PracticeVideosBlogFlashcardsEspañol
All Practice Exams

300+ Free Elastic Certified Engineer Practice Questions

Prepare for the Elastic Certified Engineer exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
300+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More Elastic Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

Elastic Certified Analyst

Practice Questions

Elastic Certified Observability Engineer

Practice Questions

Elastic Certified SIEM Analyst

Practice Questions
2026 Statistics

Key Facts: Elastic Certified Engineer Exam

3 hours

Exam Duration

Elastic

$400

Exam Fee

Elastic

8.15

Elasticsearch Version

Elastic FAQ

14 days

Retake Wait

Elastic FAQ

2 years

Credential Validity

Elastic

1 year

Attempt Validity

Elastic FAQ

Elastic Certified Engineer is a 3-hour performance-based exam on Elasticsearch 8.15, costing $400 USD per attempt. Delivered remotely through TrueAbility and Honorlock. Elastic documentation is accessible during the exam; other sites are not. 14-day retake wait. Credential valid for 2 years. No fixed task count or public passing score is published.

Sample Elastic Certified Engineer Practice Questions

Try these sample questions to test your Elastic Certified Engineer exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 300+ question experience with AI tutoring.

1Which API returns the health status of an Elasticsearch cluster, showing red/yellow/green status?
A.GET /_cluster/stats
B.GET /_cluster/health
C.GET /_nodes/stats
D.GET /_cat/health?v
Explanation: GET /_cluster/health returns the cluster health status (green/yellow/red), number of nodes, shards, and pending tasks.
2A cluster has status 'yellow'. What does this indicate?
A.All primary and replica shards are assigned
B.All primary shards are assigned but some replica shards are unassigned
C.Some primary shards are unassigned
D.The cluster is unavailable
Explanation: Yellow status means all primary shards are assigned and the cluster is operational, but one or more replica shards are unassigned. Data is available but not fully redundant.
3You run GET /_cluster/allocation/explain and see 'no_attempt' for a shard. What is the most likely cause?
A.The shard is actively being relocated
B.Allocation is disabled via cluster.routing.allocation.enable set to 'none'
C.The node hosting the shard has left the cluster
D.The index has been closed
Explanation: When cluster.routing.allocation.enable is set to 'none' or 'primaries', replica allocation is halted and the explain API reports 'no_attempt' because Elasticsearch has not tried to allocate the shard.
4What is the correct Request body to create an index named 'products' with 2 primary shards and 1 replica?
A.{"settings":{"number_of_shards":2,"number_of_replicas":1}}
B.{"mappings":{"shards":2,"replicas":1}}
C.{"index":{"shards":2,"replicas":1}}
D.{"settings":{"shards":2,"replicas":1}}
Explanation: Index settings use the keys number_of_shards and number_of_replicas inside a settings block. PUT /products with this body creates the index correctly.
5Which mapping type should you use for a field that stores structured JSON objects and needs each sub-field to be indexed independently?
A.nested
B.object
C.flattened
D.keyword
Explanation: The 'object' type maps JSON objects with each sub-field indexed as a flat field (e.g., address.city). Use 'nested' only when you need to query inner objects as independent documents.
6You have an index with dynamic mapping enabled. A document is indexed with a field 'price' containing the value '19.99' (a string). What type will Elasticsearch assign?
A.float
B.double
C.keyword and text (multi-field)
D.long
Explanation: Dynamic mapping for string values creates a multi-field: a 'text' field for full-text search and a 'keyword' sub-field for sorting/aggregations. Numeric strings are NOT auto-detected as numbers.
7Which setting prevents Elasticsearch from adding new fields to an index automatically while still allowing documents with unknown fields to be indexed (fields are ignored)?
A."dynamic": "strict"
B."dynamic": false
C."dynamic": "runtime"
D."dynamic": true
Explanation: Setting dynamic to false disables automatic field creation. Unknown fields are silently ignored during indexing but not mapped or searchable. Documents are still accepted.
8What is a runtime field in Elasticsearch?
A.A field computed at query time from existing document data, not stored in the index
B.A field that is updated automatically when a document is re-indexed
C.A field type exclusive to time-series indices
D.A field that overrides an existing mapped field at write time
Explanation: Runtime fields are evaluated at query time using a Painless script. They are not stored in _source or the inverted index, making them flexible for ad-hoc field definitions without reindexing.
9You need to add a runtime field 'full_name' that concatenates 'first_name' and 'last_name' from _source. Which API do you use to add it to an existing index without reindexing?
A.PUT /index/_mapping with a runtime block
B.POST /index/_update_by_query
C.PUT /index/_settings
D.POST /index/_reindex
Explanation: Runtime fields are defined in the index mapping under a 'runtime' block via PUT /<index>/_mapping. They do not require reindexing because values are computed at query time.
10Which Query DSL query finds documents where the 'status' field exactly equals 'published'?
A.{"match":{"status":"published"}}
B.{"term":{"status":{"value":"published"}}}
C.{"match_phrase":{"status":"published"}}
D.{"wildcard":{"status":{"value":"publish*"}}}
Explanation: The term query performs an exact match on keyword/numeric fields without analysis. It is the correct choice for exact value lookups on keyword fields.

About the Elastic Certified Engineer Exam

The Elastic Certified Engineer exam validates hands-on Elasticsearch skill for indexing, searching, managing data, and operating clusters. Expect performance-based tasks around mappings, ingest pipelines, Query DSL, aggregations, data streams, ILM, snapshots, shard allocation, and troubleshooting on Elasticsearch 8.15.

Assessment

Performance-based hands-on tasks on a live Elasticsearch 8.15 cluster with remote proctoring

Time Limit

3 hours

Passing Score

Not publicly disclosed

Exam Fee

$400 USD per attempt (Elastic)

Elastic Certified Engineer Exam Content Outline

~14%

Data Modeling

Mappings, field types (keyword, text, nested, object, date), analyzers, multi-fields, dynamic templates, and runtime fields.

~18%

Search

Query DSL, bool/filter/must/should logic, match/term/range queries, sorting, pagination, highlighting, and efficient retrieval strategies.

~16%

Aggregations

Bucket aggregations (terms, date_histogram, range), metric aggregations (avg, sum, max, min, cardinality), and pipeline aggregations.

~19%

Data Processing

Ingest pipelines, grok and dissect processors, set/rename/remove processors, enrich policies, transforms, and reindex workflows.

~10%

Distributed Datastore

Shards, replicas, routing, node roles (master, data, ingest, coordinating), refresh intervals, and distributed cluster behavior.

~9%

Data Management

Data streams, index templates, aliases, rollover, ILM policy phases (hot/warm/cold/frozen/delete), SLM, snapshots, and restore.

~14%

Cluster Management

Cluster health, CAT APIs, allocation explain, recovery API, shard rebalancing, cluster settings, and troubleshooting unhealthy clusters.

How to Pass the Elastic Certified Engineer Exam

What You Need to Know

  • Passing score: Not publicly disclosed
  • Assessment: Performance-based hands-on tasks on a live Elasticsearch 8.15 cluster with remote proctoring
  • Time limit: 3 hours
  • Exam fee: $400 USD per attempt

Keys to Passing

  • Work through all 300 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

Elastic Certified Engineer Study Tips from Top Performers

1Practice every core workflow in Kibana Dev Tools until index, search, ingest, and lifecycle tasks feel mechanical.
2Drill ingest pipelines — grok, dissect, enrich, and transforms — because tasks often connect ingestion with search validation.
3Use filter context whenever scoring is unnecessary and verify query behavior by reading raw _search responses.
4Rehearse data streams, aliases, rollover, ILM phases, snapshots, and restore so routine administration is fast under time pressure.
5Know the triage APIs cold: _cluster/health, _cat/shards?v, _cluster/allocation/explain, _cat/recovery, and _cluster/settings.

Frequently Asked Questions

What is the Elastic Certified Engineer exam?

Elastic Certified Engineer is a performance-based hands-on certification that validates your ability to build and operate Elasticsearch solutions. You complete real tasks on a live Elasticsearch 8.15 cluster — indexing documents, configuring mappings, writing queries, building ingest pipelines, managing ILM policies, and troubleshooting cluster issues.

How hard is the Elastic Certified Engineer exam?

The exam is considered advanced. You must complete real operational tasks under a 3-hour time limit on a live cluster. Speed matters. Candidates who practice all topic areas hands-on and can recall API syntax without references generally pass.

What is the difference between Elastic Certified Engineer and Elastic Certified Analyst?

The Engineer exam is hands-on Elasticsearch administration — mappings, ingest, queries, aggregations, ILM, and cluster management. The Analyst exam focuses on Kibana — Discover, Lens, Dashboard, Maps, KQL/ESQL, and alerting. Many practitioners pursue both.

How long should I study for the Elastic Certified Engineer exam?

Most candidates with prior Elasticsearch experience need 80-140 hours spread over 8-14 weeks. Focus on hands-on practice in Kibana Dev Tools: build indices, write queries, configure ILM, take snapshots, and diagnose cluster health issues repeatedly until each task is fast.

What are the system requirements for the remote exam?

You need a webcam, microphone, stable broadband, and the Honorlock browser extension. Linux systems are not supported. The exam is delivered through TrueAbility. You may use Elastic documentation inside the exam environment but no other external sites.