Elastic Certified Engineer (ECE) — Questions and Answers

Question 1: Which aggregation type in Elasticsearch would you use to calculate the average value of a numeric field?

Histogram aggregation
Cardinality aggregation
Terms aggregation
Avg metric aggregation (Correct answer)

Correct answer: Avg metric aggregation

The avg metric aggregation computes the average of numeric values extracted from documents in the aggregation scope.

Question 2: What is 'rollover' in the context of Elasticsearch index management?

Migrating an index to a different tier
Rolling back failed index operations
Restoring a snapshot to a new index
Automatically creating a new index when the current one meets specified conditions like size or age (Correct answer)

Correct answer: Automatically creating a new index when the current one meets specified conditions like size or age

Rollover creates a new write index when the current index meets specified conditions such as maximum document count, index size, or age.

Question 3: How should ElasticSearch professionals prioritize identified risks?

Alphabetically
Randomly
Based on likelihood of occurrence combined with severity of potential impact (Correct answer)
By cost to mitigate only

Correct answer: Based on likelihood of occurrence combined with severity of potential impact

This is fundamental to ElasticSearch practice. Based on likelihood of occurrence combined with severity of potential impact represents the professional standard for risk management in the ElasticSearch certification framework.

Question 4: What does the 'exists' query do in Elasticsearch?

Returns documents that contain at least one non-null value for a specified field (Correct answer)
Checks if an index exists
Checks if a specific document ID exists
Verifies if a node is available

Correct answer: Returns documents that contain at least one non-null value for a specified field

The exists query returns documents where the specified field has at least one non-null, non-empty value in the indexed document.

Question 5: What is the purpose of the Elasticsearch 'force merge' operation?

To reduce the number of Lucene segments in an index shard, reclaiming disk space from deleted documents (Correct answer)
To merge multiple cluster states into a single consistent state
To merge two separate indices into one
To force all pending writes to disk immediately

Correct answer: To reduce the number of Lucene segments in an index shard, reclaiming disk space from deleted documents

Force merge reduces the number of Lucene segments per shard and permanently removes deleted documents, but should only be run on read-only indices as it is I/O intensive.

Question 6: What is the professional standard for managing Elasticsearch credentials used by application services?

Store credentials in a secrets manager and rotate them on a defined schedule (Correct answer)
Use anonymous access for internal services to simplify management
Share one superuser account across all services
Hardcode credentials in application source code for reliability

Correct answer: Store credentials in a secrets manager and rotate them on a defined schedule

Industry-standard credential hygiene requires using a secrets manager and scheduled rotation to limit the blast radius of a credential compromise.

Question 7: What is the difference between 'filter' context and 'query' context in Elasticsearch?

Filter context limits result count, query context does not
Query context scores documents for relevance; filter context does not score and is cacheable (Correct answer)
There is no functional difference; they are interchangeable
Filter context runs before indexing; query context runs at search time

Correct answer: Query context scores documents for relevance; filter context does not score and is cacheable

Query context contributes to relevance scoring, while filter context only determines inclusion/exclusion and results are cached for better performance.

Question 8: Which Elasticsearch configuration change reduces the risk of cluster-wide disruption when a single node runs out of disk space?

Setting index.blocks.read_only to false on all indices
Setting cluster.routing.allocation.disk.watermark.low and high thresholds (Correct answer)
Increasing the number of primary shards for all indices
Enabling shard rebalancing on disk watermark breach

Correct answer: Setting cluster.routing.allocation.disk.watermark.low and high thresholds

Disk watermark thresholds trigger shard relocation before a node reaches full capacity, preventing allocation failures and index lockout.

Question 9: Under GDPR, a data controller must be able to demonstrate lawful basis for processing personal data stored in Elasticsearch. Which governance practice best supports this requirement?

Enabling Elasticsearch's built-in GDPR compliance mode
Using anonymous access to prevent identifying who stored the data
Tagging indices with metadata fields that link to the corresponding data processing record in a Data Processing Register (Correct answer)
Storing personal data in encrypted snapshots only

Correct answer: Tagging indices with metadata fields that link to the corresponding data processing record in a Data Processing Register

Maintaining a Data Processing Register and linking indices to their processing records via index metadata or naming conventions provides the audit trail needed to demonstrate lawful basis.

Question 10: How does the `_source` field configuration affect data quality and storage in Elasticsearch?

Disabling _source forces Elasticsearch to use doc values for all queries
Disabling _source reduces heap usage but prevents document updates and reindexing (Correct answer)
Enabling _source compresses all stored fields automatically
Disabling _source improves search relevance scoring

Correct answer: Disabling _source reduces heap usage but prevents document updates and reindexing

Disabling `_source` saves disk space but prevents `_update`, `update_by_query`, and reindex operations, which require the original document to be available.

Question 11: Which Elasticsearch feature enables real-time alerting based on query results?

Snapshot lifecycle policies
Field data cache
Watchers (Elasticsearch Alerting) (Correct answer)
Cross-cluster replication

Correct answer: Watchers (Elasticsearch Alerting)

Elasticsearch Watcher (part of X-Pack) monitors data and sends alerts based on conditions evaluated against scheduled query results.

Question 12: What is the purpose of Elasticsearch's 'index templates'?

To replicate indices to another cluster
To automatically apply settings and mappings to new indices (Correct answer)
To create visual dashboards for index data
To define access control policies per index

Correct answer: To automatically apply settings and mappings to new indices

Index templates define settings, mappings, and aliases that are automatically applied when a new index matching a specified pattern is created.

Question 13: A data scientist wants to score research papers higher when they match multiple evidence keywords rather than just one. Which Elasticsearch feature enables boosting relevance based on matching multiple optional terms?

must_not clause in bool query
must clause in bool query
filter clause in bool query
should clause in bool query (Correct answer)

Correct answer: should clause in bool query

The should clause in a bool query increases the relevance score for each additional matching condition without making any single condition mandatory.

Question 14: What does the 'geo_point' field type enable in Elasticsearch?

Tagging documents with country codes
Mapping document URLs to geographic regions
Storing latitude/longitude coordinates and performing geo-spatial queries (Correct answer)
Storing IP address ranges

Correct answer: Storing latitude/longitude coordinates and performing geo-spatial queries

The geo_point field type stores latitude and longitude pairs and enables geo-spatial queries such as finding documents within a bounding box or distance from a point.

Question 15: First release of Elasticsearch

2011
2010 (Correct answer)
2009
2012

Correct answer: 2010

Elasticsearch was first released in February 2010 by Shay Banon. It was developed as a distributed, open-source search engine built on top of Apache Lucene. Its initial release marked the beginning of its journey to become a widely adopted solution for full-text search, log analysis, and real-time analytics.

Question 16: A scientific search engine needs to suggest corrections for misspelled medical terms (e.g., 'diabetis' → 'diabetes'). Which Elasticsearch feature handles this?

context suggester
completion suggester
term suggester (Correct answer)
phrase suggester

Correct answer: term suggester

The term suggester uses edit distance to propose corrections for individual misspelled words, making it suitable for fixing typos in search queries.

Question 17: Which Elasticsearch security feature allows an organization to delegate authentication to an enterprise identity provider (e.g., Okta or Azure AD) to satisfy SSO requirements common in SOC 2 and ISO 27001 audits?

API key authentication with long-lived keys
SAML or OpenID Connect realm configuration in Elasticsearch security settings (Correct answer)
Native realm with manually managed users
HTTP basic authentication over HTTPS

Correct answer: SAML or OpenID Connect realm configuration in Elasticsearch security settings

Configuring a SAML or OIDC realm allows Elasticsearch to federate authentication to enterprise IdPs like Okta or Azure AD, enabling SSO and centralized access governance.

Question 18: What does ILM stand for in the context of Elasticsearch?

Internal Load Management
Index Lifecycle Management (Correct answer)
Integrated Log Monitoring
Index Level Mapping

Correct answer: Index Lifecycle Management

ILM (Index Lifecycle Management) automates the management of indices over time, moving them through hot, warm, cold, and delete phases.

Question 19: What does the 'profile' API in Elasticsearch help with?

Cluster resource usage reporting
Index-level performance benchmarking
User authentication profiling
Detailed timing breakdown of query and aggregation execution (Correct answer)

Correct answer: Detailed timing breakdown of query and aggregation execution

The profile API provides detailed timing information about how each component of a search query and its aggregations executed, helping identify bottlenecks.

Question 20: What does 'inverted index' mean in Elasticsearch?

A secondary index on a nested field
A data structure mapping terms to documents containing them (Correct answer)
An index that has been deleted and restored
An index stored in reverse alphabetical order

Correct answer: A data structure mapping terms to documents containing them

An inverted index maps each unique term to the list of documents in which it appears, enabling fast full-text search.

Question 21: What are 'doc values' in Elasticsearch?

The default value assigned to a field when it is missing
The total number of documents indexed per day
The stored source of a document
An on-disk columnar data structure that supports sorting, aggregations, and scripting efficiently (Correct answer)

Correct answer: An on-disk columnar data structure that supports sorting, aggregations, and scripting efficiently

Doc values are an on-disk, columnar data structure built at index time that enables efficient sorting, aggregations, and access in scripts without loading data into memory.

Question 22: What does 'force merge' do in Elasticsearch?

Forces a re-election of the master node
Manually triggers segment merging to reduce the number of segments in an index (Correct answer)
Merges two indices into one
Forces a primary shard to merge with its replica

Correct answer: Manually triggers segment merging to reduce the number of segments in an index

Force merge triggers an immediate merge of an index's Lucene segments, reducing their number and freeing space from deleted documents, but it is resource-intensive.

Question 23: What is a 'multi_match' query in Elasticsearch?

A query that searches across multiple indices simultaneously
A query that matches multiple document IDs at once
A query that runs the same match query across multiple fields (Correct answer)
A query that performs multiple match types in sequence

Correct answer: A query that runs the same match query across multiple fields

A multi_match query extends the match query to allow searching across multiple fields simultaneously with configurable tie-breaking strategies.

Question 24: What did the discovery.zen.minimum_master_nodes setting control in Elasticsearch versions prior to 7.0?

The maximum number of master nodes allowed
The quorum of votes needed to elect a master and prevent split-brain (Correct answer)
The number of voting-only nodes in the cluster
Which nodes are eligible to become master

Correct answer: The quorum of votes needed to elect a master and prevent split-brain

discovery.zen.minimum_master_nodes defined the quorum (typically (N/2)+1) required to elect a master, preventing two partitions from each electing their own master.

Question 25: What is 'segment merging' in Elasticsearch?

Replicating data between nodes
Combining multiple shards into one
The background process of merging smaller Lucene segments into larger ones to optimize storage and search performance (Correct answer)
Migrating an index from one cluster to another

Correct answer: The background process of merging smaller Lucene segments into larger ones to optimize storage and search performance

Segment merging is a background process where Elasticsearch merges smaller Lucene segments into larger ones, reducing the number of segments and improving query performance.

Question 26: A startup indexes user-generated reviews. They need to surface the most helpful reviews first while still factoring in relevance to the search query. What is the best approach?

Use a bool query with must and should clauses
Use function score combining BM25 score with a field_value_factor on helpful_votes (Correct answer)
Sort by helpful_votes descending only
Use a rank feature field on helpful_votes

Correct answer: Use function score combining BM25 score with a field_value_factor on helpful_votes

Function score with field_value_factor blends the text relevance score with numeric signals like helpful_votes into a single composite score.

Question 27: What is the purpose of the 'shrink' API in Elasticsearch?

Merging all segments into one
Compressing index data to save disk space
Decreasing the replica count
Reducing the number of primary shards in an index (Correct answer)

Correct answer: Reducing the number of primary shards in an index

The shrink API allows you to reduce the number of primary shards in an index, which is useful after data becomes less active and fewer shards are needed.

Question 28: What is the purpose of the `fielddata` setting for text fields in Elasticsearch?

Stores raw field values on disk for source retrieval
Enables the field to be used in full-text search queries
Enables the field to participate in cross-cluster search
Allows text fields to be used in sorting and aggregations by loading data into heap memory (Correct answer)

Correct answer: Allows text fields to be used in sorting and aggregations by loading data into heap memory

fielddata loads analyzed text field values into the JVM heap to enable sorting and aggregations on text fields, but it is memory-intensive and disabled by default.

Question 29: What does 'field data' refer to in Elasticsearch?

The raw bytes stored in a document field
An in-memory data structure used for sorting and aggregations on text fields (Correct answer)
The number of documents containing a specific field
The analyzer applied to a field

Correct answer: An in-memory data structure used for sorting and aggregations on text fields

Field data is an in-memory data structure Elasticsearch builds on demand to support sorting and aggregations on analyzed text fields, though it can be memory-intensive.

Question 30: What does the 'translog' in Elasticsearch do?

Provides durability by recording operations before they are flushed to Lucene (Correct answer)
Tracks changes to mappings over time
Logs all HTTP requests to the cluster
Records node join/leave events in the cluster

Correct answer: Provides durability by recording operations before they are flushed to Lucene

The transaction log (translog) ensures durability by recording every operation in a log file before it is permanently committed to the Lucene index.

Question 31: What is a 'near real-time' (NRT) search in Elasticsearch?

Search performed only on primary shards
Search that returns results within 1 millisecond
Search using caching to avoid re-scanning indices
Search that becomes available within ~1 second after indexing due to refresh intervals (Correct answer)

Correct answer: Search that becomes available within ~1 second after indexing due to refresh intervals

Elasticsearch is near real-time because indexed documents become searchable only after a refresh (default every 1 second), not immediately.

Question 32: Which Elasticsearch feature would you use to search for documents where a field value falls within a specific date range?

range query on a date field (Correct answer)
fuzzy query with date tolerance
match query with date format
wildcard query with date pattern

Correct answer: range query on a date field

The range query with gte, lte, gt, or lt parameters on a date field allows filtering documents by date ranges, supporting various date math expressions.

Question 33: What is the purpose of regular risk reviews in ElasticSearch practice?

To generate reports
To reduce workload
To identify new risks, evaluate control effectiveness, and update mitigation strategies (Correct answer)
To satisfy auditors only

Correct answer: To identify new risks, evaluate control effectiveness, and update mitigation strategies

This is fundamental to ElasticSearch practice. To identify new risks, evaluate control effectiveness, and update mitigation strategies represents the professional standard for risk management in the ElasticSearch certification framework.

Question 34: Which Elasticsearch concept describes the process of breaking text into tokens during indexing?

Analysis (Correct answer)
Segmentation
Sharding
Normalization

Correct answer: Analysis

Analysis is the process of converting text into tokens (terms) using character filters, tokenizers, and token filters defined in an analyzer.

Question 35: Research data indexed with a daily date_histogram shows sparse days with zero publications. Which date_histogram parameter ensures empty buckets are included in the response?

missing parameter set to 0
min_doc_count: 0 with extended_bounds (Correct answer)
keyed: true parameter
size: 0 in the aggregation

Correct answer: min_doc_count: 0 with extended_bounds

Setting min_doc_count: 0 combined with extended_bounds forces Elasticsearch to return buckets even when no documents fall in that interval.

Question 36: A healthcare company stores patient records and needs to ensure that a doctor's query only returns records for their assigned patients. Which Elasticsearch mechanism should be used?

Document-level security with role-based queries (Correct answer)
Index-level access control
Separate indices per doctor
Field-level encryption

Correct answer: Document-level security with role-based queries

Document-level security allows role-based queries that filter which documents a user can retrieve, enforcing per-user data boundaries.

Question 37: An Elasticsearch professional is onboarding a new team member. Which topic is MOST critical to cover first for safe cluster operations?

How to disable security for easier local development
How to write Elasticsearch blog posts
How to customize Kibana color themes
The impact of shard count on performance, and why adding shards is not a universal solution (Correct answer)

Correct answer: The impact of shard count on performance, and why adding shards is not a universal solution

Misconfigured shard counts are among the most common causes of Elasticsearch performance problems; understanding the over-sharding pitfall is foundational operational knowledge.

Question 38: What is Index Lifecycle Management (ILM) in Elasticsearch?

A method for distributing shards optimally
A tool for backing up index data to S3
A monitoring tool for index performance
A policy system to automate index transitions through phases like hot, warm, cold, and delete (Correct answer)

Correct answer: A policy system to automate index transitions through phases like hot, warm, cold, and delete

ILM automates the management of indices over time by defining policies that move indices through lifecycle phases (hot, warm, cold, frozen, delete) based on criteria like age or size.

Question 39: How can you detect that an Elasticsearch index has too many fields, which may degrade performance and stability?

Check `_cat/indices` for a high doc count
Review `_cat/segments` for large segment sizes
Monitor `jvm.gc.collectors.young.collection_count`
Check `_mapping` and compare total field count against `index.mapping.total_fields.limit` (Correct answer)

Correct answer: Check `_mapping` and compare total field count against `index.mapping.total_fields.limit`

Fetching the index mapping and counting fields against the `index.mapping.total_fields.limit` (default 1000) identifies mapping explosion, which strains heap and coordination.

Question 40: What is the minimum number of master-eligible nodes recommended to avoid a split-brain scenario in Elasticsearch?

4
3 (Correct answer)
5
2

Correct answer: 3

Three master-eligible nodes with quorum-based voting (majority of 2) prevents split-brain where two network partitions each elect their own master.

Question 41: What does 'reindexing' mean in Elasticsearch?

Reassigning shards across nodes
Copying documents from one index to another, often to apply new mappings or settings (Correct answer)
Rebuilding the inverted index from raw data
Deleting and recreating an index with the same settings

Correct answer: Copying documents from one index to another, often to apply new mappings or settings

Reindexing is the process of copying documents from a source index to a destination index, typically used when you need to change mappings or index settings.

Question 42: What is the purpose of 'index templates' in Elasticsearch?

Templates for generating bulk index requests
Pre-built Kibana dashboards for new indices
Automatically applying settings, mappings, and aliases to new indices matching a name pattern (Correct answer)
A GUI for designing index mappings

Correct answer: Automatically applying settings, mappings, and aliases to new indices matching a name pattern

Index templates allow you to define settings, mappings, and aliases that are automatically applied to new indices whose names match a specified pattern.

Question 43: What is the 'join' field type used for in Elasticsearch?

Defining parent-child relationships between documents within the same index (Correct answer)
Performing SQL-like joins between two indices
Merging duplicate documents during indexing
Linking an index alias to multiple indices

Correct answer: Defining parent-child relationships between documents within the same index

The join field type defines parent-child relationships between documents in the same index, allowing has_child and has_parent queries.

Question 44: What is the bare minimum of master nodes that a cluster must have?

one
two
three (Correct answer)
four

Correct answer: three

For a production Elasticsearch cluster, it is recommended to have a minimum of three dedicated master-eligible nodes. This configuration helps prevent split-brain scenarios, where different parts of the cluster disagree on the cluster state, by ensuring a quorum (majority) can always be formed. With three nodes, even if one fails, the remaining two can still form a quorum and maintain cluster stability and availability.

Question 45: Which Elasticsearch feature helps assess the risk of a query returning stale data after a primary shard failover?

The routing parameter on search requests
The explain API on the query
The _seq_no and _primary_term fields for optimistic concurrency control (Correct answer)
The preference parameter set to _local

Correct answer: The _seq_no and _primary_term fields for optimistic concurrency control

Sequence numbers and primary terms allow clients to detect whether a document has been modified or if they are reading post-failover data.

Question 46: What is an 'ingest pipeline' in Elasticsearch?

A Logstash configuration file
A set of processors that transform documents before they are indexed (Correct answer)
A Kibana dashboard for monitoring ingest rates
A scheduled job for bulk indexing

Correct answer: A set of processors that transform documents before they are indexed

An ingest pipeline defines a series of processors that pre-process documents before indexing, such as parsing dates, renaming fields, or enriching data.

Question 47: What role does the master node play in an Elasticsearch cluster?

Stores all primary shards
Provides the REST API endpoint
Handles all search queries
Manages cluster-wide settings and metadata (Correct answer)

Correct answer: Manages cluster-wide settings and metadata

The master node is responsible for cluster-wide operations such as creating/deleting indices and tracking which nodes are part of the cluster.

Question 48: What does the 'update by query' API do in Elasticsearch?

Updates index settings without downtime
Updates index mappings in bulk
Updates all documents that match a query using a script or partial update (Correct answer)
Renames fields across all documents

Correct answer: Updates all documents that match a query using a script or partial update

The update by query API performs updates on all documents matching a given query, often using a Painless script to modify field values.

Question 49: Which Elasticsearch query is most appropriate for implementing autocomplete or prefix-based search functionality?

prefix or completion suggester (Correct answer)
match_phrase
more_like_this
fuzzy

Correct answer: prefix or completion suggester

The prefix query or the completion suggester (with 'completion' mapped field type) are specifically designed for efficient prefix-based and autocomplete search scenarios.

Question 50: What is the Elasticsearch Bulk API used for?

Increasing shard count on an existing index
Running multiple queries at once
Reindexing large datasets across clusters
Performing multiple index, update, or delete operations in a single request (Correct answer)

Correct answer: Performing multiple index, update, or delete operations in a single request

The Bulk API allows you to perform multiple index, create, update, or delete operations in a single HTTP request, significantly improving throughput.

Question 51: What happens when cluster.routing.allocation.enable is set to 'none' in Elasticsearch?

New index creation is prevented
The cluster stops electing a new master node
All shard allocations are disabled, preventing any new shard assignments (Correct answer)
Only replica shard allocations are disabled

Correct answer: All shard allocations are disabled, preventing any new shard assignments

Setting cluster.routing.allocation.enable to 'none' disables all shard allocations, which is useful during maintenance operations such as rolling upgrades.

Question 52: What is a 'mapping' in Elasticsearch?

The schema definition for documents in an index (Correct answer)
A routing algorithm for shards
A type of search query
A visual diagram of cluster nodes

Correct answer: The schema definition for documents in an index

A mapping defines how documents and their fields are stored and indexed, similar to a schema in a relational database.

Question 53: When an Elasticsearch cluster disk usage exceeds the flood-stage watermark, what professional action is required immediately?

Increase the watermark threshold to 100% to regain writes
Restart all data nodes simultaneously
Delete the _security index to recover space
Free disk space or add capacity, then reset index.blocks.read_only_allow_delete on affected indices (Correct answer)

Correct answer: Free disk space or add capacity, then reset index.blocks.read_only_allow_delete on affected indices

Elasticsearch sets indices to read-only at the flood-stage watermark; resolving disk pressure and then clearing the read-only block restores write access.

Question 54: How do continuing education requirements benefit ElasticSearch certified professionals?

They only benefit training providers
They reduce practical skills
They ensure professionals stay current with evolving industry practices and knowledge (Correct answer)
They are unnecessary formalities

Correct answer: They ensure professionals stay current with evolving industry practices and knowledge

This is fundamental to ElasticSearch practice. They ensure professionals stay current with evolving industry practices and knowledge represents the professional standard for professional standards in the ElasticSearch certification framework.

Question 55: A compliance officer requires that all Elasticsearch search queries against sensitive data be logged with the requesting user's identity. Which feature enables this?

GeoIP Processor
Elasticsearch Slow Log
Audit Logging (X-Pack Security) (Correct answer)
Elasticsearch Watcher

Correct answer: Audit Logging (X-Pack Security)

X-Pack Security's audit logging records authentication events, authorization decisions, and REST/transport-layer requests along with the authenticated user's identity.

Question 56: What is the Elasticsearch 'snapshot' feature used for?

Capturing the current cluster state for debugging
Creating backups of indices or entire clusters to remote storage (Correct answer)
Freezing an index for read-only access
Taking real-time screenshots of Kibana dashboards

Correct answer: Creating backups of indices or entire clusters to remote storage

The snapshot API creates backups of individual indices or entire clusters to a remote repository such as S3, GCS, or a shared filesystem.

Question 57: Which Elasticsearch feature allows an organization to mask or omit sensitive fields (e.g., SSN, credit card numbers) in query results returned to specific roles, supporting least-privilege compliance?

Watcher alert filtering
Ingest pipeline redaction processor
Document-level security
Field-level security (FLS) (Correct answer)

Correct answer: Field-level security (FLS)

Field-level security restricts which fields in a document a given role can read, effectively hiding sensitive fields like SSNs from unauthorized users.

Question 58: What is a 'data stream' in Elasticsearch?

A real-time CDC (change data capture) feed from a database
A Kafka-compatible message ingestion pipeline
An abstraction over time-series indices that handles rollover and ILM automatically (Correct answer)
A type of aggregation for streaming data

Correct answer: An abstraction over time-series indices that handles rollover and ILM automatically

A data stream is an abstraction over a series of time-series indices that automatically handles rollover and integrates with ILM for lifecycle management.

Question 59: What is a 'hot-warm architecture' in Elasticsearch?

A method for real-time data streaming
A deployment model with active-active replication
A failover strategy using two identical clusters
A tiered storage approach where hot nodes handle new data and warm nodes hold older data (Correct answer)

Correct answer: A tiered storage approach where hot nodes handle new data and warm nodes hold older data

A hot-warm architecture uses fast (hot) nodes for recent, frequently queried data and slower, cost-effective (warm) nodes for older data.

Question 60: Which Elasticsearch feature allows you to search across multiple indices using a single query?

Index aliases
Multi-index search with wildcards (Correct answer)
Data streams
Cross-cluster replication

Correct answer: Multi-index search with wildcards

Elasticsearch supports multi-index search by specifying multiple index names or wildcard patterns (e.g., logs-*) in a single query.

Elastic Certified Engineer (ECE)

The Elastic Certified Engineer exam validates hands-on skills in deploying, managing, and searching with Elasticsearch. It covers indexing, querying, aggregations, cluster administration, mapping, and text analysis.

Questions

90 min

Time Limit

72%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds