection, preserving original collection timestamps (subject to
buffer size limits). B is false because active proxies do buffer; C
misstates the mechanism-no passive fallback is required; D is wrong
because original timestamps are retained, not overwritten at
reconnection.
Page 2
, Question 2
An engineer writes a trigger expression: {host:item.avg(5m)}>90 &
{host:item.avg(5m)}<100. The item has a 1-minute update interval. What is
the most significant semantic flaw in this expression for detecting a sustained
high-load condition?
A. The avg() function cannot be combined with two comparisons in a
single trigger expression.
B. Both functions reference the same 5-minute window, so the two
conditions are evaluated over identical samples and the expression
effectively tests a single averaged value, not a sustained range.
C. The trigger will always evaluate to true because Zabbix treats '&' as a
logical OR in trigger expressions.
D. The 5m window is invalid when the item interval is 1m; Zabbix
requires the window to be an integer multiple of the interval greater than
10m.
Correct Answer: B - Both functions reference the same 5-minute
window, so the two conditions are evaluated over identical
samples and the expression effectively tests a single averaged
value, not a sustained range.
RATIONALE
Both avg(5m) calls draw from the same 5-minute sample set, so the
trigger tests a single averaged scalar rather than a sustained
condition-there is no temporal separation between the two thresholds.
A is false (multiple comparisons are allowed), C inverts the operator
semantics, and D invents a nonexistent interval-multiple rule.
Page 3
, Question 3
A low-level discovery rule returns JSON objects containing {#FSNAME} and
{#FSTYPE}. The engineer wants dependent items per discovered filesystem.
Which configuration is REQUIRED for the dependent item prototype to
resolve correctly?
A. The master item must be a Zabbix trapper item, and the prototype
must use a calculated item formula.
B. The dependent item prototype must reference the master item and use
LLD macros (e.g., {#FSNAME}) in its key, with preprocessing steps
chained from the master's value.
C. The prototype must be defined as a separate LLD rule with its own
filter, independent of the master item.
D. The master item must be disabled so that only dependent items collect
data, preventing duplicate polling.
Correct Answer: B - The dependent item prototype must
reference the master item and use LLD macros (e.g.,
{#FSNAME}) in its key, with preprocessing steps chained from
the master's value.
RATIONALE
Dependent item prototypes must reference a master item and embed
LLD macros in the key so each discovered entity resolves uniquely;
preprocessing is chained from the master value. A is wrong because
trapper/calculated items are unrelated to dependency; C confuses
discovery rules with dependent items; D is false-the master item must
remain enabled to feed dependents.
Page 4
A monitored host is reachable only through a Zabbix proxy operating in active
mode. The proxy loses its connection to the server for 45 minutes, then
reconnects. Which statement correctly describes the data-handling behavior
during and after the outage?
A. The proxy buffers collected values locally and forwards them to the
server upon reconnection; the server timestamps them at original
collection time, subject to the proxy's local buffer configuration.
B. The proxy discards all values collected during the outage because
active proxies cannot store data without a live server connection.
C. The server retrieves the buffered values only if the proxy is configured
with a passive mode fallback; otherwise data is permanently lost.
D. Values are forwarded but re-timestamped at reconnection time, causing
all trigger events to fire simultaneously in a burst.
Correct Answer: A - The proxy buffers collected values locally
and forwards them to the server upon reconnection; the server
timestamps them at original collection time, subject to the proxy's
local buffer configuration.
RATIONALE
Active proxies buffer unsent data locally and transmit it on
reconnection, preserving original collection timestamps (subject to
buffer size limits). B is false because active proxies do buffer; C
misstates the mechanism-no passive fallback is required; D is wrong
because original timestamps are retained, not overwritten at
reconnection.
Page 2
, Question 2
An engineer writes a trigger expression: {host:item.avg(5m)}>90 &
{host:item.avg(5m)}<100. The item has a 1-minute update interval. What is
the most significant semantic flaw in this expression for detecting a sustained
high-load condition?
A. The avg() function cannot be combined with two comparisons in a
single trigger expression.
B. Both functions reference the same 5-minute window, so the two
conditions are evaluated over identical samples and the expression
effectively tests a single averaged value, not a sustained range.
C. The trigger will always evaluate to true because Zabbix treats '&' as a
logical OR in trigger expressions.
D. The 5m window is invalid when the item interval is 1m; Zabbix
requires the window to be an integer multiple of the interval greater than
10m.
Correct Answer: B - Both functions reference the same 5-minute
window, so the two conditions are evaluated over identical
samples and the expression effectively tests a single averaged
value, not a sustained range.
RATIONALE
Both avg(5m) calls draw from the same 5-minute sample set, so the
trigger tests a single averaged scalar rather than a sustained
condition-there is no temporal separation between the two thresholds.
A is false (multiple comparisons are allowed), C inverts the operator
semantics, and D invents a nonexistent interval-multiple rule.
Page 3
, Question 3
A low-level discovery rule returns JSON objects containing {#FSNAME} and
{#FSTYPE}. The engineer wants dependent items per discovered filesystem.
Which configuration is REQUIRED for the dependent item prototype to
resolve correctly?
A. The master item must be a Zabbix trapper item, and the prototype
must use a calculated item formula.
B. The dependent item prototype must reference the master item and use
LLD macros (e.g., {#FSNAME}) in its key, with preprocessing steps
chained from the master's value.
C. The prototype must be defined as a separate LLD rule with its own
filter, independent of the master item.
D. The master item must be disabled so that only dependent items collect
data, preventing duplicate polling.
Correct Answer: B - The dependent item prototype must
reference the master item and use LLD macros (e.g.,
{#FSNAME}) in its key, with preprocessing steps chained from
the master's value.
RATIONALE
Dependent item prototypes must reference a master item and embed
LLD macros in the key so each discovered entity resolves uniquely;
preprocessing is chained from the master value. A is wrong because
trapper/calculated items are unrelated to dependency; C confuses
discovery rules with dependent items; D is false-the master item must
remain enabled to feed dependents.
Page 4
