Wiz Cloud Fundamentals

Correct answer: B. Inventory > Technology Inventory page

The Technology Inventory page specifically lists the hosted technologies, coding languages, operating systems, and applications detected across workloads by Wiz. For the exam, rely on this page whenever you need to locate specific software or OS environments.

Correct answer: C. The Findings pages (e.g., Vulnerability Findings, Cloud Configuration Findings).

A finding represents a single instance of a risk on a specific resource, and the individual findings pages are used to view these. Distinguish this from the Issues page, which aggregates multiple findings to track broader remediation workflows.

Correct answer: B. Scanning the workload by creating disk snapshots or clones 'out of band'.

The correct answer works because Wiz scans out of band using disk snapshots, keeping the live workload untouched. For the exam, remember that Wiz avoids heavy agents; continuous live monitoring or runtime API polling would defeat the agentless design goal.

Correct answer: D. It highlights which vulnerabilities are involved in a critical attack path leading to sensitive data or lateral movement, helping to prioritize remediation.

The correct answer works because Wiz maps vulnerabilities to attack paths, showing exactly which flaws lead to sensitive data. Avoid options relying solely on CVSS scores; the practical exam cue is that context transforms raw vulnerabilities into prioritized, actionable risk.

Correct answer: B. --multi-tenant

The multi-tenant parameter must be added to the deployment script to allow scanning across different Azure tenants. This is a highly specific command-line flag, so memorizing the exact parameter names for Outpost deployments is crucial for exam success.

Correct answer: C. The API Explorer.

The API Explorer serves as the native tool for writing, validating, and testing GraphQL queries against the Security Graph. While Inventory provides a visual UI, the Explorer is the direct interface for programmatic querying and relationship mapping.

Correct answer: C. External Enrichment Integration.

External Enrichment integrations are specifically designed to ingest findings from third-party tools and layer them onto the Security Graph. A standard Push Integration simply sends Wiz alerts outbound rather than pulling context into the graph.

Correct answer: B. Defining security policies as code over complex hierarchical data structures (CSP JSON objects).

Rego is the declarative policy language used with Open Policy Agent to evaluate complex JSON data structures from cloud providers. It does not execute scripts or perform network analysis, but rather defines the configuration rules as code.

Correct answer: C. By using template variables surrounded by double curly braces (e.g., {{resourceName}}).

Template variables enclosed in double curly braces allow dynamic injection of resource data into the payload sent to external tools. You cannot alter the third-party API schema from within Wiz, so native templating provides the required customization.

Correct answer: C. Wiz Cloud Advanced

Container registry scanning, Threat Detection Rules, and Outpost are exclusive features of the Wiz Cloud Advanced commercial license. Knowing which capabilities belong to the Essential versus Advanced tiers frequently appears on the exam.

Correct answer: C. Toxic Combination (Issue).

A Toxic Combination synthesizes multiple individual findings across different risk categories into a single prioritized issue. A standalone configuration rule violation is just a finding, whereas an issue requires correlating multiple security risks.

Correct answer: B. A sensitive data finding combined with a real-time data exfiltration attempt.

Data Leakage specifically requires pairing a sensitive data finding with evidence of a near real-time exfiltration attempt. Simply pairing sensitive data with external exposure results in a different risk category, such as Unprotected Data, rather than active leakage.

Correct answer: B. TLS 1.2 or greater encryption.

Wiz secures all communications between its backend and the customer cloud environment using TLS 1.2 or higher encryption. No proprietary protocols or dedicated VPN tunnels are required for the standard SaaS scanning architecture.

Correct answer: B. Cloud Cost

The Cloud Cost feature provides cloud spending visibility and optimization recommendations for AWS and Azure. Remember that FinOps capabilities in Wiz are tied directly to this specific module, rather than being driven by resource tags or dynamic scanners.

Correct answer: B. Because it combines with other signals to potentially model toxic combinations.

Public exposure is an inherent risk because Wiz combines it with other security signals to model exploitable attack paths, known as toxic combinations. Intentional exposure does not automatically violate compliance rules, but it acts as a critical multiplier.

Correct answer: B. roles/iam.serviceAccountAdmin, roles/iam.organizationRoleAdmin, roles/iam.securityAdmin

Deploying Wiz at the GCP Organization level requires specific administrative roles for service accounts, organization roles, and security. For the exam, focus on this exact combination of IAM roles rather than general compute or storage privileges.

Correct answer: C. Wiz CLI

The Wiz CLI shifts security left by detecting risks like host misconfigurations and secrets directly within the command line or CI/CD pipeline. Use this as your exam cue for developer integrations, contrasting it with runtime sensors for production environments.

Correct answer: C. A Docker host with the Wiz Broker installed.

A Docker host running the Wiz Broker is required to act as a reverse proxy when the vCenter API is not internet-facing. This broker bridges the gap between your isolated vSphere environment and the Wiz backend for scanning.

Correct answer: B. Infrastructure lacks persistent storage, ensuring metadata is stored only in secured databases.

Immutable infrastructure means components lack persistent storage, ensuring metadata is stored only in secured, external databases. A solid exam takeaway is that this architecture prevents post-deployment modifications, directly supporting Wiz's security and data isolation model.

Correct answer: C. Partially covered cloud services.

The correct answer is partially covered cloud services, as Wiz lists them on the Technologies page as technology usage objects. A strong distractor is fully covered services, which instead receive dedicated resource objects and full risk analysis within the Security Graph.

Correct answer: C. The API Console.

The API Console is correct because it captures exact GraphQL payloads as you click through the portal, which is perfect for building custom scripts. Do not confuse this with the API Explorer, which only helps you manually write and test queries.

Correct answer: B. According to the maximum number of unique matches found.

The correct answer works because Wiz calculates severity based on the maximum number of unique matches across all files on that resource. Ignore options suggesting averages or severity caps; Wiz uses the highest count to reflect the true exposure accurately.

Correct answer: B. The Principal value (Wiz account ID) and the sts:ExternalId value (Tenant ID).

The correct answer works because the trust policy must map the Wiz account ID as the Principal and the Tenant ID as the external ID. Distractors listing policy ARNs fail because those belong in the permissions policy, not the trust relationship section.

Correct answer: B. Inventory > Technologies page.

Partially covered services are cataloged on the Inventory Technologies page to show what is detected but not fully analyzed. Settings only displays configured connectors, while the Security Graph maps fully supported resource relationships.

Correct answer: B. Wiz Cloud Advanced or Wiz for Gov Advanced.

The correct answer works because integrating identity providers like Okta requires the higher feature thresholds found in Wiz Cloud Advanced. For the exam, associate identity and secrets scanning with advanced licensing rather than basic entry level tiers.

Correct answer: B. Policy Update trigger: Created.

Policy Update triggers are specifically designed to notify users when changes or new policies are introduced by Wiz, allowing customers to review implementation schedules. Cloud Event triggers handle runtime occurrences, not platform policy announcements.

Correct answer: C. In SaaS, Wiz infrastructure performs the workload scan; in Outpost, customer infrastructure performs the scan, and only security metadata results are sent to Wiz.

The primary distinction is the location where workload scanning executes. In the SaaS model, Wiz infrastructure scans the data, whereas the Outpost model executes scans within customer infrastructure, sending only security metadata back to the Wiz SaaS backend.

Correct answer: B. Cloud platform access keys or SSH keys

Wiz detects hardcoded credentials like cloud platform access keys and SSH keys left exposed on system volumes. Customer-managed encryption keys are managed cloud services, while multi-factor authentication tokens are temporary runtime sessions.

Correct answer: C. Open Policy Agent (OPA) and Rego.

Wiz uses the Open Policy Agent framework to evaluate cloud configuration checks against raw resource data. The rules are written in the Rego declarative language. Terraform and HCL are infrastructure provisioning tools, not policy engines.

Correct answer: B. To analyze permissions granted and used to discover lateral movement paths and highlight high-privileged roles.

The Identity Analyzer evaluates effective permissions to uncover lateral movement paths and over-privileged identities. It goes beyond basic network mapping by highlighting risky permission combinations, whereas scanning for keys relies on workload analysis.

Correct answer: D. Wiz Broker

The Wiz Broker acts as a lightweight reverse proxy creating a secure tunnel to isolated resources. It allows the Wiz backend to communicate securely with internal instances like Jira without requiring inbound internet access.

Correct answer: B. Policy Update trigger.

The Policy Update trigger allows you to notify external systems when Wiz announces new or updated policies. Cloud Event triggers handle cloud provider logs, while Audit Log triggers monitor user actions within the Wiz platform itself.

Correct answer: C. The Windows Knowledge Base (KB) updates.

For Windows environments, Wiz scans the installed Windows Knowledge Base updates to identify missing security patches and vulnerabilities. For the exam, remember that Wiz maps detected vulnerabilities to specific KB updates rather than analyzing the host firewall or kernel.

Correct answer: C. Correlation Rules.

Correlation rules are used for detecting complex sequences of events that indicate a broader threat pattern, as opposed to cloud event rules, which monitor single events. Use this distinction to easily separate sequence-based detections from isolated alerts.

Correct answer: B. Overprivileging (Excessive Access)

The identity analyzer focuses heavily on identifying overprivileging or excessive access, where identities possess permissions that are unused or exceed least privilege. The exam cue here is equating unused identity rights directly with excessive access.

Correct answer: C. Explicit and Effective IAM policies.

Wiz analyzes both explicit and effective IAM policies as part of its effective permissions analysis to identify risks like over-privileging and lateral movement. Explicit policies are assigned directly, while effective policies include inherited group memberships.

Correct answer: C. Python (supporting version 3.12 in Lambda).

Custom response functions for AWS Remediation and Response are written in Python, designed to run within the AWS Lambda environment. For the exam, associate remediation automation directly with Python, while remembering that Rego is used strictly for defining Wiz configuration rules.

Correct answer: B. It scans files using proprietary YAR rules which may detect patterns not malicious in public databases.

Wiz uses proprietary YARA rules to scan for cloud-specific malware behaviors, catching threats not yet in public hash databases. A helpful exam tip is to differentiate static scanning from runtime analysis, as the malware analyzer does not strictly require the runtime sensor.

Correct answer: B. Wiz CLI and Wiz Admission Controller deployments.

The correct answer is Wiz CLI and Admission Controller deployments, as these are enablement tools excluded from billable unit counts. Remember that compute workloads, container images, and Wiz OS instances are the actual licensed entities you must track.

Correct answer: C. Managing the EKS cluster, assumed by the Wiz Orchestrator Role.

The Orchestrator EKS Role specifically manages the EKS cluster that hosts Outpost scanner components and is assumed by the primary Orchestrator Role. Remember that the EKS role handles orchestration infrastructure, while a separate read-only connector role fetches the actual IAM policies.

Correct answer: B. Use device code flow tied to their Wiz user account, requiring a Wiz Code license add-on.

Local directory scans use device code flow tied to the user's identity, which requires the Wiz Code license add-on. Service accounts or pipeline tokens are meant for automated automation, whereas interactive developer workflows rely on interactive authentication.

Correct answer: C. Threat Center

The Threat Center is the dedicated hub for tracking emerging global threats and analyzing their impact on your resources. While configuration findings show misconfigurations, Threat Center specifically contextualizes active risks and zero-day advisories.

Correct answer: D. Metadata related to VM properties, networking rules (like Security Groups), and resource tags.

The Cloud Scanner uses API calls to gather control-plane metadata, such as VM properties, tags, and networking rules. Deep inspection tasks, like finding OS packages or exposed keys, are handled by the agentless workload scanner looking at disk volumes.

Correct answer: B. Severities are assigned based on the Common Vulnerability Scoring System (CVSS) and data ingested from dozens of public sources, including NVD and cloud service providers (CSPs).

Wiz determines vulnerability severity primarily using industry-standard CVSS scores, enriching the data with threat intelligence from public databases like NVD. Wiz does not rely on arbitrary proprietary scales, ensuring alignment with standard CVE assessments.

Correct answer: B. The Wiz Runtime Sensor.

The Wiz Runtime Sensor provides live behavioral telemetry for real-time threat detection inside active workloads like Kubernetes clusters. The agentless workload scanner only provides a static point-in-time snapshot of vulnerabilities on disk.

Correct answer: C. Cataloging hosted software, operating systems, and partially covered cloud services found across workloads.

The Technology Inventory catalogs software, operating systems, and partially covered services found across workloads. It focuses strictly on application stacks, distinguishing it from the resource graph which tracks cloud infrastructure objects like buckets.

Correct answer: B. Wiz is granted read-only permissions (Wiz Access Role) to fetch cloud metadata.

The standard SaaS connector deploys a read-only role to safely fetch cloud metadata. Wiz avoids requiring administrator or write permissions for environmental scanning to strictly adhere to least privilege principles, using external identifiers solely for role assumption.

Correct answer: C. By organizational unit (e.g., Dev team 1), purpose (e.g., production), or business unit.

Projects segment cloud estates by organizational structures like business units, teams, or environments to enforce accountability. They are not limited to a single cloud provider or resource type, enabling flexible ownership tracking across diverse assets.

Correct answer: B. Configured network security rules

The exposure path is calculated using configured network security rules like security groups and network ACLs. This simulates allowed traffic flow across mapped resources, ignoring real-time telemetry which is not part of this graph calculation.

Correct answer: B. The user must navigate to the 'Forgot Password' link on the login page, initiating an email reset process that expires in 1 day.

Local user password recovery is done through an automated email reset link initiated by the user, which is valid for only one day. If a user logs in via an identity provider, password resets must happen there, not in Wiz.

Correct answer: B. Redacted snippets of code and masked data samples.

Wiz stores only minimal, heavily redacted metadata, such as masked data samples or code snippets necessary for remediation. Full disk images and complete files are intentionally excluded to maintain strict privacy and security boundaries.

Correct answer: D. A single broker instance cannot serve multiple different Connectors or third-party integrations.

A design constraint is that a single Wiz Broker instance is dedicated per connector or third-party integration. It cannot multiplex connections for several different services. Brokers are deployed within the customer environment using various methods.

Correct answer: B. AWS SQS queue

Remediation and response deployments often utilize an SQS queue to receive event payloads, which are then processed by a serverless function like Lambda. Remember that SNS is a push pub sub service, while SQS holds the message buffer.