Elasticsearch Certified Engineer Exam 2026: Professional
Certification Practice Test — Index Management, Mappings, Search
Queries, Aggregations, Data modelling & Cluster Performance — 190
Multiple-Choice Questions with Answers & Detailed Rationales
SECTION 1: Elasticsearch Fundamentals and Architecture
Question 1
What is the primary role of a master node in an Elasticsearch cluster?
A. Store and serve search queries across all indices
B. Manage cluster state, shard allocation, and node membership
C. Perform data ingestion and transformation pipelines
D. Handle client requests and route them to data nodes
Correct Answer: B
Explanation: Master nodes govern cluster-wide operations including state management,
shard allocation decisions, and tracking node membership without storing data.
Question 2
A developer notices that documents indexed with a new field are not immediately visible in
search results. Which Elasticsearch concept explains this behavior?
A. Shard replication lag
B. Near real-time indexing with refresh intervals
C. Translog synchronization delay
,D. Cluster state propagation time
Correct Answer: B
Explanation: Elasticsearch is near real-time; documents become searchable only after a
refresh operation, typically every 1 second by default.
Question 3
Which component of Elasticsearch is responsible for converting text into tokens during
indexing?
A. Mapper
B. Analyzer
C. Tokenizer only
D. Normalizer
Correct Answer: B
Explanation: An analyzer combines character filters, a tokenizer, and token filters to
transform text into searchable tokens during indexing.
Question 4
A company wants to ensure that search operations continue even if an entire data center
fails. Which architectural feature should they implement?
A. Increase the number of primary shards
B. Configure cross-cluster replication across data centers
,C. Enable index rollover policies
D. Use a single large shard per index
Correct Answer: B
Explanation: Cross-cluster replication replicates indices across geographically distributed
clusters, ensuring availability during data center failures.
Question 5
What happens to an index's primary shards when a data node leaves the cluster
unexpectedly?
A. Primary shards are immediately deleted
B. Replica shards are promoted to primary shards
C. The index becomes read-only until the node returns
D. All shards are redistributed to master nodes
Correct Answer: B
Explanation: When a node fails, Elasticsearch promotes replica shards to primary shards to
maintain data availability and cluster health.
Question 6
Which node type is specifically optimized for running search and aggregation operations
without holding data?
A. Master node
, B. Ingest node
C. Coordinating node
D. Machine learning node
Correct Answer: C
Explanation: Coordinating nodes route requests, merge results, and handle
search/aggregation phases without storing data or managing cluster state.
Question 7
A team needs to store time-series data with automatic deletion of old indices. Which
Elasticsearch feature should they use?
A. Index aliases with filters
B. Index lifecycle management policies
C. Snapshot and restore
D. Shard allocation filtering
Correct Answer: B
Explanation: Index lifecycle management automates rollover, shrink, force merge, and
deletion of indices based on age or size criteria.
Question 8
What is the purpose of the translog in Elasticsearch?
A. Store search results for caching
Certification Practice Test — Index Management, Mappings, Search
Queries, Aggregations, Data modelling & Cluster Performance — 190
Multiple-Choice Questions with Answers & Detailed Rationales
SECTION 1: Elasticsearch Fundamentals and Architecture
Question 1
What is the primary role of a master node in an Elasticsearch cluster?
A. Store and serve search queries across all indices
B. Manage cluster state, shard allocation, and node membership
C. Perform data ingestion and transformation pipelines
D. Handle client requests and route them to data nodes
Correct Answer: B
Explanation: Master nodes govern cluster-wide operations including state management,
shard allocation decisions, and tracking node membership without storing data.
Question 2
A developer notices that documents indexed with a new field are not immediately visible in
search results. Which Elasticsearch concept explains this behavior?
A. Shard replication lag
B. Near real-time indexing with refresh intervals
C. Translog synchronization delay
,D. Cluster state propagation time
Correct Answer: B
Explanation: Elasticsearch is near real-time; documents become searchable only after a
refresh operation, typically every 1 second by default.
Question 3
Which component of Elasticsearch is responsible for converting text into tokens during
indexing?
A. Mapper
B. Analyzer
C. Tokenizer only
D. Normalizer
Correct Answer: B
Explanation: An analyzer combines character filters, a tokenizer, and token filters to
transform text into searchable tokens during indexing.
Question 4
A company wants to ensure that search operations continue even if an entire data center
fails. Which architectural feature should they implement?
A. Increase the number of primary shards
B. Configure cross-cluster replication across data centers
,C. Enable index rollover policies
D. Use a single large shard per index
Correct Answer: B
Explanation: Cross-cluster replication replicates indices across geographically distributed
clusters, ensuring availability during data center failures.
Question 5
What happens to an index's primary shards when a data node leaves the cluster
unexpectedly?
A. Primary shards are immediately deleted
B. Replica shards are promoted to primary shards
C. The index becomes read-only until the node returns
D. All shards are redistributed to master nodes
Correct Answer: B
Explanation: When a node fails, Elasticsearch promotes replica shards to primary shards to
maintain data availability and cluster health.
Question 6
Which node type is specifically optimized for running search and aggregation operations
without holding data?
A. Master node
, B. Ingest node
C. Coordinating node
D. Machine learning node
Correct Answer: C
Explanation: Coordinating nodes route requests, merge results, and handle
search/aggregation phases without storing data or managing cluster state.
Question 7
A team needs to store time-series data with automatic deletion of old indices. Which
Elasticsearch feature should they use?
A. Index aliases with filters
B. Index lifecycle management policies
C. Snapshot and restore
D. Shard allocation filtering
Correct Answer: B
Explanation: Index lifecycle management automates rollover, shrink, force merge, and
deletion of indices based on age or size criteria.
Question 8
What is the purpose of the translog in Elasticsearch?
A. Store search results for caching
