Wiz Cloud Fundamentals

Correct answer: D. Rego

Open Policy Agent uses the Rego declarative language to define Wiz Cloud Configuration Rules as code. For the exam, permanently associate Rego with custom configuration rules, while YAML and JSON are simply used for structural data formatting.

Correct answer: C. By assigning the Marketing department's resources to a dedicated Wiz Project, and then scoping the user's Role Based Access Control (RBAC) permissions to that Project.

Projects allow you to subdivide resources by department, and scoping RBAC permissions to that project restricts visibility. Ignore rules are for filtering alert noise, while configuration rules evaluate compliance rather than access.

Correct answer: D. Compliance Management tools

Compliance Management tools focus on consolidating findings to automate evidence collection and manage regulatory adherence. For the exam, distinguish this category clearly from SOAR and automation, which generally handles broader incident response and ticketing workflows rather than strict audits.

Correct answer: C. It uses cloud provider functionality to create an out-of-band snapshot or disk clone for scanning.

Wiz uses cloud provider functionality to create an out-of-band snapshot or disk clone for scanning. This ensures the analysis occurs entirely on ephemeral copies, separating the heavy scanning processes from the live workload to prevent any operational disruption.

Correct answer: B. Discovering complex risk correlations by traversing connected components.

The graph database model allows the Security Graph to efficiently discover complex risk correlations and attack paths by traversing connected components. SQL queries are incorrect because the underlying structure is a graph, not a relational database.

Correct answer: A. A finding is the result of a single policy violation, while an issue is the result of a toxic combination of multiple findings and risks.

A finding represents a single policy violation, while an issue is generated by a toxic combination of multiple findings and risk factors. Remember that issues represent critical attack paths, rather than just raw vulnerability data or simple network exposure.

Correct answer: C. The Security Graph

The Security Graph aggregates configuration details, resource relationships, and findings from various scanners to enable complex risk analysis. It maps these connections to identify toxic combinations, distinguishing it from the Network Analyzer or Configuration Rule Engine.

Correct answer: C. Periodically validating the status of potentially exposed ports and IP addresses.

The dynamic scanner periodically validates the actual operational status of potentially exposed ports and IP addresses identified during initial exposure analysis. Remember that the security graph builds the theoretical exposure model, while the scanner verifies if those paths are actually live.

Correct answer: C. responseFunctionId

The responseFunctionId specifies the exact remediation function that your custom automation stack needs to execute. When integrating Remediation and Response workflows, map this payload field carefully to ensure your serverless function triggers the correct corrective action.

Correct answer: B. To assess host configurations against official hardening benchmarks for OS and applications.

Host Configuration Rules assess host configurations by validating operating systems and applications against official hardening benchmarks. Do not confuse these with cloud configuration rules, which focus entirely on cloud control plane settings rather than internal workload hardening.

Correct answer: B. Agentless scanning via snapshot/disk clone.

Agentless scanning via disk snapshots allows deep analysis without impacting live workload performance. By analyzing an offline copy of the disk, Wiz extracts vulnerabilities and misconfigurations safely. The Runtime Sensor is used for live protection, not agentless scanning.

Correct answer: B. Utilizing the vSphere API via the Wiz Broker to list installed VIBs and their versions.

Wiz retrieves installation bundle information by utilizing the vSphere API. Because vSphere environments are frequently internal, the Wiz Broker is deployed to facilitate secure communication between the Wiz backend and your private vCenter API.

Correct answer: C. Container Registry Connector

The Container Registry Connector relies on the Wiz Broker to fetch images if the registry is private or lacks internet access. The Broker acts as a secure bridge, allowing the Wiz backend to communicate with isolated internal registry APIs.

Correct answer: C. Using Automation Rules with integrations like Slack or Jira.

Automation Rules link Issue state changes to integrated actions, enabling automated communication to external platforms like Slack or Jira. Manual actions require human intervention, which defeats the requirement for automated messaging.

Correct answer: D. 180 days.

Resolved Wiz Issues are retained for 180 days after resolution by default. Memorize the standard data retention timelines for Wiz Issues, as these lifecycles frequently appear on the certification exam.

Correct answer: B. The Network Analyzer, which calculates the effective exposure based on cloud service provider (CSP) network information.

The Network Analyzer builds a model of the network architecture and calculates the effective exposure of public-facing resources using information gathered directly from the cloud service provider. The Dynamic Scanner verifies exposure paths but does not model them initially.

Correct answer: C. Metadata, such as resource identifiers and security findings (redacted where necessary).

The Wiz backend is designed only to store metadata and security findings, with sensitive data redacted to avoid storing intact copies. Wiz does not permanently retain full copies of customer data from VM disks or databases.

Correct answer: B. By identifying the latest installed kernel version via the OS package manager and checking the vendor's update stream.

Wiz uses the OS package manager to identify the installed kernel version and checks the vendor's update stream for associated vulnerabilities. Avoid options suggesting runtime sensors or API queries, as agentless scanning leverages existing package data and external threat intelligence.

Correct answer: B. It has a very small resource footprint, usually not requiring more than 100 milliCPU and 128MiB of memory.

The Wiz Broker is designed to be lightweight, requiring minimal resources like one hundred milliCPU and one hundred twenty-eight mebibytes of memory. Avoid options claiming it requires heavy compute or full administrative privileges, since its primary role is secure tunneling.

Correct answer: C. Secrets

The Secrets risk domain handles scanning repository branches and commits to uncover exposed credentials. External Exposure focuses on internet-facing attack surfaces, while Cloud Entitlements analyzes permissions.

Correct answer: C. Information taken directly from the cloud service provider (CSP).

The Network Analyzer calculates effective exposure using configuration information retrieved directly from cloud service provider APIs. It does not rely on synthetic traffic generation or audit logs, making CSP integration essential for accurate network modeling.

Correct answer: B. Policy Rules (like CCRs and HCRs)

Policy Rules, such as Cloud Configuration Rules and Host Configuration Rules, generate the foundational findings on the Security Graph. Remember that automation rules act on existing issues, while configuration rules actually discover the raw ingredients.

Correct answer: A. Settings > Ask AI page (Remote MCP Server must be enabled)

The remote Model Context Protocol Server must be enabled on the Settings, Ask AI page. While the graph search bar handles typed queries, the artificial intelligence assistant integration requires activating the remote server specifically in settings.

Correct answer: C. Known and unknown threats and malicious behaviors in real-time runtime.

The Runtime Sensor is specifically designed to detect known and unknown threats and malicious behaviors in real time. In contrast, the agentless scanner focuses on static analysis, like finding disk vulnerabilities or exposed secrets.

Correct answer: A. Resource Tag rules.

Resource Tag rules allow you to dynamically apply tags to resources based on Security Graph query results. Cloud Configuration Rules evaluate baselines, but Resource Tag rules specifically handle this dynamic graph-based tagging workflow.

Correct answer: C. Full-stack Visibility

The Full-stack Visibility phase focuses on comprehensive coverage, normalization, and context mapping. Preventive and Proactive security phases come later in the framework, focusing on shifting left and reducing risk.

Correct answer: C. Wiz Outpost deployment

Wiz Outpost performs all workload scanning directly within the customer environment, ensuring Wiz never accesses VM volumes. The default SaaS deployment relies on snapshot sharing, which violates strict data isolation regulations.

Correct answer: A. Python

Custom response functions for Remediation and Response across all supported clouds must be written in Python. Rego is used for policy rules, and Terraform handles infrastructure provisioning, but neither builds custom automated responses.

Correct answer: B. It enables the Wiz backend to perform continuous monitoring of the broker's health and activity.

The persistent connection enables the Wiz backend to perform continuous monitoring of the broker's health and activity directly from the portal. This improves reliability over older polling models, though it is important to remember that outbound internet connectivity is still required.

Correct answer: B. Authentication using a dedicated Wiz service account.

A dedicated Wiz service account is the recommended method for automating tasks in production environments, including CI/CD pipelines. Service accounts provide secure, non-interactive authentication, whereas API tokens generated via the GUI are typically tied to individual users and expire.

Correct answer: B. API keys, passwords, encryption keys, tokens, and credentials.

Cloud secrets are technical credentials enabling system access, such as API keys, passwords, and tokens. Remember that secrets management in Wiz focuses strictly on authentication artifacts, not broader sensitive business data like financial records or employee information.

Correct answer: B. The Customer must manage service accounts and keep Wiz credentials confidential.

The customer is explicitly responsible for managing accounts within their Wiz tenant and keeping associated credentials confidential. While Wiz handles platform security, securing your service account keys ensures safe non-human access to the environment.

Correct answer: B. To trigger changes to Issues and Threats on Wiz itself (e.g., closing an Issue or changing its severity).

Platform Actions are used to trigger changes to objects directly within the Wiz portal, such as modifying issue severity or status. Do not confuse these with cloud actions, which interact with your actual cloud provider to quarantine resources.

Correct answer: B. The Settings > Audit Log page.

Remote Wiz MCP Server activity is specifically logged on the Settings > Audit Log page. For the exam, remember that user interactions with AI assistants via MCP are treated as auditable platform events, which differ from runtime cloud events.

Correct answer: B. Uploading the hash for the file or set of files as a custom file detection.

Custom file detections allow users to upload hashes for specific files, allowing Wiz to monitor their presence based on defined policy tuning needs. Modifying Rego code is used for configuration assessments, not for identifying specific intellectual property files.

Correct answer: C. AWS Lambda function.

In AWS Remediation and Response, a serverless parser function running on Lambda receives the event payload and converts the Issue data into details needed by the remediation playbooks. SQS and SNS handle message routing rather than parsing the JSON payload.

Correct answer: B. Wiz must calculate the effective exposure of all detected resources.

Wiz calculates effective exposure and permissions before initiating the data scanner process, as context on exposure and access is necessary to properly assess risk. Threat detection rules trigger alerts, whereas exposure determines if data scanning is warranted.

Correct answer: B. Correlating the vulnerabilities in Cycode with relevant information from the source code for remediation.

Cycode pulls container image vulnerabilities from Wiz to correlate them with source code information, facilitating root cause analysis and code-level remediation. Wiz does not automatically fix the container vulnerabilities, nor does Cycode enrich the Wiz Security Graph directly.

Correct answer: C. Python

Custom response functions for AWS remediation in Wiz must be written in Python to align with the AWS Lambda execution environment. Rego is used for policy authoring, while other languages are not supported for these specific custom remediation scripts.

Correct answer: B. A common scenario where Wiz lacks direct access due to non-onboarded external components.

Incomplete exposure modeling often occurs when third-party firewalls or network virtual appliances are not properly onboarded into Wiz. Because Wiz relies on visibility, unmanaged external proxies create blind spots rather than indicating an agentless scanning failure.

Correct answer: C. Infrastructure-as-code (IaC)

Infrastructure-as-code enforces automated and traceable changes, establishing a strict change management baseline. On the exam, remember that immutable infrastructure replaces servers instead of modifying them, making it the wrong choice for governing manual code changes.

Correct answer: C. Reversing Labs.

Wiz augments its proprietary malware engine with threat intelligence from Reversing Labs for hash-based detection. Note that Virus Total is a distractor, but Reversing Labs is the specific integrated provider for this workflow.

Correct answer: A. The VMware vCenter API.

Wiz retrieves information on vSphere Installation Bundles on ESXi hosts by utilizing the vCenter API, often facilitated by the Wiz Broker for on-premises connections. The NSX API is a distractor meant for networking rather than host package analysis.

Correct answer: B. Via a container image containing the core packages and built-in functions.

The Remediation and Response components for GCP are bundled within a single container image containing the necessary Python packages and built-in functions. Eliminate options mentioning Cloud Storage buckets or pre-installed service accounts.

Correct answer: C. The CCR must be explicitly set to function as a Control to generate an Issue.

Remediation actions rely on Issues as triggers, so a rule must be configured to function as a Control to generate an Issue when violated. Rules merely generate Findings unless promoted to Controls.

Correct answer: C. Wiz Admission Controller (Wiz AC).

The Wiz Admission Controller is deployed in Kubernetes clusters to enforce policies defined using rules, auditing or blocking resource creation that violates policy. The Wiz Broker is only for access brokering, not Kubernetes deployment enforcement.

Correct answer: B. Findings generated by policies are aggregated by controls to identify a toxic combination (Issue).

Policies generate individual Findings, which Controls then consume to identify toxic combinations that result in creating an Issue. A practical exam cue is remembering that Policies create Findings, and Controls create Issues.

Correct answer: B. To perform the VM scan (creation and scanning of snapshots).

The Scanner application is dedicated to performing the agentless workload scan function, creating and analyzing snapshots of virtual machines on behalf of the Outpost. It does not handle metadata fetching or event payload parsing.

Correct answer: C. On the Wiz security graph.

Findings, including vulnerabilities, are modeled and placed directly on the Wiz security graph, where they are correlated with other risks to form Issues. Avoid choosing dedicated dashboards, as they merely visualize data rather than store it.

Correct answer: B. Settings > Automations > Create Rule

Automation Rules linking triggers to actions are created under Settings, Automations, and Create Rule. Remember that you cannot add actions directly inside the Cloud Configuration Rules interface, making the Policies option a trap.

Correct answer: C. Wiz Orchestrator Node Pool Role (with Data Policy)

The Wiz Orchestrator Node Pool Role, when configured with the Data Policy, grants the EKS nodes permissions to execute DSPM database scans. The standard Wiz Access Role is for the main SaaS connector, not Outpost data scanning.

Correct answer: C. Wiz Orchestrator Node Pool Role.

The Wiz Orchestrator Node Pool Role is assumed by the EKS worker nodes to execute low-level snapshot scanning tasks. The Wiz Access Role is used by the SaaS platform for general read-only API access, not snapshot operations.

Correct answer: B. Python 3.11.

Custom response functions for Azure remediation must support Python version three point eleven. This specific version is supplied directly within the Wiz container image and is the supported requirement for the Azure Functions environment as of two thousand twenty six.

Correct answer: B. Defining whether the infrastructure will be allowed to run in 'All resources' or a 'Selected projects' list.

Selecting deployment scope acts as a guardrail by restricting remediation infrastructure to explicitly approved projects. You will choose between all resources or selected projects to ensure response actions only execute within properly authorized boundaries.

Correct answer: C. Wiz MCP Server via 'Get account team contacts' tool

The Wiz MCP Server provides a dedicated tool to retrieve details for the account team and tenant contacts configured for escalation. Familiarize yourself with administrative toolsets, as portal contact retrieval is increasingly handled via programmatic interfaces.