I85PREP
⌘ K
Elastic Certified Engineer study materials
Elastic Certified Engineer study resources

Elastic Certified Engineer practice questions

One question at a time. Build your Elastic Certified Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Installation and Configuration

Which file in an Elasticsearch installation contains the primary node, cluster, and network settings?

  1. config/log4j2.properties
  2. config/elasticsearch.yml Correct answer.
  3. config/jvm.options
  4. config/roles.yml

Explanation

elasticsearch.yml is the main configuration file and holds cluster, node, network, discovery, and security settings. jvm.options controls JVM flags and heap, log4j2.properties controls logging, and roles.yml defines security roles.

Question 2Installation and Configuration

By default, which port does an Elasticsearch node use to serve the HTTP REST API?

  1. 5601
  2. 9200 Correct answer.
  3. 9300
  4. 5044

Explanation

The HTTP layer listens on 9200 by default, while internode transport uses 9300. Kibana serves on 5601, and the Beats input in Logstash commonly uses 5044.

Question 3Installation and Configuration

Which setting lists the master-eligible node names that participate in the very first election of a new cluster?

  1. node.master
  2. discovery.seed_hosts
  3. gateway.recover_after_nodes
  4. cluster.initial_master_nodes Correct answer.

Explanation

cluster.initial_master_nodes is used only to bootstrap a brand-new cluster and should contain the names of the initial master-eligible nodes. discovery.seed_hosts handles ongoing unicast discovery, while the other settings do not control the first election.

Question 4Installation and Configuration

Which configuration file sets the Elasticsearch JVM heap size using -Xms and -Xmx?

  1. elasticsearch.keystore
  2. jvm.options Correct answer.
  3. elasticsearch.yml
  4. log4j2.properties

Explanation

JVM options such as -Xms and -Xmx are defined in config/jvm.options, and additional files can be placed in jvm.options.d. elasticsearch.yml is for Elasticsearch settings, not JVM flags.

Question 5Installation and Configuration

Which command-line option overrides an Elasticsearch setting when starting the node directly from the tarball?

  1. -O
  2. -E Correct answer.
  3. -D
  4. -X

Explanation

The -E option passes a setting as key=value on the command line, for example -Ecluster.name=test. This takes precedence over values in elasticsearch.yml.

Question 6Installation and Configuration

What is the default cluster.name value when it is not set in elasticsearch.yml?

  1. my-application
  2. elastic
  3. elasticsearch Correct answer.
  4. docker-cluster

Explanation

If cluster.name is omitted, Elasticsearch uses the default name elasticsearch. Nodes must share the same cluster.name to join the same cluster.

Question 7Installation and Configuration

Which setting in kibana.yml defines the Elasticsearch endpoint that Kibana connects to?

  1. elasticsearch.url
  2. output.elasticsearch.hosts
  3. server.elasticsearch
  4. elasticsearch.hosts Correct answer.

Explanation

Kibana uses elasticsearch.hosts, an array of URLs, to locate Elasticsearch. The older elasticsearch.url setting was removed in Kibana 7.0.

Question 8Installation and Configuration

Which formatting rule applies when editing elasticsearch.yml?

  1. Indentation must use tab characters
  2. Each setting must end with a semicolon
  3. Nested sections are indented with spaces Correct answer.
  4. Keys must be enclosed in double quotes

Explanation

elasticsearch.yml is YAML, which requires spaces for indentation and forbids tab characters. Keys are normally unquoted, and settings do not end with semicolons.

Question 9Installation and Configuration

An administrator sets network.host: 0.0.0.0 on an Elasticsearch node. What happens at startup?

  1. The node binds only to the loopback interface
  2. TLS is automatically enabled for the HTTP layer
  3. The node enters production mode and bootstrap checks are enforced Correct answer.
  4. The HTTP layer is disabled and only transport remains

Explanation

Binding to a non-loopback address puts the node into production mode, which enables the bootstrap checks. Those checks can prevent startup if system limits such as vm.max_map_count are too low.

Question 10Installation and Configuration

To pass the Elasticsearch bootstrap check on Linux, what is the minimum required value for vm.max_map_count?

  1. 1048576
  2. 65530
  3. 262144 Correct answer.
  4. 131072

Explanation

Elasticsearch requires vm.max_map_count to be at least 262144. The common Linux default of 65530 triggers a bootstrap check failure in production mode.

Question 11Installation and Configuration

Which command adds a secure setting, such as a password, to the Elasticsearch keystore?

  1. bin/elasticsearch-keystore set <setting>
  2. bin/elasticsearch-keystore put <setting>
  3. bin/elasticsearch-keystore create <setting>
  4. bin/elasticsearch-keystore add <setting> Correct answer.

Explanation

The elasticsearch-keystore add command prompts for a value and stores it in the keystore. The create subcommand creates the keystore file itself, while list and remove manage entries.

Question 12Installation and Configuration

Which system limit must be raised for the elasticsearch user so that bootstrap.memory_lock: true can work?

  1. nofile (open files)
  2. as (address space)
  3. nproc (processes)
  4. memlock (locked memory) Correct answer.

Explanation

bootstrap.memory_lock uses mlockall to prevent heap pages from being swapped, which requires the memlock limit to be unlimited or high enough. It is set in limits.conf or via systemd LimitMEMLOCK.

Question 13Installation and Configuration

What does discovery.seed_hosts provide in a multi-node Elasticsearch cluster?

  1. Addresses of master-eligible nodes for discovery Correct answer.
  2. The nodes that will hold replica shards
  3. A list of nodes that are allowed to join the cluster
  4. The initial master node names for the first election

Explanation

discovery.seed_hosts lists addresses of master-eligible nodes so that a node can find the cluster and gossip about cluster state. It is not an access-control list or a shard allocation setting.

Question 14Installation and Configuration

If node.name is omitted from elasticsearch.yml, what value does Elasticsearch assign?

  1. The first non-loopback IP address
  2. A random UUID generated at each startup
  3. The machine hostname Correct answer.
  4. The value of cluster.name

Explanation

By default, node.name takes the machine's hostname. Setting an explicit node.name makes logs and cluster APIs easier to interpret.

Question 15Installation and Configuration

In the official Elasticsearch Docker image, which environment variable creates a single-node development cluster?

  1. node.roles=single
  2. cluster.mode=single
  3. discovery.type=single-node Correct answer.
  4. discovery.single=true

Explanation

discovery.type=single-node tells Elasticsearch to skip the multi-node bootstrap process and form a one-node cluster. It is intended for development and testing, not production.

Question 16Installation and Configuration

In a fresh Elasticsearch 8.x installation, what is the default behavior of the security features?

  1. Enabled, with TLS and authentication configured during startup Correct answer.
  2. Enabled only for the transport layer
  3. Enabled only when a basic license is installed
  4. Disabled unless xpack.security.enabled is set to true

Explanation

Elasticsearch 8.x enables security by default. On first startup it configures TLS and creates enrollment tokens so that clients and Kibana can connect securely.

Question 17Installation and Configuration

Which configuration block in a Beats shipper sends events directly to Elasticsearch?

  1. output.elastic
  2. elasticsearch.output
  3. output.logstash
  4. output.elasticsearch Correct answer.

Explanation

Beats use output.elasticsearch with a hosts list to publish events to Elasticsearch. output.logstash is used instead when events are routed through Logstash.

Question 18Installation and Configuration

Which environment variable specifies the directory containing elasticsearch.yml when running from a tarball?

  1. ES_CONFIG
  2. ES_HOME
  3. ES_PATH_CONF Correct answer.
  4. ES_SETTINGS

Explanation

ES_PATH_CONF points Elasticsearch to the configuration directory, which defaults to $ES_HOME/config. ES_HOME identifies the installation directory itself.

Question 19Installation and Configuration

Which setting changes the port used for internode transport communication?

  1. http.port
  2. cluster.port
  3. network.port
  4. transport.port Correct answer.

Explanation

transport.port controls the internode transport listener and defaults to 9300. http.port controls the REST API listener and defaults to 9200.

Question 20Installation and Configuration

What does node.roles: [] configure in Elasticsearch 8.x?

  1. A node that is excluded from the cluster state
  2. A node that cannot join any cluster
  3. A coordinating-only node that routes requests but holds no roles Correct answer.
  4. A master-eligible node with no data storage

Explanation

An empty node.roles array assigns no roles, producing a coordinating-only node. It joins the cluster and can route requests and merge results but does not store data or participate in elections.

Question 21Installation and Configuration

After a new cluster has successfully formed for the first time, what should be done with cluster.initial_master_nodes?

  1. Replace it with discovery.type: single-node
  2. Keep it set on all master-eligible nodes permanently
  3. Set it only on data nodes
  4. Remove it from the configuration on all nodes Correct answer.

Explanation

cluster.initial_master_nodes is only needed for the initial bootstrap. Leaving it configured can cause nodes to form separate clusters during a full restart, so it should be removed after the cluster is established.

Question 22Installation and Configuration

Which settings group enables TLS for internode transport communication in Elasticsearch 8.x?

  1. xpack.security.http.ssl.*
  2. xpack.security.transport.ssl.* Correct answer.
  3. transport.ssl.*
  4. xpack.ssl.transport.*

Explanation

Internode TLS is configured under xpack.security.transport.ssl.*, including enabled, keystore, and verification_mode. The HTTP layer uses xpack.security.http.ssl.* separately.

Question 23Installation and Configuration

Which command-line tool generates certificate authorities, certificates, and CSRs for Elasticsearch security?

  1. elasticsearch-certutil Correct answer.
  2. elasticsearch-env
  3. elasticsearch-plugin
  4. elasticsearch-keystore

Explanation

elasticsearch-certutil provides ca, cert, csr, and http modes for creating the certificates used by X-Pack security. The keystore tool stores secrets, and the plugin tool manages plugins.

Question 24Installation and Configuration

Where should a custom heap setting be placed on a Debian package installation so that it survives package upgrades?

  1. In the ES_JVM_HEAP environment variable
  2. Directly appended to /etc/elasticsearch/jvm.options
  3. In /etc/elasticsearch/elasticsearch.yml under jvm.options
  4. In a .options file under /etc/elasticsearch/jvm.options.d/ Correct answer.

Explanation

Files ending in .options under /etc/elasticsearch/jvm.options.d/ are loaded after the main jvm.options file and are preserved across upgrades. Editing jvm.options directly can be overwritten by package updates.

Question 25Installation and Configuration

On a systemd-managed Elasticsearch host, where should LimitNOFILE be raised for the service?

  1. In elasticsearch.yml as bootstrap.limit_nofile
  2. In /etc/security/limits.conf only
  3. In a systemd unit override for the elasticsearch service Correct answer.
  4. In jvm.options as -XX:+UseFileLimit

Explanation

Services started by systemd do not apply /etc/security/limits.conf through PAM, so the limit must be set in a unit override such as LimitNOFILE. Elasticsearch documents this approach for package installations.

Question 26Cluster Administration

A cluster reports health status red. What does this indicate?

  1. At least one primary shard is unassigned. Correct answer.
  2. All primary shards are assigned but some replicas are unassigned.
  3. The master node has lost its quorum.
  4. All primary and replica shards are assigned.

Explanation

A red cluster health status means at least one primary shard is unassigned. Until that primary is allocated, the affected index cannot serve reads or writes for those shards. Yellow indicates missing replicas, and green indicates all shards are assigned.

Question 27Cluster Administration

A cluster reports health status yellow. Which condition produces this status?

  1. All primaries are assigned but a replica is unassigned. Correct answer.
  2. Every primary and replica shard is assigned.
  3. A node has exceeded the flood-stage disk watermark and its indices are read-only.
  4. One or more primary shards are unassigned.

Explanation

Yellow means every primary shard is active but at least one replica is unassigned. Searches still work, but redundancy is reduced. Red indicates an unassigned primary.

Question 28Cluster Administration

Which endpoint returns cluster health as a JSON document with status, numberOfNodes, and activeShards fields?

  1. GET /_cat/health
  2. GET /_cluster/health Correct answer.
  3. GET /_cluster/state
  4. GET /_nodes/stats/indices

Explanation

The cluster health API returns a JSON object containing status, numberOfNodes, activeShards, and related fields. The cat health API returns a tabular text view, while cluster state and node stats serve different purposes.

Question 29Cluster Administration

Which node role is responsible for storing shards and answering search requests?

  1. data Correct answer.
  2. coordinating
  3. master
  4. ingest

Explanation

Data nodes hold shard data and execute indexing and search operations. Master-eligible nodes manage cluster state, ingest nodes preprocess documents, and coordinating nodes route requests.

Question 30Cluster Administration

Which cat API lists the allocation state of individual shards across the cluster?

  1. _cat/indices
  2. _cat/nodes
  3. _cat/shards Correct answer.
  4. _cat/allocation

Explanation

_cat/shards lists each shard's index, shard number, primary or replica type, state, and assigned node. _cat/indices summarizes indices, _cat/allocation shows disk usage per node, and _cat/nodes lists nodes.

Question 31Cluster Administration

Which value of cluster.routing.allocation.enable prevents any shard from being allocated?

  1. none Correct answer.
  2. primaries
  3. all
  4. new_primaries

Explanation

cluster.routing.allocation.enable: none disables all shard allocation, including primaries and replicas. all re-enables all allocation, primaries allows only primaries, and new_primaries allows only newly created primaries.

Question 32Cluster Administration

Which snapshot repository type stores snapshots on a shared filesystem path mounted on every node?

  1. s3
  2. gcs
  3. fs Correct answer.
  4. url

Explanation

The fs repository type reads and writes snapshots on a shared filesystem path that must be mounted on every node. s3, gcs, and azure repositories use object storage instead.

Question 33Cluster Administration

When is cluster.initial_master_nodes used?

  1. On every node restart, including rolling restarts
  2. When enabling TLS between nodes
  3. After restoring a snapshot into the cluster
  4. Only when bootstrapping a new cluster Correct answer.

Explanation

cluster.initial_master_nodes is used only on the first bootstrap of a cluster to elect the initial master. It should be removed after the cluster forms, and it is not needed on later restarts.

Question 34Cluster Administration

What is the default value of cluster.routing.allocation.disk.watermark.high?

  1. 90% Correct answer.
  2. 85%
  3. 95%
  4. 80%

Explanation

The high disk watermark defaults to 90%. At that level Elasticsearch stops allocating new shards to the node, while the low watermark at 85% triggers relocation and the flood stage at 95% sets indices read-only.

Question 35Cluster Administration

Which index setting prevents an index from being allocated to nodes in the zone named cold?

  1. cluster.routing.allocation.exclude.zone: cold,archive
  2. index.routing.allocation.require.zone: cold
  3. index.routing.allocation.exclude.zone: cold Correct answer.
  4. index.routing.allocation.include.zone: cold

Explanation

index.routing.allocation.exclude.zone excludes nodes in the named zone from allocation for that index. include and require are used to select nodes positively, and the cluster-level setting does not target a single index.

Question 36Cluster Administration

Which setting makes Elasticsearch keep a replica unassigned rather than place it in the same zone as its primary?

  1. cluster.routing.allocation.awareness.attributes: zone,rack
  2. cluster.routing.allocation.same_shard.host
  3. cluster.routing.allocation.awareness.attributes
  4. cluster.routing.allocation.awareness.force.zone.values Correct answer.

Explanation

Forced awareness uses cluster.routing.allocation.awareness.force.<attribute>.values to list zones and prevents Elasticsearch from placing both copies of a shard in one zone. If only one zone is available, replicas remain unassigned.

Question 37Cluster Administration

A setting is defined both in elasticsearch.yml and in the persistent cluster settings. Which value is used at runtime?

  1. Index-level settings
  2. Persistent cluster settings Correct answer.
  3. Default settings built into the node
  4. Settings in elasticsearch.yml

Explanation

Persistent cluster settings override the same setting in elasticsearch.yml and remain after a full cluster restart. They are applied through the cluster settings API.

Question 38Cluster Administration

Which request manually moves a shard from one node to another?

  1. POST /_cluster/allocation/explain
  2. POST /_flush/synced
  3. POST /_cluster/reroute with a move command Correct answer.
  4. PUT /_cluster/settings with allocation.enable

Explanation

The cluster reroute API accepts commands such as move, allocate_replica, and cancel. A move command specifies the index, shard, from_node, and to_node.

Question 39Cluster Administration

A shard is unassigned and you need to know why. Which API should you call?

  1. GET /_nodes/stats/indices
  2. GET /_cluster/state?filter_path=metadata
  3. GET /_cluster/allocation/explain Correct answer.
  4. GET /_cat/recovery

Explanation

The allocation explain API returns a detailed explanation of why a shard is unassigned, including decider decisions. It can be called for a specific index and shard or for the first unassigned shard.

Question 40Cluster Administration

Which API reports the recovery progress of an index's shards?

  1. GET /_cat/shards
  2. GET /_cluster/health
  3. GET /_cluster/pending_tasks
  4. GET /my-index/_recovery Correct answer.

Explanation

The index recovery API reports recovery status, type, and progress for each shard. It is useful after node restarts or snapshot restores.

Question 41Cluster Administration

Which API lists cluster-level tasks that are waiting to execute?

  1. GET /_tasks
  2. GET /_cat/thread_pool?output=json
  3. GET /_nodes/hot_threads
  4. GET /_cluster/pending_tasks Correct answer.

Explanation

The pending tasks API lists cluster-level tasks queued behind current master tasks, such as shard allocation or index creation. The tasks API shows currently running tasks.

Question 42Cluster Administration

What is the purpose of a snapshot lifecycle policy?

  1. To schedule and manage automatic snapshots Correct answer.
  2. To define index rollover thresholds
  3. To rotate TLS certificates
  4. To assign shards to nodes by attribute and zone

Explanation

A snapshot lifecycle policy defines a schedule and retention rules for automatic snapshots. It is managed through the snapshot lifecycle management APIs.

Question 43Cluster Administration

When restoring an index snapshot under a different index name, which restore parameters are used?

  1. wait_for_completion and ignore_unavailable
  2. include_global_state and partial
  3. rename_pattern and rename_replacement Correct answer.
  4. max_restore_bytes_per_sec and indices

Explanation

Restore supports rename_pattern and rename_replacement to restore an index under a new name. include_global_state controls cluster state restoration, and wait_for_completion controls blocking behavior.

Question 44Cluster Administration

During a rolling restart, which step should be taken before stopping a data node?

  1. Disable shard allocation with cluster.routing.allocation.enable. Correct answer.
  2. Delete the node's replica shards.
  3. Increase cluster.routing.allocation.node_concurrent_recoveries.
  4. Set the node's disk watermark to 100%.

Explanation

Before stopping a data node, disable shard allocation so Elasticsearch does not start unnecessary rebalancing while the node is down. Re-enable allocation after the node rejoins and its shards have recovered.

Question 45Cluster Administration

Which allocation decider prevents a shard from being assigned to a node whose disk usage exceeds the high watermark?

  1. Awareness allocation decider for zones
  2. Same-shard allocation decider
  3. Disk threshold allocation decider Correct answer.
  4. Filter allocation decider

Explanation

The disk threshold decider compares node disk usage against the low, high, and flood-stage watermarks. Above the high watermark it prevents new shard allocation to that node.

Question 46Cluster Administration

Which cat API shows disk usage and shard counts per node?

  1. _cat/shards
  2. _cat/allocation Correct answer.
  3. _cat/health
  4. _cat/indices?v&s=index

Explanation

_cat/allocation shows each node's disk usage, shard count, and disk indices. It helps identify nodes running low on space.

Question 47Cluster Administration

Which API is used to identify Java threads that are consuming high CPU on a node?

  1. GET /_nodes/hot_threads Correct answer.
  2. GET /_cluster/pending_tasks
  3. GET /_cat/thread_pool
  4. GET /_nodes/stats/jvm

Explanation

The hot threads API samples Java threads and reports those consuming high CPU. It is used for troubleshooting node performance.

Question 48Cluster Administration

Before removing a master-eligible node from a cluster, which API should be used to exclude it from voting?

  1. DELETE /_nodes/node-1
  2. POST /_cluster/voting_config_exclusions?node_names=node-1 Correct answer.
  3. PUT /_cluster/settings with cluster.routing.allocation.exclude._name
  4. POST /_cluster/reroute

Explanation

Before removing a master-eligible node, add it to voting configuration exclusions so the remaining masters can elect a new master without waiting for it. Use the voting_config_exclusions API with the node name or ID.

Question 49Cluster Administration

Which value of cluster.routing.rebalance.enable allows rebalancing only for primary shards?

  1. cluster.routing.rebalance.enable: all (default)
  2. cluster.routing.rebalance.enable: none at all
  3. cluster.routing.rebalance.enable: replicas (default)
  4. cluster.routing.rebalance.enable: primaries Correct answer.

Explanation

cluster.routing.rebalance.enable: primaries allows rebalancing of primary shards only. all allows all shards, replicas allows replicas only, and none disables rebalancing.

Question 50Cluster Administration

When a node exceeds the flood-stage disk watermark, what does Elasticsearch do to affected indices?

  1. It moves all their primary shards to another node immediately.
  2. It deletes their oldest shards.
  3. It sets index.blocks.read_only_allow_delete on them. Correct answer.
  4. It increases their refresh interval.

Explanation

At the flood-stage watermark Elasticsearch sets index.blocks.read_only_allow_delete on affected indices, preventing writes until space is freed. It does not delete shards or move primaries automatically.