ZABBIX CERTIFIED SPECIALIST EXAMS (DAY 1-5)
COMPREHENSIVE PRACTICE
2026/2027 EDITION • 250 Questions • Full Explanatory Rationales
A comprehensive, publication-grade examination covering the full 5-day Zabbix Certified Specialist (ZCS) syllabus aligned with
Zabbix 6.0 LTS and Zabbix 7.0 standards. Covers architecture, server/proxy deployment, agent modes, item preprocessing
pipelines, templates, SNMP/JMX/HTTP monitoring, trigger expressions, action escalations, granular user roles, low-level
discovery, native high availability, and API automation.
ZCS Course Day & Domain Questions Core Subject Matter & Technical Competencies
Day 1: Architecture & Installation 50 Qs (Q1–Q50) Server, Proxy, Agent, Frontend, DBs (MySQL, PG,
TimescaleDB), HW specs, PHP prerequisites, logging, HA setup
Day 2: Agent Modes & Preprocessing 50 Qs (Q51–Q100) Active/Passive agents, StartAgents=0, UserParameters, reload
commands, regex (10 groups), Custom on fail, throttling
Day 3: Templates & Data Collection 50 Qs Template inheritance & RBAC groups, macro precedence,
(Q101–Q150) context macros, Agent/SNMP/JMX/IPMI interfaces, dependent
items
Day 4: Triggers, Actions & RBAC 50 Qs Trigger syntax, mandatory fields, hysteresis, dependencies,
(Q151–Q200) action conditions, escalation steps, user roles, JSON-RPC API
Day 5: Advanced Config & 50 Qs Proxy modes (active/passive), LLD filters/overrides/lost periods,
Troubleshooting (Q201–Q250) SLA service trees, diagnostic metrics, HA failover scenarios
EXAM SPECIFICATIONS & INSTRUCTIONS
• Cognitive Distribution: 30% Recall (defaults, ports, syntax, requirements), 50% Application (configuration scenarios, best
practices, troubleshooting), 20% Analysis (complex architectures, macro resolution, failover and performance optimization).
• Format: 250 Multiple-Choice Questions (A–D, exactly one correct marked [CORRECT]) followed by official Answer Key and
Rationale.
• Study Strategy: Practice under timed conditions to master enterprise monitoring design, poller tuning, trigger expressions,
and action workflows.
Turn the page to begin the examination. Master your monitoring infrastructure.
Zabbix Certified Specialist (ZCS Day 1-5) Examination (2026/2027 Edition) | Page 1
,Section 1 (Day 1): Zabbix Architecture & Installation – Components, Databases,
Frontend, Logging, HA Requirements (50 questions)
Zabbix Server, Proxy, Agent, Frontend, Database backends (MySQL, PostgreSQL, TimescaleDB, unsupported MSSQL),
minimum hardware specs (2 CPU, 8GB RAM for 2,000 hosts), frontend prerequisites (PHP 7.2.5+, screen width 1200px), log
levels, runtime controls, and native HA requirements.
Q1: Which of the following database engines is explicitly NOT supported as a backend database for the Zabbix
Server in production environments?
A. Microsoft SQL Server (MSSQL) [CORRECT]
B. MySQL / MariaDB with InnoDB engine
C. PostgreSQL with TimescaleDB extension
D. PostgreSQL without TimescaleDB
Correct Answer: A
Rationale: Zabbix Server supports MySQL, MariaDB, PostgreSQL, and Oracle; Microsoft SQL Server (MSSQL) and SQLite are
NOT supported backends for Zabbix Server (SQLite is only supported on Zabbix Proxy).
Q2: What is the official recommended method for deploying Zabbix components in standard Linux enterprise
environments?
A. Compiling all binaries manually from source tarballs on each host
B. Installing pre-compiled official packages from the official Zabbix repository using system package managers (APT,
YUM, DNF) [CORRECT]
C. Running portable single-file binaries without systemd service integration
D. Downloading unverified third-party executable archives
Correct Answer: B
Rationale: Zabbix officially recommends installing components via official repository packages (RPM/DEB) to ensure dependency
resolution, automated updates, and standard systemd integration.
Q3: Which Zabbix component can utilize SQLite as its backend database?
A. Zabbix Server only
B. Zabbix Frontend only
C. Zabbix Proxy only [CORRECT]
D. Both Zabbix Server and Zabbix Frontend
Correct Answer: C
Rationale: SQLite is lightweight and self-contained, making it supported and ideal for Zabbix Proxy; Zabbix Server and Frontend
require full relational database management systems.
Q4: What is the default TCP listening port used by the Zabbix Server and Zabbix Proxy daemon to receive incoming
metrics?
A. TCP port 10050
B. TCP port 8080
C. TCP port 162
D. TCP port 10051 [CORRECT]
Correct Answer: D
Rationale: Zabbix Server and Zabbix Proxy listen on TCP port 10051 by default; Zabbix Agent listens on TCP port 10050 for
passive checks.
Q5: What is the default TCP listening port on which the Zabbix Agent daemon listens for incoming passive check
requests from the Server or Proxy?
A. TCP port 10050 [CORRECT]
B. TCP port 10051
C. TCP port 161
Zabbix Certified Specialist (ZCS Day 1-5) Examination (2026/2027 Edition) | Page 2
, D. TCP port 3306
Correct Answer: A
Rationale: Zabbix Agent listens on TCP port 10050 for incoming passive metric polls; port 10051 is used by the Server/Proxy, port
161 by SNMP, and port 3306 by MySQL.
Q6: What is the minimum recommended hardware specification for a production Zabbix Server monitoring
approximately 2,000 hosts with standard polling intervals?
A. 1 CPU core, 1 GB RAM, 20 GB HDD
B. 2 CPU cores, 8 GB RAM, and high-speed SSD/NVMe storage [CORRECT]
C. 32 CPU cores, 256 GB RAM, and magnetic tape drives
D. 1 CPU core, 2 GB RAM, and USB flash drive storage
Correct Answer: B
Rationale: For ~2,000 hosts, Zabbix recommends at least 2 CPU cores, 8 GB of RAM, and fast SSD/NVMe storage to handle
database write IOPS and poller cache concurrency.
Q7: Why is precise Network Time Protocol (NTP / chrony) synchronization mandatory across all Zabbix servers,
proxies, and monitored agents?
A. Because Zabbix cannot start if the system clock timezone is set to UTC
B. To encrypt database passwords automatically during transit
C. To prevent clock skew that causes false trigger alerts, missing trend calculations, incorrect SLA reports, and
rejected active check data [CORRECT]
D. To allow the Zabbix frontend to display different themes based on local sunrise
Correct Answer: C
Rationale: Accurate time synchronization is vital across monitoring infrastructure; timestamp mismatches cause active agent data
rejections, false trigger states, and corrupted historical trends.
Q8: Which PHP configuration directive MUST be set to a minimum of 300 seconds to satisfy Zabbix Frontend
prerequisites?
A. session.gc_maxlifetime
B. default_socket_timeout
C. upload_max_filesize
D. max_execution_time and max_input_time [CORRECT]
Correct Answer: D
Rationale: Zabbix Frontend prerequisites mandate that both `max_execution_time` and `max_input_time` in `php.ini` be set to at
least 300 seconds to support large configuration imports and report generation.
Q9: What is the minimum horizontal screen resolution width required for optimal viewing and navigation of the
Zabbix Frontend web interface?
A. 1200 pixels [CORRECT]
B. 800 pixels
C. 1024 pixels
D. 1920 pixels
Correct Answer: A
Rationale: The Zabbix Frontend UI is optimized for a minimum viewport width of 1200 pixels to ensure tables, graphs,
dashboards, and navigation menus display without clipping.
Q10: What runtime control command is used to force the Zabbix Server daemon to immediately reload its
configuration cache from the database without restarting the service?
A. systemctl restart zabbix-server
B. zabbix_server -R config_cache_reload [CORRECT]
C. zabbix_server --reload-all
Zabbix Certified Specialist (ZCS Day 1-5) Examination (2026/2027 Edition) | Page 3
, D. zabbix_admin flush_cache
Correct Answer: B
Rationale: `zabbix_server -R config_cache_reload` instructs the running Zabbix Server daemon via runtime control to refresh its
in-memory configuration cache without dropping active connections.
Q11: What runtime control command can be executed on a running Zabbix Server daemon to dynamically increase
its logging verbosity level by one step?
A. zabbix_server --debug=true
B. zabbix_server -R set_log_verbose
C. zabbix_server -R log_level_increase [CORRECT]
D. kill -HUP zabbix_server
Correct Answer: C
Rationale: `zabbix_server -R log_level_increase` increases the logging verbosity of all server processes (or specific target
processes if specified) by one level at runtime.
Q12: In the Zabbix Server configuration file (`zabbix_server.conf`), what does `DebugLevel=3` represent?
A. No logging (disabled)
B. Critical information only
C. Extended debug information with full SQL queries
D. Warning-level messages (standard production default) [CORRECT]
Correct Answer: D
Rationale: `DebugLevel=3` is the standard production default in Zabbix, logging warning, error, and critical messages;
DebugLevel=4 provides debug info, and DebugLevel=5 provides extended trace data.
Q13: What is the primary role of the Zabbix 'Housekeeper' internal server process?
A. To periodically delete expired historical data, trend data, problems, and audit logs according to item and global
retention settings [CORRECT]
B. To deploy Zabbix agent updates automatically across all monitored Linux hosts
C. To balance poller processes evenly across all CPU cores
D. To restart failed database connections during outages
Correct Answer: A
Rationale: The Housekeeper periodically executes SQL delete queries to purge history, trends, and event records that exceed
their defined retention periods (unless external partitioning like TimescaleDB is used).
Q14: What is the key difference between 'History' and 'Trends' data storage in Zabbix?
A. History stores aggregated hourly min/max/avg values, while Trends store raw values with exact timestamps
B. History stores raw collected values with exact timestamps for all item types; Trends store calculated hourly
statistical summaries (min, max, avg, count) for numeric items only [CORRECT]
C. Trends are stored in plain text files on disk, while History is stored in RAM
D. History is retained permanently, while Trends expire after 24 hours
Correct Answer: B
Rationale: History retains every individual raw value and timestamp collected; Trends aggregate numeric data into hourly min,
max, avg, and count records for long-term multi-year storage with minimal database footprint.
Q15: Which of the following item value types CANNOT generate Trends in Zabbix?
A. Numeric (unsigned) and Numeric (float)
B. Numeric (float) only
C. Character, Text, and Log [CORRECT]
D. All item value types generate trends equally
Correct Answer: C
Zabbix Certified Specialist (ZCS Day 1-5) Examination (2026/2027 Edition) | Page 4
COMPREHENSIVE PRACTICE
2026/2027 EDITION • 250 Questions • Full Explanatory Rationales
A comprehensive, publication-grade examination covering the full 5-day Zabbix Certified Specialist (ZCS) syllabus aligned with
Zabbix 6.0 LTS and Zabbix 7.0 standards. Covers architecture, server/proxy deployment, agent modes, item preprocessing
pipelines, templates, SNMP/JMX/HTTP monitoring, trigger expressions, action escalations, granular user roles, low-level
discovery, native high availability, and API automation.
ZCS Course Day & Domain Questions Core Subject Matter & Technical Competencies
Day 1: Architecture & Installation 50 Qs (Q1–Q50) Server, Proxy, Agent, Frontend, DBs (MySQL, PG,
TimescaleDB), HW specs, PHP prerequisites, logging, HA setup
Day 2: Agent Modes & Preprocessing 50 Qs (Q51–Q100) Active/Passive agents, StartAgents=0, UserParameters, reload
commands, regex (10 groups), Custom on fail, throttling
Day 3: Templates & Data Collection 50 Qs Template inheritance & RBAC groups, macro precedence,
(Q101–Q150) context macros, Agent/SNMP/JMX/IPMI interfaces, dependent
items
Day 4: Triggers, Actions & RBAC 50 Qs Trigger syntax, mandatory fields, hysteresis, dependencies,
(Q151–Q200) action conditions, escalation steps, user roles, JSON-RPC API
Day 5: Advanced Config & 50 Qs Proxy modes (active/passive), LLD filters/overrides/lost periods,
Troubleshooting (Q201–Q250) SLA service trees, diagnostic metrics, HA failover scenarios
EXAM SPECIFICATIONS & INSTRUCTIONS
• Cognitive Distribution: 30% Recall (defaults, ports, syntax, requirements), 50% Application (configuration scenarios, best
practices, troubleshooting), 20% Analysis (complex architectures, macro resolution, failover and performance optimization).
• Format: 250 Multiple-Choice Questions (A–D, exactly one correct marked [CORRECT]) followed by official Answer Key and
Rationale.
• Study Strategy: Practice under timed conditions to master enterprise monitoring design, poller tuning, trigger expressions,
and action workflows.
Turn the page to begin the examination. Master your monitoring infrastructure.
Zabbix Certified Specialist (ZCS Day 1-5) Examination (2026/2027 Edition) | Page 1
,Section 1 (Day 1): Zabbix Architecture & Installation – Components, Databases,
Frontend, Logging, HA Requirements (50 questions)
Zabbix Server, Proxy, Agent, Frontend, Database backends (MySQL, PostgreSQL, TimescaleDB, unsupported MSSQL),
minimum hardware specs (2 CPU, 8GB RAM for 2,000 hosts), frontend prerequisites (PHP 7.2.5+, screen width 1200px), log
levels, runtime controls, and native HA requirements.
Q1: Which of the following database engines is explicitly NOT supported as a backend database for the Zabbix
Server in production environments?
A. Microsoft SQL Server (MSSQL) [CORRECT]
B. MySQL / MariaDB with InnoDB engine
C. PostgreSQL with TimescaleDB extension
D. PostgreSQL without TimescaleDB
Correct Answer: A
Rationale: Zabbix Server supports MySQL, MariaDB, PostgreSQL, and Oracle; Microsoft SQL Server (MSSQL) and SQLite are
NOT supported backends for Zabbix Server (SQLite is only supported on Zabbix Proxy).
Q2: What is the official recommended method for deploying Zabbix components in standard Linux enterprise
environments?
A. Compiling all binaries manually from source tarballs on each host
B. Installing pre-compiled official packages from the official Zabbix repository using system package managers (APT,
YUM, DNF) [CORRECT]
C. Running portable single-file binaries without systemd service integration
D. Downloading unverified third-party executable archives
Correct Answer: B
Rationale: Zabbix officially recommends installing components via official repository packages (RPM/DEB) to ensure dependency
resolution, automated updates, and standard systemd integration.
Q3: Which Zabbix component can utilize SQLite as its backend database?
A. Zabbix Server only
B. Zabbix Frontend only
C. Zabbix Proxy only [CORRECT]
D. Both Zabbix Server and Zabbix Frontend
Correct Answer: C
Rationale: SQLite is lightweight and self-contained, making it supported and ideal for Zabbix Proxy; Zabbix Server and Frontend
require full relational database management systems.
Q4: What is the default TCP listening port used by the Zabbix Server and Zabbix Proxy daemon to receive incoming
metrics?
A. TCP port 10050
B. TCP port 8080
C. TCP port 162
D. TCP port 10051 [CORRECT]
Correct Answer: D
Rationale: Zabbix Server and Zabbix Proxy listen on TCP port 10051 by default; Zabbix Agent listens on TCP port 10050 for
passive checks.
Q5: What is the default TCP listening port on which the Zabbix Agent daemon listens for incoming passive check
requests from the Server or Proxy?
A. TCP port 10050 [CORRECT]
B. TCP port 10051
C. TCP port 161
Zabbix Certified Specialist (ZCS Day 1-5) Examination (2026/2027 Edition) | Page 2
, D. TCP port 3306
Correct Answer: A
Rationale: Zabbix Agent listens on TCP port 10050 for incoming passive metric polls; port 10051 is used by the Server/Proxy, port
161 by SNMP, and port 3306 by MySQL.
Q6: What is the minimum recommended hardware specification for a production Zabbix Server monitoring
approximately 2,000 hosts with standard polling intervals?
A. 1 CPU core, 1 GB RAM, 20 GB HDD
B. 2 CPU cores, 8 GB RAM, and high-speed SSD/NVMe storage [CORRECT]
C. 32 CPU cores, 256 GB RAM, and magnetic tape drives
D. 1 CPU core, 2 GB RAM, and USB flash drive storage
Correct Answer: B
Rationale: For ~2,000 hosts, Zabbix recommends at least 2 CPU cores, 8 GB of RAM, and fast SSD/NVMe storage to handle
database write IOPS and poller cache concurrency.
Q7: Why is precise Network Time Protocol (NTP / chrony) synchronization mandatory across all Zabbix servers,
proxies, and monitored agents?
A. Because Zabbix cannot start if the system clock timezone is set to UTC
B. To encrypt database passwords automatically during transit
C. To prevent clock skew that causes false trigger alerts, missing trend calculations, incorrect SLA reports, and
rejected active check data [CORRECT]
D. To allow the Zabbix frontend to display different themes based on local sunrise
Correct Answer: C
Rationale: Accurate time synchronization is vital across monitoring infrastructure; timestamp mismatches cause active agent data
rejections, false trigger states, and corrupted historical trends.
Q8: Which PHP configuration directive MUST be set to a minimum of 300 seconds to satisfy Zabbix Frontend
prerequisites?
A. session.gc_maxlifetime
B. default_socket_timeout
C. upload_max_filesize
D. max_execution_time and max_input_time [CORRECT]
Correct Answer: D
Rationale: Zabbix Frontend prerequisites mandate that both `max_execution_time` and `max_input_time` in `php.ini` be set to at
least 300 seconds to support large configuration imports and report generation.
Q9: What is the minimum horizontal screen resolution width required for optimal viewing and navigation of the
Zabbix Frontend web interface?
A. 1200 pixels [CORRECT]
B. 800 pixels
C. 1024 pixels
D. 1920 pixels
Correct Answer: A
Rationale: The Zabbix Frontend UI is optimized for a minimum viewport width of 1200 pixels to ensure tables, graphs,
dashboards, and navigation menus display without clipping.
Q10: What runtime control command is used to force the Zabbix Server daemon to immediately reload its
configuration cache from the database without restarting the service?
A. systemctl restart zabbix-server
B. zabbix_server -R config_cache_reload [CORRECT]
C. zabbix_server --reload-all
Zabbix Certified Specialist (ZCS Day 1-5) Examination (2026/2027 Edition) | Page 3
, D. zabbix_admin flush_cache
Correct Answer: B
Rationale: `zabbix_server -R config_cache_reload` instructs the running Zabbix Server daemon via runtime control to refresh its
in-memory configuration cache without dropping active connections.
Q11: What runtime control command can be executed on a running Zabbix Server daemon to dynamically increase
its logging verbosity level by one step?
A. zabbix_server --debug=true
B. zabbix_server -R set_log_verbose
C. zabbix_server -R log_level_increase [CORRECT]
D. kill -HUP zabbix_server
Correct Answer: C
Rationale: `zabbix_server -R log_level_increase` increases the logging verbosity of all server processes (or specific target
processes if specified) by one level at runtime.
Q12: In the Zabbix Server configuration file (`zabbix_server.conf`), what does `DebugLevel=3` represent?
A. No logging (disabled)
B. Critical information only
C. Extended debug information with full SQL queries
D. Warning-level messages (standard production default) [CORRECT]
Correct Answer: D
Rationale: `DebugLevel=3` is the standard production default in Zabbix, logging warning, error, and critical messages;
DebugLevel=4 provides debug info, and DebugLevel=5 provides extended trace data.
Q13: What is the primary role of the Zabbix 'Housekeeper' internal server process?
A. To periodically delete expired historical data, trend data, problems, and audit logs according to item and global
retention settings [CORRECT]
B. To deploy Zabbix agent updates automatically across all monitored Linux hosts
C. To balance poller processes evenly across all CPU cores
D. To restart failed database connections during outages
Correct Answer: A
Rationale: The Housekeeper periodically executes SQL delete queries to purge history, trends, and event records that exceed
their defined retention periods (unless external partitioning like TimescaleDB is used).
Q14: What is the key difference between 'History' and 'Trends' data storage in Zabbix?
A. History stores aggregated hourly min/max/avg values, while Trends store raw values with exact timestamps
B. History stores raw collected values with exact timestamps for all item types; Trends store calculated hourly
statistical summaries (min, max, avg, count) for numeric items only [CORRECT]
C. Trends are stored in plain text files on disk, while History is stored in RAM
D. History is retained permanently, while Trends expire after 24 hours
Correct Answer: B
Rationale: History retains every individual raw value and timestamp collected; Trends aggregate numeric data into hourly min,
max, avg, and count records for long-term multi-year storage with minimal database footprint.
Q15: Which of the following item value types CANNOT generate Trends in Zabbix?
A. Numeric (unsigned) and Numeric (float)
B. Numeric (float) only
C. Character, Text, and Log [CORRECT]
D. All item value types generate trends equally
Correct Answer: C
Zabbix Certified Specialist (ZCS Day 1-5) Examination (2026/2027 Edition) | Page 4
