, Question 1
A host monitors a volatile metric via a Zabbix trapper item. The item is
configured with 'Allowed hosts' set to 10.0.0.0/24 and 'Type of information' =
Numeric (float). A sender from 10.0.0.5 transmits the value 'NaN'. Which
outcome occurs, and why?
A. The value is stored as NULL and triggers evaluate as unsupported.
B. The value is rejected with a 'not a number' error and the item becomes
unsupported.
C. The value is accepted and stored as a float NaN, which can be matched
by a trigger using the 'band' operator.
D. The value is accepted and stored as 0.0 because Zabbix coerces
non-numeric strings to zero.
Correct Answer: B - The value is rejected with a 'not a number'
error and the item becomes unsupported.
RATIONALE
Zabbix trapper items with Numeric (float) type reject non-numeric
payloads such as 'NaN', causing an error and marking the item
unsupported. Options A and D misstate coercion behavior; C
incorrectly implies NaN is a valid float in Zabbix's numeric model.
Question 2
During LLD of network interfaces, a discovery rule returns 200 interfaces per
host. The item prototype uses a 'Preprocessing' step of JSONPath and a
dependent item referencing a master item that returns all interface counters in
one JSON payload. Which configuration minimizes server load while
preserving per-interface history?
A. Set the master item to 'Zabbix agent (active)' and the dependent items
to 'Zabbix agent (passive)'.
B. Enable 'Preprocessing: Discard unchanged with heartbeat' on the
master item only.
Page 2
, C. Use a master item with a single agent call; dependent items parse the
JSON via preprocessing and store individual values.
D. Convert each dependent item to a separate trapper item fed by a
custom script on the agent.
Correct Answer: C - Use a master item with a single agent call;
dependent items parse the JSON via preprocessing and store
individual values.
RATIONALE
Dependent items share one master collection call, drastically reducing
agent/server round-trips while allowing per-interface storage via
JSONPath preprocessing. A and D increase load; B discards data and
does not address the fan-out problem.
Question 3
A trigger expression is: min(/host/key,10m) > 90 and last(/host/key) > 90. The
intent is to fire only after sustained high values. Which subtle flaw exists, and
how should it be corrected?
A. No flaw; the expression correctly implements hysteresis.
B. The expression can fire on a single spike because min() and last() may
evaluate different samples; use min(/host/key,10m) > 90 only.
C. The expression never recovers; add a recovery expression using max().
D. The expression is invalid because 'and' cannot combine aggregate and
last functions.
Correct Answer: B - The expression can fire on a single spike
because min() and last() may evaluate different samples; use
min(/host/key,10m) > 90 only.
Page 3
, RATIONALE
Combining min() and last() can produce inconsistent sample windows,
allowing a spike to satisfy last() while min() lags; a single min() over
the window enforces sustained condition. C and D misstate Zabbix
expression semantics; A ignores the sampling inconsistency.
Question 4
A Zabbix proxy is configured in active mode behind a NAT gateway. The
server cannot initiate connections to the proxy. Which configuration is required
for the proxy to receive configuration updates and send data?
A. Set ProxyMode=0 and open inbound port 10051 on the proxy.
B. Set ProxyMode=1 and configure the server's 'Proxy address' to the
proxy's public IP.
C. Set ProxyMode=1 and ensure the proxy can reach the server on port
10051; the server address is defined in the proxy config.
D. Set ProxyMode=0 and enable 'Proxy offload' on the server.
Correct Answer: C - Set ProxyMode=1 and ensure the proxy can
reach the server on port 10051; the server address is defined in
the proxy config.
RATIONALE
Active proxies (ProxyMode=1) initiate connections to the server on
port 10051, which works through NAT without inbound access. A and
D describe passive mode; B incorrectly requires the server to reach the
proxy.
Question 5
An engineer needs to detect a service outage only when at least 3 of 5 backend
nodes are down simultaneously, but avoid flapping during rolling restarts.
Which trigger construction best satisfies this?
A. sum(last_foreach(/*/net.tcp.service[http],#5)) < 3
Page 4
A host monitors a volatile metric via a Zabbix trapper item. The item is
configured with 'Allowed hosts' set to 10.0.0.0/24 and 'Type of information' =
Numeric (float). A sender from 10.0.0.5 transmits the value 'NaN'. Which
outcome occurs, and why?
A. The value is stored as NULL and triggers evaluate as unsupported.
B. The value is rejected with a 'not a number' error and the item becomes
unsupported.
C. The value is accepted and stored as a float NaN, which can be matched
by a trigger using the 'band' operator.
D. The value is accepted and stored as 0.0 because Zabbix coerces
non-numeric strings to zero.
Correct Answer: B - The value is rejected with a 'not a number'
error and the item becomes unsupported.
RATIONALE
Zabbix trapper items with Numeric (float) type reject non-numeric
payloads such as 'NaN', causing an error and marking the item
unsupported. Options A and D misstate coercion behavior; C
incorrectly implies NaN is a valid float in Zabbix's numeric model.
Question 2
During LLD of network interfaces, a discovery rule returns 200 interfaces per
host. The item prototype uses a 'Preprocessing' step of JSONPath and a
dependent item referencing a master item that returns all interface counters in
one JSON payload. Which configuration minimizes server load while
preserving per-interface history?
A. Set the master item to 'Zabbix agent (active)' and the dependent items
to 'Zabbix agent (passive)'.
B. Enable 'Preprocessing: Discard unchanged with heartbeat' on the
master item only.
Page 2
, C. Use a master item with a single agent call; dependent items parse the
JSON via preprocessing and store individual values.
D. Convert each dependent item to a separate trapper item fed by a
custom script on the agent.
Correct Answer: C - Use a master item with a single agent call;
dependent items parse the JSON via preprocessing and store
individual values.
RATIONALE
Dependent items share one master collection call, drastically reducing
agent/server round-trips while allowing per-interface storage via
JSONPath preprocessing. A and D increase load; B discards data and
does not address the fan-out problem.
Question 3
A trigger expression is: min(/host/key,10m) > 90 and last(/host/key) > 90. The
intent is to fire only after sustained high values. Which subtle flaw exists, and
how should it be corrected?
A. No flaw; the expression correctly implements hysteresis.
B. The expression can fire on a single spike because min() and last() may
evaluate different samples; use min(/host/key,10m) > 90 only.
C. The expression never recovers; add a recovery expression using max().
D. The expression is invalid because 'and' cannot combine aggregate and
last functions.
Correct Answer: B - The expression can fire on a single spike
because min() and last() may evaluate different samples; use
min(/host/key,10m) > 90 only.
Page 3
, RATIONALE
Combining min() and last() can produce inconsistent sample windows,
allowing a spike to satisfy last() while min() lags; a single min() over
the window enforces sustained condition. C and D misstate Zabbix
expression semantics; A ignores the sampling inconsistency.
Question 4
A Zabbix proxy is configured in active mode behind a NAT gateway. The
server cannot initiate connections to the proxy. Which configuration is required
for the proxy to receive configuration updates and send data?
A. Set ProxyMode=0 and open inbound port 10051 on the proxy.
B. Set ProxyMode=1 and configure the server's 'Proxy address' to the
proxy's public IP.
C. Set ProxyMode=1 and ensure the proxy can reach the server on port
10051; the server address is defined in the proxy config.
D. Set ProxyMode=0 and enable 'Proxy offload' on the server.
Correct Answer: C - Set ProxyMode=1 and ensure the proxy can
reach the server on port 10051; the server address is defined in
the proxy config.
RATIONALE
Active proxies (ProxyMode=1) initiate connections to the server on
port 10051, which works through NAT without inbound access. A and
D describe passive mode; B incorrectly requires the server to reach the
proxy.
Question 5
An engineer needs to detect a service outage only when at least 3 of 5 backend
nodes are down simultaneously, but avoid flapping during rolling restarts.
Which trigger construction best satisfies this?
A. sum(last_foreach(/*/net.tcp.service[http],#5)) < 3
Page 4
