, Question 1
A Zabbix proxy is configured in active mode and monitors 500 hosts. After a
network partition between the proxy and server lasting 90 minutes, the server's
history sync backlog grows exponentially. Which architectural change most
effectively prevents this backlog from overwhelming the server upon
reconnection?
A. Switch the proxy to passive mode so the server pulls data at its own
pace.
B. Increase the proxy's ProxyBufferSize and configure the server to
accept data in smaller batches.
C. Enable proxy data compression and configure the server's StartPollers
to match the proxy's StartTrappers.
D. Deploy multiple proxies per host group and use load balancing to
distribute the reconnection burst.
Correct Answer: C - Enable proxy data compression and
configure the server's StartPollers to match the proxy's
StartTrappers.
RATIONALE
Proxy data compression reduces the volume of buffered data
transferred during reconnection, and matching server pollers to proxy
trappers ensures the server can process the incoming stream without
creating a new bottleneck. Passive mode (A) shifts the polling burden
and does not inherently solve backlog; buffer tuning (B) only delays
overflow; load balancing (D) adds complexity without addressing the
burst volume.
Question 2
Given the trigger expression: `min(/host/system.cpu.load[percpu,avg1],5m) > 2
and avg(/host/system.cpu.load[percpu,avg1],15m) > 1.5`. If the 5-minute
minimum is 2.1 and the 15-minute average is 1.4, what is the trigger state and
why?
Page 2
, A. PROBLEM, because the first condition is true and Zabbix uses OR
logic by default.
B. OK, because the second condition is false, and the AND operator
requires both to be true.
C. PROBLEM, because the 5-minute minimum exceeds the threshold,
overriding the average.
D. UNKNOWN, because mixing min() and avg() in one expression is
invalid syntax.
Correct Answer: B - OK, because the second condition is false,
and the AND operator requires both to be true.
RATIONALE
The AND operator requires both conditions to be true for the trigger to
enter PROBLEM. Since the 15-minute average (1.4) is below 1.5, the
second condition is false, so the trigger remains OK. Options A and C
misapply logical operators; D is incorrect because mixing functions is
valid.
Question 3
A Zabbix agent active check is configured with `ServerActive=10.0.0.1` and
`Hostname=Web01`. The server has a host named 'Web01' but its interface is
configured with an IP address of 10.0.0.2 and no DNS name. The agent's
checks are not appearing. What is the most likely cause?
A. The agent must use the server's IP in ServerActive, not the hostname.
B. Active checks require the host's interface to have a DNS name
matching the agent's Hostname parameter.
C. The host's 'Monitored by' setting must be set to 'Server' and the agent's
Hostname must match the technical host name exactly.
D. The agent's Hostname parameter is case-sensitive and must match the
visible name, not the technical name.
Correct Answer: C - The host's 'Monitored by' setting must be set
Page 3
, to 'Server' and the agent's Hostname must match the technical
host name exactly.
RATIONALE
For active checks, the agent's Hostname must match the host's
technical name in Zabbix, and the host must be monitored by the
server or a proxy. The interface IP/DNS is irrelevant for active checks,
making B incorrect. A is false because ServerActive can be an IP or
DNS; D is false because the match is against the technical name, not
the visible name.
Question 4
A calculated item `calc.cpu.util` is defined as `100 -
last(//system.cpu.util[,idle])`. The item is assigned to a host, but its value is
always 0. What is the most likely error?
A. The item key is missing the host prefix in the formula.
B. The formula uses `last()` without a time period, which defaults to 0.
C. The calculated item must reference the host's technical name, not `//`.
D. The formula references a non-existent item key
`system.cpu.util[,idle]`.
Correct Answer: A - The item key is missing the host prefix in the
formula.
RATIONALE
In calculated items, the host part of the item key must be specified,
e.g., `last(/Host/system.cpu.util[,idle])`. Using `//` omits the host and
may resolve to the current host only if the item exists, but typically
results in 0 if not found. B is false because `last()` without a period
uses the latest value. C is incorrect because `//` is valid syntax for the
current host if the item exists. D is unlikely if the item key is correct.
Page 4
A Zabbix proxy is configured in active mode and monitors 500 hosts. After a
network partition between the proxy and server lasting 90 minutes, the server's
history sync backlog grows exponentially. Which architectural change most
effectively prevents this backlog from overwhelming the server upon
reconnection?
A. Switch the proxy to passive mode so the server pulls data at its own
pace.
B. Increase the proxy's ProxyBufferSize and configure the server to
accept data in smaller batches.
C. Enable proxy data compression and configure the server's StartPollers
to match the proxy's StartTrappers.
D. Deploy multiple proxies per host group and use load balancing to
distribute the reconnection burst.
Correct Answer: C - Enable proxy data compression and
configure the server's StartPollers to match the proxy's
StartTrappers.
RATIONALE
Proxy data compression reduces the volume of buffered data
transferred during reconnection, and matching server pollers to proxy
trappers ensures the server can process the incoming stream without
creating a new bottleneck. Passive mode (A) shifts the polling burden
and does not inherently solve backlog; buffer tuning (B) only delays
overflow; load balancing (D) adds complexity without addressing the
burst volume.
Question 2
Given the trigger expression: `min(/host/system.cpu.load[percpu,avg1],5m) > 2
and avg(/host/system.cpu.load[percpu,avg1],15m) > 1.5`. If the 5-minute
minimum is 2.1 and the 15-minute average is 1.4, what is the trigger state and
why?
Page 2
, A. PROBLEM, because the first condition is true and Zabbix uses OR
logic by default.
B. OK, because the second condition is false, and the AND operator
requires both to be true.
C. PROBLEM, because the 5-minute minimum exceeds the threshold,
overriding the average.
D. UNKNOWN, because mixing min() and avg() in one expression is
invalid syntax.
Correct Answer: B - OK, because the second condition is false,
and the AND operator requires both to be true.
RATIONALE
The AND operator requires both conditions to be true for the trigger to
enter PROBLEM. Since the 15-minute average (1.4) is below 1.5, the
second condition is false, so the trigger remains OK. Options A and C
misapply logical operators; D is incorrect because mixing functions is
valid.
Question 3
A Zabbix agent active check is configured with `ServerActive=10.0.0.1` and
`Hostname=Web01`. The server has a host named 'Web01' but its interface is
configured with an IP address of 10.0.0.2 and no DNS name. The agent's
checks are not appearing. What is the most likely cause?
A. The agent must use the server's IP in ServerActive, not the hostname.
B. Active checks require the host's interface to have a DNS name
matching the agent's Hostname parameter.
C. The host's 'Monitored by' setting must be set to 'Server' and the agent's
Hostname must match the technical host name exactly.
D. The agent's Hostname parameter is case-sensitive and must match the
visible name, not the technical name.
Correct Answer: C - The host's 'Monitored by' setting must be set
Page 3
, to 'Server' and the agent's Hostname must match the technical
host name exactly.
RATIONALE
For active checks, the agent's Hostname must match the host's
technical name in Zabbix, and the host must be monitored by the
server or a proxy. The interface IP/DNS is irrelevant for active checks,
making B incorrect. A is false because ServerActive can be an IP or
DNS; D is false because the match is against the technical name, not
the visible name.
Question 4
A calculated item `calc.cpu.util` is defined as `100 -
last(//system.cpu.util[,idle])`. The item is assigned to a host, but its value is
always 0. What is the most likely error?
A. The item key is missing the host prefix in the formula.
B. The formula uses `last()` without a time period, which defaults to 0.
C. The calculated item must reference the host's technical name, not `//`.
D. The formula references a non-existent item key
`system.cpu.util[,idle]`.
Correct Answer: A - The item key is missing the host prefix in the
formula.
RATIONALE
In calculated items, the host part of the item key must be specified,
e.g., `last(/Host/system.cpu.util[,idle])`. Using `//` omits the host and
may resolve to the current host only if the item exists, but typically
results in 0 if not found. B is false because `last()` without a period
uses the latest value. C is incorrect because `//` is valid syntax for the
current host if the item exists. D is unlikely if the item key is correct.
Page 4
