Wiz Cloud Fundamentals

Correct answer: D. Wiz Runtime Sensor

The Wiz Runtime Sensor is the correct choice because it uses eBPF to provide real-time threat detection inside running workloads. Remember to distinguish it from the agentless scanner, which relies on disk snapshots rather than runtime analysis.

Correct answer: C. To perform workload scanning within the customer's cloud environment, keeping sensitive data snapshots within their cloud boundary, often due to data sovereignty or compliance needs.

The Outpost deployment model keeps workload scanning within the customer cloud boundary to satisfy strict data sovereignty rules. Standard SaaS deployments centrally analyze snapshots, which violates strict data residency compliance requirements.

Correct answer: A. The workload scanner detects malware using YARA rules on disk snapshots, while the Runtime Sensor detects malicious behavior in real-time within the live workload.

The agentless workload scanner statically analyzes disk snapshots for malware using YARA rules. The optional Runtime Sensor provides dynamic, real-time threat detection based on actual behavior inside the running workload.

Correct answer: B. Code library dependencies (direct and transient).

Software Composition Analysis evaluates code library dependencies, including both direct and transitive packages, to find known vulnerabilities. Exam tip: SCA strictly focuses on open-source libraries, so it will never analyze operating systems, network rules, or hardcoded API keys.

Correct answer: C. Every time your environment is scanned and the Security Graph is updated.

Controls act as security graph queries that run immediately after every scan cycle to guarantee your security posture is completely up to date. Avoid options relying on strict hourly or weekly schedules, as Wiz evaluates issues dynamically based on graph updates.

Correct answer: C. Inventory > Technologies page

The Technologies page under the Inventory section provides a consolidated view of all hosted software and services discovered across your environment. Use the Resources page for individual assets, and remember that discovery dashboards summarize posture rather than listing specific technologies.

Correct answer: C. Custom data classifiers.

Custom data classifiers allow you to define specific keywords or formats unique to your business, such as internal product codes. Built-in rules only cover standard compliance data like PII, and text search lacks the active scanning integration required for DSPM discovery.

Correct answer: B. Bearer Token (JWT) derived from service account credentials.

Wiz API authentication requires exchanging service account credentials for a bearer token to authorize GraphQL queries. Basic authentication and custom certificates are unsupported, while OAuth signatures belong to legacy patterns rather than current Wiz service account workflows.

Correct answer: C. Access to Terraform state files or CloudTrail logs.

Code-to-cloud correlation requires granting Wiz access to Terraform state files or CloudTrail logs via the connector configuration. Runtime sensors and malware scanners detect active threats, but they cannot map a live cloud resource back to its original infrastructure code declaration.

Correct answer: C. A Wiz abstraction representing a specific vulnerability or risk identified on a single resource, such as a misconfiguration or CVE.

A finding accurately represents a specific risk on a single resource, such as a misconfiguration or vulnerability. Be careful not to confuse this with an issue, which groups multiple findings and context together to represent a broader security problem.

Correct answer: B. Wiz provides preconfigured stacks, templates, and response functions as a bundle for the customer's environment (e.g., AWS, Azure, GCP).

Remediation and Response deploys preconfigured infrastructure as code templates and response functions directly into the customer cloud environment. Remember that Wiz is agentless, so it relies on cloud native deployment bundles rather than installing agents.

Correct answer: D. On premises databases.

Wiz is explicitly a cloud only solution, meaning it does not scan or assess on premises databases. The platform relies entirely on cloud provider APIs and agentless cloud scanning to evaluate risk for cloud hosted infrastructure.

Correct answer: C. Which Wiz projects can use this deployment as a gateway to remediate findings.

Defining the project scope restricts which Wiz projects can utilize the deployment to execute automated remediations. This is a critical guardrail, ensuring development projects cannot trigger actions in production environments.

Correct answer: B. IT professionals, systems and security administrators, and developers who use Wiz in their daily tasks.

The exam targets IT professionals, security administrators, and developers who manage or operate the platform daily. It is not restricted to internal staff or architects, though candidates should possess hands-on cloud security experience beforehand.

Correct answer: C. Support for custom data classifiers.

Wiz enables the creation of custom data classifiers to identify unique or proprietary sensitive information specific to an organization. Manual tagging is a distractor because the platform prioritizes automated detection logic over manual label assignment.

Correct answer: B. The full path, including network interfaces, VPCs, and gateways, mapped to the internet.

Effective exposure requires mapping the entire network path from the internal resource through interfaces and gateways out to the internet. Avoid picking options that only look at direct public IPs or focus solely on IAM permissions.

Correct answer: D. 180 days.

Resolved Wiz Issues are retained for 180 days to support historical analysis and compliance reporting. Be careful not to confuse this with shorter audit log retention periods common in standard cloud provider tools.

Correct answer: B. Deploying Remediation & Response resources (like serverless functions) in the customer's cloud environment, triggered by Automation Rules based on Issues/Findings.

Wiz deploys Remediation and Response resources like serverless functions directly into your environment to automate fixes. Do not confuse this automated remediation with manual API exploration or CLI commands.

Correct answer: C. Wiz Broker

The Wiz Broker acts as a secure reverse proxy tunnel connecting the backend to private or isolated resources. The Runtime Sensor and Admission Controller handle workload protection and policy enforcement, not network bridging.

Correct answer: C. AWS EKS (Elastic Kubernetes Service).

AWS EKS requires an additional specific onboarding step beyond the standard connector to scan its configuration. Remember that Wiz handles Azure AKS and GCP GKE automatically through their native connectors.

Correct answer: C. Wiz does not indicate the user is an Admin, as there is little to no risk of account takeover.

Limiting permissions to a single resource minimizes account takeover risk, so Wiz does not flag the user as an Admin. Wiz reserves the Admin risk indicator for broad, high-impact access scopes.

Correct answer: D. GraphQL, providing flexibility and efficiency over multiple REST requests.

Wiz uses GraphQL for its API to give you flexible and efficient data retrieval. This architecture lets you query exact data needs in a single request instead of chaining multiple REST endpoints.

Correct answer: C. A Cloud Configuration Finding.

Failed Cloud Configuration Rules generate Cloud Configuration Findings on the Security Graph. Distinguish this from Host Configuration Findings, which focus on vulnerabilities inside the operating system.

Correct answer: B. The user must be familiar with Rego, the language in which CCRs are written.

You must know the Rego policy language because Wiz custom rules for the Admission Controller are written using it. Admin rights or deploying a Broker will not help you write the actual policy logic.

Correct answer: A. Use a Service Account with appropriate permission scopes.

Service accounts provide secure, non-interactive authentication with specific permission scopes for automation. Hardcoded API keys are legacy or meant for basic testing, while device code flows and interactive MFA logins fail unattended scripts.

Correct answer: B. A Service Principal created in Azure, identified by a Client ID and Client Secret.

Wiz requires a Service Principal with appropriate permissions, authenticated via a Client ID and Secret, to access an Azure Container Registry. Standard administrative credentials are unsupported because least-privilege programmatic access is expected.

Correct answer: D. Global roles with Write permissions on the Settings > Deployments page.

Global roles with Write permissions are required to create organization-wide Integrations and Automation Rules. Project-scoped roles lack the necessary cross-tenant visibility, causing integrations and triggered rules to fail outside their projects.

Correct answer: B. Rule type, severity, binding types, target resources, and project scope.

Ignore Rules offer granular scoping using rule type, severity, binding types, target resources, and project scope. This flexibility ensures false positives or accepted risks are suppressed precisely without hiding unrelated critical security issues.

Correct answer: A. The JSON tab in the resource's detail drawer.

The raw metadata fetched from the cloud provider API for a resource can be viewed by opening the resource detail drawer and navigating to the JSON tab. Configuration history tracks changes over time, while the graph builder visualizes relationships.

Correct answer: B. Configuring customer-managed SAML identity providers for Single-Sign On (SSO).

Configuring an external SAML identity provider for single sign-on is the recommended best practice because it centralizes identity management. Creating local accounts is only for break-glass scenarios, and API tokens are strictly for automation.

Correct answer: C. To ensure that all sensitive workload scanning (snapshots/disk clones) occurs entirely within the customer's environment, satisfying data residency and access regulatory requirements.

Wiz Outpost keeps workload scanning entirely within the customer environment to satisfy strict data residency and access regulatory requirements. Standard deployments send snapshot analysis back to the Wiz SaaS infrastructure.

Correct answer: C. Effective permissions and their usage.

The Identity Analyzer assesses effective permissions versus actual usage to identify overly privileged roles and potential lateral movement vectors. Network flow logs show traffic patterns but do not evaluate identity permissions directly.

Correct answer: C. WizCloudCostPolicy

The WizCloudCostPolicy is the optional managed policy required to retrieve cost data from AWS accounts for cloud cost features. Data scanning and defend policies focus on vulnerability analysis and runtime threat detection respectively.

Correct answer: C. Vulnerability findings and Cloud configuration findings.

Wiz generates vulnerability findings for software flaws and cloud configuration findings for misconfigurations like public storage buckets. While secrets and exposures are important risk vectors, they are ultimately correlated into issues rather than representing the primary scanning modules here.

Correct answer: C. Effective Exposure.

The correct answer is Effective Exposure because the Network Analyzer calculates this by mapping architecture, elements, and internet paths. Do not confuse this with Toxic Combinations, which represent chained risks rather than the baseline network path analysis.

Correct answer: B. Wiz for Cost Optimization framework

The Wiz for Cost Optimization framework is explicitly built to identify waste and architectural improvements to lower cloud bills. Security frameworks like CIS or MITRE ATT&CK focus on compliance and threat modeling, not financial savings.

Correct answer: C. Building the network architecture (the Wiz graph mapping)

The process starts by building the network architecture, which maps resources and network elements into the graph. Calculating exposure based on security rules happens after this initial architectural mapping phase is fully completed.

Correct answer: B. Global AD Administrator role

Although the permissions requested are read-only, Azure requires a Global AD Admin to approve the broad scope of permissions needed for identity analysis and audit log reading. Remember that subscription roles like Reader do not have the authority to grant directory-level consents.

Correct answer: C. A single Wiz Broker instance can only be mapped to one parent Integration, Connector, or cluster deployment.

A Wiz Broker operates with a strict one-to-one mapping requirement, meaning a single instance serves only one integration or connector. Do not assume a broker can aggregate multiple underlying connections, as this architectural limit is frequently tested.

Correct answer: C. Cloud events (security logs) that match specific criteria defined by Wiz.

Near real-time scanning is triggered by cloud events or security logs that match specific criteria defined by Wiz. Scheduled full scans are too slow for rapid assessment, so remember that event-driven architecture powers the timely updates.

Correct answer: C. A serverless parser function.

A dedicated serverless parser function inside the customer environment translates the JSON payload into actionable metadata for remediation playbooks. The Wiz Control Engine triggers the action but relies entirely on this localized parser.

Correct answer: B. Navigate to Settings > Integrations and add a GCS Integration.

Report export functionality relies on integrations, so you must configure a Google Cloud Storage integration under Settings before selecting the bucket. Avoid choosing report-level menus, as destinations are managed centrally via integrations.

Correct answer: C. The representation of the toxic combination as a Wiz Issue.

The policy management chain starts with resource collection, leading to findings, which feed controls, and finally culminates in a Wiz Issue representing a toxic combination. Automated remediation is a potential response, not the representation itself.

Correct answer: B. Findings are correlated with other risk factors to provide a full risk assessment of infected resources.

Wiz correlates malware findings with other risk factors like exposure and access to provide a contextualized and prioritized risk assessment. Findings are not automatically critical unless contextual risk elevates them.

Correct answer: B. Directory.Read.All, AuditLog.Read.All, and RoleManagement.Read.All.

The three key read permissions required for Entra ID identity analysis are Directory.Read.All, AuditLog.Read.All, and RoleManagement.Read.All. Watch for options containing write or delete permissions, as Wiz strictly uses read-only access.

Correct answer: D. WizLightsailScanningPolicy.

The WizLightsailScanningPolicy is specifically designed to grant the necessary permissions for workload and data scanning on Amazon Lightsail resources. General policies lack the specific service actions required for Lightsail enumeration.

Correct answer: C. Near real-time scanning feature enablement.

Enabling near real-time scanning uses Cloud Event Connectors to trigger rescans immediately after specific infrastructure changes. Broker deployments handle access, while admission controllers focus on Kubernetes deployment blocking.

Correct answer: B. Internal network exposure analysis.

Internal network exposure analysis requires the Advanced license because it calculates complex internal connectivity. Essential licenses include external exposure analysis, software bill of materials generation, and basic secrets scanning functionality.

Correct answer: B. GET /v2/_catalog

The standard Docker Registry API requires a successful GET request to the endpoint to retrieve a list of repositories. This allows Wiz to properly enumerate container images before pulling tags or manifests for vulnerability scanning.

Correct answer: C. The user's Wiz Administrator (to update their Role Based Access Control).

Portal permissions are governed by Wiz's Role Based Access Control. The user must contact their Wiz Administrator to adjust their assigned role or access scope within the tenant. The cloud provider admin manages cloud infrastructure, not portal access.

Correct answer: C. 'Trusted Service' must be enabled for CloudFormation StackSets in AWS Organization settings.

Enabling CloudFormation StackSets as a trusted service in AWS Organizations is required to automatically provision the necessary roles across multiple accounts. The root user should never be used for standard deployments.

Correct answer: D. Ignore Rules.

Ignore Rules explicitly suppress alerts when a finding and resource combination is deemed an acceptable risk or false positive. Custom Controls create new detections rather than tuning out existing noise for specific scenarios.

Correct answer: B. The user's role does not have the necessary permissions to view the requested data or perform the action.

An RBAC error means the user lacks the necessary permissions for their requested action or data view. Multi-factor authentication failures prevent portal login entirely rather than generating specific access errors.

Correct answer: B. Cloud Certificates (SSL/TLS certificates)

SSL or TLS certificates secure web communications and are managed via dedicated cloud services like AWS Certificate Manager. For the exam, remember that keys and certificates are treated as secrets, but standard KMS keys and SSH keys serve different encryption or access functions.

Correct answer: A. Remediation within 48 hours.

Wiz policy mandates remediating critical vulnerabilities on publicly exposed development and production systems within forty-eight hours. Shorter timeframes apply to internet-facing assets, whereas internal or low-severity findings typically allow longer remediation windows like fourteen days.

Correct answer: C. Enrich

The Enrich behavior allows Wiz to ingest external findings to add context to the Security Graph. Watch out for Consume, which can seem correct for ingesting data, but Enrich is the specific terminology for adding third-party security context.

Correct answer: C. roles/iam.serviceAccountAdmin, roles/iam.organizationRoleAdmin, and roles/iam.securityAdmin.

Connecting Wiz to a GCP organization requires specific administrative roles including service account admin, organization role admin, and security admin. Remember that standard project level roles are insufficient for organization wide access deployment.

Correct answer: C. The API Explorer.

The API Explorer is the in-app tool used to write, validate, and test GraphQL queries, which are essential for navigating the Security Graph. The Inventory page provides graphical filtering rather than direct programmatic querying.

Correct answer: D. Apache Struts

Among the provided options, Apache Struts features explicit support for end-of-life detection within Wiz's workload scanning capabilities. Standard SaaS platforms like Asana typically lack local workload EOL scanning, while frameworks might only trigger general package vulnerability alerts.

Correct answer: C. User Icon > Developer and using the keyboard shortcut Ctrl +

Developer tools are accessible via the User Icon menu and the Ctrl keyboard shortcut. Settings and Connect to Wiz pages handle infrastructure connectors and licensing, not direct API exploration or interactive GraphQL queries.