ZABBIX CERTIFIED SPECIALIST
COMPREHENSIVE EXAMINATION ZABBIX
LLC ACADEMIC YEAR 2026/2027
48 QUESTIONS
TABLE OF CONTENTS
# TOPIC
1 Design and troubleshoot distributed Zabbix architectures including proxies, active/passive modes, and
high-availability configurations
2 Construct and debug complex trigger expressions, calculated items, and dependent item hierarchies
using internal item references and functions
3 Automate Zabbix configuration and data retrieval using the JSON-RPC API, including authentication, host
import/export, and bulk operations
4 Apply security best practices for agent encryption (PSK), user roles, and frontend hardening in
compliance with contemporary standards
5 Interpret diagnostic exhibits and logs to diagnose data collection, preprocessing, and performance issues
6 ZABBIX CERTIFIED SPECIALIST COMPREHENSIVE EXAMINATION ZABBIX LLC ACADEMIC YEAR
2026
7 2027
8 Foundations of Zabbix Enterprise Monitoring: Architecture, Data Collection, Automation, and Security
9 Applied Zabbix Enterprise Monitoring: Architecture, Data Collection, Automation, and Security
10 Advanced Zabbix Enterprise Monitoring: Architecture, Data Collection, Automation, and Security
11 Zabbix Enterprise Monitoring: Architecture, Data Collection, Automation, and Security Review
ABSTRACT
Page 1
,This study document brings together 48 carefully worded exam questions drawn from ZABBIX
CERTIFIED SPECIALIST COMPREHENSIVE EXAMINATION ZABBIX LLC ACADEMIC YEAR
2026/2027, with the strongest emphasis placed on Design and troubleshoot distributed Zabbix
architectures including proxies, active/passive modes, and high-availability configurations,
Construct and debug complex trigger expressions, calculated items, and dependent item
hierarchies using internal item references and functions, Automate Zabbix configuration and data
retrieval using the JSON-RPC API, including authentication, host import/export and and bulk
operations. Every item follows the wording style and level of reasoning you meet in the real paper,
and each one is paired with a clear rationale so the correct choice is never a guess. Work through
the set at your own pace, mark the questions that slow you down, then come back to them until the
reasoning feels automatic. Learners who revise this way walk into the exam room recognising the
pattern behind the questions instead of meeting them for the first time. Keep going - steady, honest
practice is what turns a difficult paper into a comfortable pass.
Q1 DESIGN AND TROUBLESHOOT DISTRIBUTED ZABBIX ARCHITECTURES INCLUDING
PROXIES, ACTIVE/PASSIVE MODES, AND HIGH-AVAILABILITY CONFIGURATIONS
A Zabbix proxy is configured in active mode and monitors 500 hosts. After a
network partition between the proxy and server lasting 90 minutes, the server's
history sync backlog grows exponentially. Which architectural change most
effectively prevents this backlog from overwhelming the server upon
reconnection?
A. Switch the proxy to passive mode so the server pulls data at its own pace.
B. Increase the proxy's ProxyBufferSize and configure the server to accept data in smaller
batches.
C. Enable proxy data compression and configure the server's StartPollers to match the proxy's
StartTrappers. CORRECT
D. Deploy multiple proxies per host group and use load balancing to distribute the reconnection
burst.
RATIONALE: Proxy data compression reduces the volume of buffered data transferred during
reconnection, and matching server pollers to proxy trappers ensures the server can process the
incoming stream without creating a new bottleneck. Passive mode (A) shifts the polling burden
and does not inherently solve backlog; buffer tuning (B) only delays overflow; load balancing (D)
adds complexity without addressing the burst volume.
Page 2
, Q2 DESIGN AND TROUBLESHOOT DISTRIBUTED ZABBIX ARCHITECTURES INCLUDING
PROXIES, ACTIVE/PASSIVE MODES, AND HIGH-AVAILABILITY CONFIGURATIONS
Given the trigger expression: `min(/host/system.cpu.load[percpu,avg1],5m) > 2
and avg(/host/system.cpu.load[percpu,avg1],15m) > 1.5`. If the 5-minute minimum
is 2.1 and the 15-minute average is 1.4, what is the trigger state and why?
A. PROBLEM, because the first condition is true and Zabbix uses OR logic by default.
B. OK, because the second condition is false, and the AND operator requires both to be true.
CORRECT
C. PROBLEM, because the 5-minute minimum exceeds the threshold, overriding the average.
D. UNKNOWN, because mixing min() and avg() in one expression is invalid syntax.
RATIONALE: The AND operator requires both conditions to be true for the trigger to enter
PROBLEM. Since the 15-minute average (1.4) is below 1.5, the second condition is false, so the
trigger remains OK. Options A and C misapply logical operators; D is incorrect because mixing
functions is valid.
Q3 DESIGN AND TROUBLESHOOT DISTRIBUTED ZABBIX ARCHITECTURES INCLUDING
PROXIES, ACTIVE/PASSIVE MODES, AND HIGH-AVAILABILITY CONFIGURATIONS
A Zabbix agent active check is configured with `ServerActive=10.0.0.1` and
`Hostname=Web01`. The server has a host named 'Web01' but its interface is
configured with an IP address of 10.0.0.2 and no DNS name. The agent's checks
are not appearing. What is the most likely cause?
A. The agent must use the server's IP in ServerActive, not the hostname.
B. Active checks require the host's interface to have a DNS name matching the agent's
Hostname parameter.
C. The host's 'Monitored by' setting must be set to 'Server' and the agent's Hostname must
match the technical host name exactly. CORRECT
D. The agent's Hostname parameter is case-sensitive and must match the visible name, not the
technical name.
RATIONALE: For active checks, the agent's Hostname must match the host's technical name in
Zabbix, and the host must be monitored by the server or a proxy. The interface IP/DNS is
irrelevant for active checks, making B incorrect. A is false because ServerActive can be an IP or
DNS; D is false because the match is against the technical name, not the visible name.
Page 3
COMPREHENSIVE EXAMINATION ZABBIX
LLC ACADEMIC YEAR 2026/2027
48 QUESTIONS
TABLE OF CONTENTS
# TOPIC
1 Design and troubleshoot distributed Zabbix architectures including proxies, active/passive modes, and
high-availability configurations
2 Construct and debug complex trigger expressions, calculated items, and dependent item hierarchies
using internal item references and functions
3 Automate Zabbix configuration and data retrieval using the JSON-RPC API, including authentication, host
import/export, and bulk operations
4 Apply security best practices for agent encryption (PSK), user roles, and frontend hardening in
compliance with contemporary standards
5 Interpret diagnostic exhibits and logs to diagnose data collection, preprocessing, and performance issues
6 ZABBIX CERTIFIED SPECIALIST COMPREHENSIVE EXAMINATION ZABBIX LLC ACADEMIC YEAR
2026
7 2027
8 Foundations of Zabbix Enterprise Monitoring: Architecture, Data Collection, Automation, and Security
9 Applied Zabbix Enterprise Monitoring: Architecture, Data Collection, Automation, and Security
10 Advanced Zabbix Enterprise Monitoring: Architecture, Data Collection, Automation, and Security
11 Zabbix Enterprise Monitoring: Architecture, Data Collection, Automation, and Security Review
ABSTRACT
Page 1
,This study document brings together 48 carefully worded exam questions drawn from ZABBIX
CERTIFIED SPECIALIST COMPREHENSIVE EXAMINATION ZABBIX LLC ACADEMIC YEAR
2026/2027, with the strongest emphasis placed on Design and troubleshoot distributed Zabbix
architectures including proxies, active/passive modes, and high-availability configurations,
Construct and debug complex trigger expressions, calculated items, and dependent item
hierarchies using internal item references and functions, Automate Zabbix configuration and data
retrieval using the JSON-RPC API, including authentication, host import/export and and bulk
operations. Every item follows the wording style and level of reasoning you meet in the real paper,
and each one is paired with a clear rationale so the correct choice is never a guess. Work through
the set at your own pace, mark the questions that slow you down, then come back to them until the
reasoning feels automatic. Learners who revise this way walk into the exam room recognising the
pattern behind the questions instead of meeting them for the first time. Keep going - steady, honest
practice is what turns a difficult paper into a comfortable pass.
Q1 DESIGN AND TROUBLESHOOT DISTRIBUTED ZABBIX ARCHITECTURES INCLUDING
PROXIES, ACTIVE/PASSIVE MODES, AND HIGH-AVAILABILITY CONFIGURATIONS
A Zabbix proxy is configured in active mode and monitors 500 hosts. After a
network partition between the proxy and server lasting 90 minutes, the server's
history sync backlog grows exponentially. Which architectural change most
effectively prevents this backlog from overwhelming the server upon
reconnection?
A. Switch the proxy to passive mode so the server pulls data at its own pace.
B. Increase the proxy's ProxyBufferSize and configure the server to accept data in smaller
batches.
C. Enable proxy data compression and configure the server's StartPollers to match the proxy's
StartTrappers. CORRECT
D. Deploy multiple proxies per host group and use load balancing to distribute the reconnection
burst.
RATIONALE: Proxy data compression reduces the volume of buffered data transferred during
reconnection, and matching server pollers to proxy trappers ensures the server can process the
incoming stream without creating a new bottleneck. Passive mode (A) shifts the polling burden
and does not inherently solve backlog; buffer tuning (B) only delays overflow; load balancing (D)
adds complexity without addressing the burst volume.
Page 2
, Q2 DESIGN AND TROUBLESHOOT DISTRIBUTED ZABBIX ARCHITECTURES INCLUDING
PROXIES, ACTIVE/PASSIVE MODES, AND HIGH-AVAILABILITY CONFIGURATIONS
Given the trigger expression: `min(/host/system.cpu.load[percpu,avg1],5m) > 2
and avg(/host/system.cpu.load[percpu,avg1],15m) > 1.5`. If the 5-minute minimum
is 2.1 and the 15-minute average is 1.4, what is the trigger state and why?
A. PROBLEM, because the first condition is true and Zabbix uses OR logic by default.
B. OK, because the second condition is false, and the AND operator requires both to be true.
CORRECT
C. PROBLEM, because the 5-minute minimum exceeds the threshold, overriding the average.
D. UNKNOWN, because mixing min() and avg() in one expression is invalid syntax.
RATIONALE: The AND operator requires both conditions to be true for the trigger to enter
PROBLEM. Since the 15-minute average (1.4) is below 1.5, the second condition is false, so the
trigger remains OK. Options A and C misapply logical operators; D is incorrect because mixing
functions is valid.
Q3 DESIGN AND TROUBLESHOOT DISTRIBUTED ZABBIX ARCHITECTURES INCLUDING
PROXIES, ACTIVE/PASSIVE MODES, AND HIGH-AVAILABILITY CONFIGURATIONS
A Zabbix agent active check is configured with `ServerActive=10.0.0.1` and
`Hostname=Web01`. The server has a host named 'Web01' but its interface is
configured with an IP address of 10.0.0.2 and no DNS name. The agent's checks
are not appearing. What is the most likely cause?
A. The agent must use the server's IP in ServerActive, not the hostname.
B. Active checks require the host's interface to have a DNS name matching the agent's
Hostname parameter.
C. The host's 'Monitored by' setting must be set to 'Server' and the agent's Hostname must
match the technical host name exactly. CORRECT
D. The agent's Hostname parameter is case-sensitive and must match the visible name, not the
technical name.
RATIONALE: For active checks, the agent's Hostname must match the host's technical name in
Zabbix, and the host must be monitored by the server or a proxy. The interface IP/DNS is
irrelevant for active checks, making B incorrect. A is false because ServerActive can be an IP or
DNS; D is false because the match is against the technical name, not the visible name.
Page 3
