Elastic Engineer Practice Questions & Exam Guide

Elastic Certified Engineer is a hands-on Elastic Stack route for candidates who need to build and troubleshoot Elasticsearch indices, mappings, queries, aggregations, analyzers, cluster behavior, and operational workflows.

Use this page to try original IT Mastery sample questions on engineering decisions. They are not official Elastic exam questions.

What these questions test

• choosing index, mapping, analyzer, query, and aggregation designs from task requirements
• diagnosing cluster, shard, indexing, search, and performance symptoms
• understanding tradeoffs between exact matching, full-text search, aggregations, and field types
• using objective questions as readiness support while still practicing hands-on Elastic tasks

Sample Exam Questions

Question 1

Topic: mappings

A field stores user status values such as active, disabled, and pending, and users need exact filters and aggregations. Which mapping is usually best?

• A. text only
• B. keyword
• C. date
• D. dense_vector

Best answer: B

Explanation: Exact filters and aggregations fit keyword fields. text fields are analyzed for full-text search and are not the best primary choice for exact status buckets.

Question 2

Topic: analyzers

A search for running should also match documents containing run and runner. Which design area matters most?

• A. Shard count only
• B. Snapshot retention
• C. Index alias name length
• D. Analyzer or token-filter choice, such as stemming where appropriate

Best answer: D

Explanation: Matching word variants depends on analysis. Stemming or other token filters can normalize related terms, but they should match the language and search requirements.

Question 3

Topic: index aliases

A team wants to switch searches from one backing index to a newly rebuilt index with minimal application change. What Elastic feature fits?

• A. Index alias
• B. Cluster UUID
• C. Kibana space color
• D. Node name

Best answer: A

Explanation: Aliases let applications reference a stable name while the underlying index changes. They support blue/green-style index migration and rollover patterns.

Question 4

Topic: aggregations

A dashboard needs sales totals by region. Which query component is most relevant?

• A. A match-all query only
• B. A delete-by-query request
• C. A terms aggregation by region with a metric aggregation for sales total
• D. A snapshot restore

Best answer: C

Explanation: Bucket aggregations group documents, and metric aggregations calculate values. Region buckets plus sales totals directly answer the dashboard need.

Question 5

Topic: query context

When should filter context be preferred over query context?

• A. When relevance scoring is the main result
• B. When a condition is yes/no and scoring is not needed, such as a fixed status or date range filter
• C. When documents must be deleted
• D. When the cluster must be restarted

Best answer: B

Explanation: Filter context is for boolean inclusion criteria and can be cached efficiently. Query context is useful when relevance scoring matters.

Question 6

Topic: shard allocation

A cluster turns yellow after creating an index with replicas. What is a common cause?

• A. Primary shards are missing
• B. The index has no mappings
• C. Kibana dashboards are hidden
• D. Replica shards cannot be assigned, often because there are not enough suitable nodes

Best answer: D

Explanation: Yellow health usually means primary shards are allocated but replicas are not. Node count, allocation rules, and disk watermarks should be checked.

Question 7

Topic: refresh interval

A write-heavy index does not need documents searchable immediately. What setting may improve indexing performance?

• A. Adjusting refresh interval to reduce refresh frequency during heavy indexing
• B. Shortening refresh interval to near zero
• C. Removing all mappings
• D. Disabling cluster health checks

Best answer: A

Explanation: Frequent refreshes make documents searchable sooner but cost resources. Increasing refresh interval can improve bulk indexing throughput when immediate search is not required.

Question 8

Topic: reindexing

A field was mapped incorrectly and existing documents need a corrected mapping. What is usually required?

• A. Edit the field type in place for all existing indexed data
• B. Rename the Kibana dashboard only
• C. Create a new index with the corrected mapping and reindex documents
• D. Delete the cluster state manually

Best answer: C

Explanation: Many mapping changes cannot be applied in place to existing fields. Reindexing into a correctly mapped index is a common fix.

Question 9

Topic: snapshots

What is the primary purpose of Elasticsearch snapshots?

• A. Improving query relevance automatically
• B. Backing up indices and cluster state so data can be restored after loss or migration needs
• C. Replacing all monitoring
• D. Converting every field to keyword

Best answer: B

Explanation: Snapshots support backup and restore. They are not a tuning mechanism or replacement for monitoring.

Question 10

Topic: search troubleshooting

A search that should match documents returns no hits. What should be checked first?

• A. Only the dashboard title
• B. Browser zoom level
• C. The user’s keyboard layout
• D. Index pattern or target, time filter where relevant, mapping type, analyzer behavior, query syntax, and sample documents

Best answer: D

Explanation: No hits can mean wrong target, too narrow time range, analyzer mismatch, field-type issue, query syntax error, or missing data. Engineers should verify each assumption.

Question 11

Topic: ingest pipelines

A log source needs a timestamp parsed and a field renamed before indexing. What Elastic feature can help?

• A. Ingest pipeline processors
• B. Snapshot repository cleanup
• C. Kibana dark mode
• D. Node shutdown API only

Best answer: A

Explanation: Ingest pipelines can transform documents before indexing, including parsing timestamps, renaming fields, and enriching data.

Question 12

Topic: operational troubleshooting

Search latency increases after a new high-cardinality aggregation is added. What should be reviewed?

• A. Only the dashboard name
• B. Whether all users can become administrators
• C. Field cardinality, mapping, query scope, aggregation design, index size, shard layout, and resource metrics
• D. The logo file size

Best answer: C

Explanation: Aggregation performance depends on data shape, field type, cardinality, query scope, shard distribution, and resources. The fix should be evidence-based.

Quick readiness checklist

Related IT Mastery pages

• Elastic Certified Analyst for Kibana and analysis workflows
• Splunk Core Power User for search and knowledge-object practice
• Databricks Data Engineer Associate for data-platform practice
• SnowPro DEA-C02 for data-engineering practice