Wiz Certified Cloud User

Correct answer: D. It establishes clear ownership for remediation and tracking

Assigning an issue establishes clear ownership so the right team drives remediation and tracks progress. The strongest distractors fail because assigning a user does not encrypt resources, disable policies, or delete underlying findings.

Correct answer: D. Whether the affected workload is internet-exposed and has access to sensitive data

Wiz prioritizes vulnerabilities using context like internet exposure and access to sensitive data rather than just raw CVSS scores. The incorrect options fail because tags, regions, and package names do not meaningfully drive risk prioritization.

Correct answer: B. To organize and visualize data/metrics for tracking and reporting on security posture

Boards are used to organize and visualize security data, providing tracked metrics and reporting for your cloud posture. Distractors mentioning runtime sensors or secrets are incorrect, as those belong to completely different feature sets within the platform.

Correct answer: B. Review and validate the recommendation against context before applying it

The recommended best practice is to carefully review and validate any AI remediation against your environmental context before applying it. Expect exam questions to emphasize human validation for artificial intelligence, treating automated suggestions as helpful guidance rather than absolute directives.

Correct answer: B. An AI assistant that helps users investigate, query, and understand security data in natural language

Wiz Assistant is an artificial intelligence tool that helps users investigate and query security data using natural language. It simply analyzes data rather than performing system installations, so dismiss options suggesting it actively deploys sensors or encrypts infrastructure.

Correct answer: C. To bring Wiz security context to the user directly within the browser experience

The browser extension brings Wiz security context directly into the user experience, allowing developers to see issues without switching tools. It provides contextual insights rather than replacing foundational architecture like the cloud connector or executing agentless disk scans.

Correct answer: C. Agentless scanning analyzes cloud state and workload contents without installed software, while Runtime Sensors collect live runtime telemetry from within workloads

Agentless scanning analyzes workload contents and cloud state without requiring installed software, while runtime sensors capture live telemetry from within active machines. A strong exam cue is remembering that agentless provides static analysis, whereas sensors grant deep process visibility.

Correct answer: C. Wiz performs automated scans on a schedule and also supports manual (on-demand) scans

The platform performs scheduled automated scans continuously, while also providing users the flexibility to trigger manual on-demand scans when needed. Dismiss extreme options suggesting manual exclusivity or total dependency on external ticketing systems for basic scanning operations.

Correct answer: A. Runtime Sensors

Runtime sensors are required to gain process-level visibility and actively validate vulnerabilities directly inside running workloads. Agentless scanning alone lacks this deep contextual telemetry, as it only provides a static snapshot of the disk and configuration state.

Correct answer: C. Rules generate Findings, while Graph Controls correlate data on the Security Graph to generate Issues

Rules detect single misconfigurations and generate findings, while graph controls correlate those findings to create contextual issues. Understand this pipeline because it defines how Wiz turns raw cloud data into prioritized risk.

Correct answer: D. Risk Issues representing active or imminent exploitable exposure are typically prioritized more urgently than baseline posture Issues

Risk issues representing exploitable toxic combinations are prioritized over baseline posture hygiene issues. For the exam, dismiss strict rules demanding equal remediation timelines, because Wiz prioritizes dynamically based on context.

Correct answer: D. Active suspicious process execution detected on a running workload by a Runtime Sensor

Threat detection issues stem from active malicious behavior observed at runtime. A practical exam cue is looking for runtime sensor alerts, while the other options describe static misconfigurations.

Correct answer: C. Prioritize and remediate it as a high-risk toxic combination, then assign for fix

Wiz Issues combine multiple risks into toxic combinations, prioritizing immediate remediation. On the exam, remember that ignoring critical attack paths or waiting for automated policy updates violates fundamental triage principles and leaves the environment exposed.

Correct answer: D. An Ignore Rule, which targets Findings directly and therefore affects Issues only indirectly

Ignore Rules directly target Findings, meaning they will indirectly affect correlated Issues across resources. Remember that temporarily ignoring an Issue only applies a time-bound suppression for a single instance, whereas bulk deletion is not supported.

Correct answer: D. When a single Issue needs short-term, time-bound suppression while a specific fix is in progress

Temporarily ignoring an Issue provides a short-term suppression while an active fix is underway. Use Ignore Rules when you need to permanently suppress a recurring pattern across the entire environment rather than managing a one-off situation.

Correct answer: A. On the next scan, the underlying Finding no longer matches, so Wiz automatically resolves the Issue

When the next scan runs and no longer detects the misconfiguration, the underlying Finding clears and automatically resolves the Issue. Users do not need to manually delete closed items, as automation handles lifecycle management based on live cloud state.

Correct answer: A. The Remediation tab

The Remediation tab provides the specific actionable steps and commands needed to fix the underlying problem. The Evidence tab only shows the technical context and configuration data that triggered the alert without offering remediation guidance.

Correct answer: A. Likelihood and impact

Issue severity is calculated by combining the likelihood of an attack with its potential impact. The platform contextualizes these factors using its Security Graph, deliberately avoiding arbitrary metrics like resource age, tags, or cost.

Correct answer: C. Correlation of multiple data points and relationships on the Security Graph

Graph Control Issues are generated by correlating multiple data points and relationships within the Security Graph. Unlike simple posture rules that evaluate a single resource in isolation, graph controls map complex toxic combinations.

Correct answer: A. Prioritize which Issues to address first

The severity rating primarily helps analysts prioritize which Issues demand immediate attention based on risk. It serves as a triage indicator for security teams, rather than dictating operational details like billing, owner emails, or deployment regions.

Correct answer: C. Severity weighs both likelihood and impact, so a high-impact scenario may still warrant attention

Severity in Wiz incorporates both likelihood and impact, meaning high impact risks demand attention even when probability is low. For the exam, remember that a low likelihood never automatically means an issue can be safely ignored.

Correct answer: C. Sensitive data exposure combined with network exposure significantly raises breach risk

Combining sensitive data with internet exposure dramatically increases the risk of a serious breach. A practical exam cue is to watch for toxic combinations, because contextual exposure is a primary driver of issue severity in Wiz.

Correct answer: D. Excessive permissions / identity-based risk

An identity granting administrative permissions beyond workload requirements is an excessive permissions risk. The other options are incorrect because broad IAM roles do not indicate malware infections, container drift, or compliance reports.

Correct answer: D. A container image running with a known vulnerable package and excessive privileges

A vulnerable package running with excessive privileges inside an image is a finding unique to containerized environments. The distractors fail because public buckets, DNS issues, and IAM users are general cloud risks not exclusive to containers.

Correct answer: C. By scanning workload disks/snapshots (agentlessly) and, with Runtime Sensors, observing runtime behavior

Wiz detects malware through agentless disk scanning and runtime behavior observation. Expect runtime sensors to add active threat detection on top of the baseline agentless snapshot scans.

Correct answer: C. It validates real exploitability, reducing noise from non-running vulnerable code

Verifying if vulnerable code is loaded validates real exploitability and eliminates noise from dormant packages. Focus on how runtime context filters out theoretical risks to highlight actual threats.

Correct answer: C. The lateral-movement impact a single exposed secret can have across the environment

This illustrates the lateral movement impact a single exposed secret can have across an environment. Prepare to map how shared credentials allow attackers to pivot from low-value targets to sensitive assets.

Correct answer: C. A privileged container with a critical vulnerability that is internet-reachable

Wiz escalates risk by combining internet exposure, critical vulnerabilities, and excessive privileges like root access. Look for the intersection of exploitability and high impact when assessing container threat scenarios.

Correct answer: D. To automatically trigger actions like assigning Issues, creating tickets, or sending notifications based on conditions

Automation Rules trigger downstream actions like assigning issues or creating tickets when specific conditions are met. Remember that these rules rely on the Security Graph for context, rather than replacing it.

Correct answer: D. Amazon S3

Amazon S3 is explicitly supported as an external destination for archiving generated reports from Wiz. On the exam, remember that third-party cloud storage is required for automated external archiving, while the other choices are completely invalid targets.

Correct answer: A. Built-in Reports stored in S3 for the export, plus an Automation Rule sending Slack notifications

Built-in reports exported to S3 handle the scheduled data lake inventory, while automation rules trigger the Slack notifications for new criticals. Remember that runtime sensors collect telemetry, whereas automation rules are your primary mechanism for driving active alerts.

Correct answer: A. Faster detection of configuration changes shortly after they occur, for supported resource types

Near real-time scanning provides faster detection of configuration changes shortly after they occur for supported resource types. It does not actively block API calls or fully replace standard scheduled scans across the entire infrastructure, which is a crucial distinction.

Correct answer: D. Use agentless scanning for broad baseline coverage and add Runtime Sensors selectively on critical workloads

Agentless scanning provides rapid, broad baseline coverage across your cloud accounts with minimal deployment friction. You then selectively deploy Runtime Sensors only on your most critical workloads to gain deeper runtime threat detection.

Correct answer: B. Providing agentless visibility and risk analysis across the running cloud environment

The correct answer works because Wiz Cloud delivers agentless visibility across the running environment. Option A is incorrect because it describes Wiz Defend, while options C and D map to Wiz Code.

Correct answer: C. It provides broad, low-friction visibility without installing software on each workload

Agentless scanning provides immediate, broad visibility without the operational burden of deploying software. Remember that Wiz uses cloud APIs and snapshots, so options requiring sensors or eliminating API access are incorrect.

Correct answer: C. A Finding

A raw configuration data point is called a finding before correlation occurs. Findings are the building blocks that policies evaluate on the security graph to generate actionable issues.

Correct answer: C. The Threat Intel Center curates threat intelligence and advisories, while the Threats page surfaces active malicious activity detected by Runtime Sensors

The threat intel center curates global advisories, while the threats page shows active malicious activity detected by runtime sensors. A practical cue is associating intelligence with advisories and threats with runtime alerts.

Correct answer: D. To organize access, scope, and visibility of data for different teams or applications

Projects and user roles organize data access and visibility for different teams. They scope resources and control permissions, rather than installing sensors, replacing cloud IAM, or acting solely as an auditor tool.

Correct answer: C. A Lens

A lens provides a temporary, filtered view of platform data based on specific criteria like internet exposure. Remember that lenses do not permanently alter configurations, unlike automation or ignore rules.

Correct answer: D. Bulk actions

Bulk actions allow users to simultaneously assign, ignore, or resolve multiple items from the Issues list. This interface feature is the correct tool for managing large volumes, whereas Mika AI or API consoles are inefficient for this specific task.

Correct answer: A. An automatic Wiz Policy update changed how the condition is evaluated, resolving the Issue

Automatic Wiz Policy updates can change condition evaluations, potentially resolving an Issue without direct cloud changes. It is best practice to audit recent policy version changes or ignore rule creations before suspecting database corruption.

Correct answer: A. Ignore Rules suppress Findings, and the related Issues are affected only indirectly as a result

Ignore rules suppress the underlying findings, which indirectly resolves the associated issues. The strongest distractor fails because ignore rules do not directly close issues or delete them from the security graph.

Correct answer: A. A cloud resource misconfiguration

Unrestricted public access on a storage resource is a classic cloud misconfiguration finding. The other options fail because public buckets do not represent malware detections, compliance certificates, or artificial intelligence pipeline risks.

Correct answer: A. A mapping of resources and Findings to framework controls, highlighting non-compliant resources

Wiz compliance posture maps resources and findings directly to framework controls to highlight non compliant areas. A key exam cue is that Wiz provides visibility rather than automatically deleting resources or guaranteeing legal certification.

Correct answer: C. Exposed secrets and sensitive training data in AI pipelines can lead to data leakage and unauthorized model/service access

Exposed secrets and sensitive data in AI pipelines create direct paths to data leakage and unauthorized access. For the exam, remember that security issues in AI pipelines are treated just like traditional cloud risks, ignoring synthetic data assumptions.

Correct answer: A. Remove the unnecessary internet exposure (e.g., restrict the security group/route)

Removing unnecessary internet exposure directly breaks the attack path by blocking initial access. When prioritizing remediation on the exam, always look for the control that severs the external entry point.

Correct answer: A. Identifying insecure configuration of cloud resources against best practices and policies

CSPM analysis identifies insecure cloud resource configurations by comparing them against best practices. Distinguish this static configuration analysis from active malware detection or code compilation processes.

Correct answer: A. The AI service's excessive permissions could be abused to reach resources unrelated to its purpose

Excessive permissions on AI services risk lateral movement to unrelated resources. Treat AI identities like any other non-human identity, ensuring least privilege to prevent unauthorized access to other services.

Correct answer: A. Attack path analysis

Attack path analysis visually maps the chained exploitable conditions leading to a critical resource. Distractors like the heatmap or remediation tab fail because they show compliance scores and fixes, not the attack chain.

Correct answer: A. The secret could be used by an attacker to authenticate and access cloud resources

A hardcoded cloud key in a public location allows attackers to authenticate and access your environment. The strongest distractor fails because exposed secrets remain a critical risk even after a security tool detects them.

Correct answer: A. Public listing still constitutes a sensitive-data exposure risk despite encryption at rest

Public listing remains a sensitive data exposure risk even when data is encrypted at rest. Remember that attackers can easily download and decrypt exposed objects if they have the necessary access keys.