Wiz Cloud Fundamentals

Correct answer: B. Settings > System Health

System Health Issues for deployed Wiz components like the Broker or Admission Controller are surfaced under Settings > System Health. For the exam, remember that operational connector health lives in Settings, not in the main Issues queue.

Correct answer: A. Cloud Configuration Rules configured in Wiz, and serverless playbooks deployed in the customer's environment.

Auto-remediation uses a hybrid model where Wiz defines the triggering rule, but serverless playbooks execute within the customer environment. Wiz does not host the remediation logic to maintain customer infrastructure boundaries.

Correct answer: C. An Azure Event Hub to stream activity logs.

Wiz ingests Azure activity logs by configuring an Azure Event Hub that streams events via Kafka. Sentinel and Log Analytics are monitoring tools, but the Event Hub is the specific streaming endpoint required.

Correct answer: C. To group resources by organizational unit, purpose, or business unit for focused management and security workflows.

Wiz Projects group resources by organizational unit or business unit to enable focused management. They establish logical boundaries that scope access control and streamline security workflows.

Correct answer: B. They are redacted to avoid storing intact copies of sensitive data.

Wiz redacts sensitive information within Secret and Data Findings before storing the results. This ensures intact sensitive data is never retained, reinforcing compliance while still alerting on the exposure.

Correct answer: B. Scanning code, IaC, and container/VM images locally or in the CI/CD pipeline.

The Wiz CLI supports shift-left security by scanning code, infrastructure-as-code, and container images early in the pipeline to generate SBOMs. While modeling VCS architecture is useful, it is a Wiz feature rather than a direct command-line interface capability.

Correct answer: B. To prevent the creation of new Wiz Issues for specific types of findings or resources in particular use cases.

Ignore rules prevent the creation of issues for specific findings or resources in approved scenarios. This allows teams to reduce noise without disabling scanning entirely, which is critical for maintaining operational focus and accurate reporting metrics.

Correct answer: B. API keys, passwords, encryption keys, tokens, and credentials.

Secrets include authentication data like API keys, passwords, tokens, and encryption keys. Wiz scans specifically for these hardcoded credentials to prevent unauthorized access, rather than scanning for general customer data like database records.

Correct answer: C. Automation Rules.

Automation Rules trigger actions based on Issue updates to notify teams via integrations like Slack and Jira. Unlike scheduled reports that simply summarize activity, automation creates real-time, targeted alerts for faster remediation.

Correct answer: C. Organization level deployment via AWS CloudFormation StackSets from the Management Account.

Deploying via AWS CloudFormation StackSets from the Management Account is recommended for managing multi-account organizations. This centralized method streamlines onboarding significantly compared to manually deploying individual roles across accounts.

Correct answer: C. GraphQL.

GraphQL provides the flexibility to query only the specific data needed, making it the standard for the Wiz API. For the exam, remember that GraphQL replaces rigid REST calls for dynamic, highly customizable data retrieval.

Correct answer: B. The basic remediation & response infrastructure must already be deployed in the customer's cloud environment.

Remediation and Response operates directly within the customer's cloud environment using their own permissions. You must deploy the foundational infrastructure stack, including the worker role and messaging services, into the target cloud before custom functions can execute.

Correct answer: B. A Finding is a single representation of a vulnerability/misconfiguration on a resource; an Issue represents a prioritized toxic combination of multiple findings/risks.

A Finding is a single security signal on one resource, while an Issue represents a prioritized toxic combination of multiple findings. This distinction is a crucial exam concept because Issues provide the actionable context needed for effective prioritization.

Correct answer: D. Wiz Terraform Provider

The Wiz Terraform Provider is the designated tool for managing Wiz resources, custom policies, and integrations as Infrastructure as Code. While the API allows mutations, the Terraform provider is specifically built for declarative deployment.

Correct answer: B. A Finding is a singular security signal (e.g., a vulnerability or misconfiguration), while an Issue is a 'toxic combination' modeling a critical, exploitable attack path.

A Finding is an individual security signal, whereas an Issue models a toxic combination of those findings into an exploitable attack path. Understanding this relationship is vital, as Issues drive Wiz's core approach to risk prioritization.

Correct answer: C. By using context to prioritize vulnerabilities that are involved in a critical attack path (toxic combinations) leading to sensitive data or lateral movement.

Wiz correlates findings using context to highlight only the vulnerabilities that form a critical attack path or toxic combination. Relying strictly on vendor severity scores without context is a trap, as it perpetuates alert fatigue rather than solving it.

Correct answer: C. The API Explorer

The API Explorer serves as the built-in playground for developers to write, validate, and test GraphQL queries against the live Wiz schema. The Wiz CLI is a separate terminal tool used for scanning rather than interactive query construction.

Correct answer: C. Cloud Connector with additional permissions and setup.

Ingesting Cloud Events for real-time threat detection relies on the Cloud Connector configured with additional permissions. The Broker handles scanning traffic, but event streaming requires expanding the connector's IAM access.

Correct answer: C. Explorer > Data Findings

The Explorer menu hosts the Data Findings page, which is dedicated to filtering DSPM classification results. Settings only configures the scanning rules, while Explorer visualizes the actual discovered sensitive data.

Correct answer: A. Owner or User Access Administrator role on the subscription/management group.

Users need the Owner or User Access Administrator role to connect Wiz at the Azure Subscription or Management Group level. This high privilege is required specifically to assign the necessary roles to the Wiz Enterprise App during setup.

Correct answer: B. Outpost is required for workload scanning, and only metadata results are sent to the Wiz backend.

Using Wiz Outpost in a China cloud requires local workload scanning because only metadata is sent back to the SaaS backend. This architecture maintains compliance with strict data sovereignty laws while still delivering full vulnerability analysis.

Correct answer: C. Highly regulated personally identifiable data, financial data, or health data findings.

Wiz Projects determine ownership for data security findings involving highly regulated information like PII, financial, or health data. Assigning these specific DSPM categories ensures the correct teams are notified for data governance remediation.

Correct answer: C. Settings > Deployments > Integrations.

Pull integrations for enriching the Security Graph are configured within the Wiz portal under Settings, then Deployments, and finally Integrations. Remember that this specific configuration requires write permissions on the deployments page.

Correct answer: C. Security Graph Analysis

The Security Graph is the core engine that correlates and analyzes complex relationships across configurations, vulnerabilities, and entitlements to calculate critical risks. Remember that graph analysis is what enables contextual attack path mapping, distinguishing it from simple compliance reporting.

Correct answer: B. As Cloud Events.

Admission Reviews processed by the Wiz Admission Controller are ingested and managed in the portal as Cloud Events. For the exam, link Kubernetes admission control activities directly to the Cloud Events processing pipeline rather than standard vulnerability findings.

Correct answer: C. Malware Analyzer

The Wiz Malware Analyzer leverages proprietary YARA rules alongside hash-based threat intelligence to detect malicious files. Distinguish this from the Vulnerability or Data Scanners, which look for software bugs or sensitive data, rather than malicious patterns.

Correct answer: A. By modeling the DAST findings on the Security Graph against Application Endpoint objects.

Dynamic black-box testing findings are modeled directly onto Application Endpoint objects within the Wiz Security Graph. This graph-based correlation is a core concept, unlike generating configuration findings or simply tagging results as malware.

Correct answer: B. Read-only permissions.

Wiz DSPM adheres to the principle of least privilege and requires only read-only permissions to sample data and provide continuous visibility. It does not need administrative or write permissions because it simply inventories and classifies the discovered resources.

Correct answer: C. They should be inserted directly without quotation marks.

Template variables that output JSON structures must be inserted directly without any surrounding quotation marks. If you wrap them in quotes, the JSON payload will be treated as a plain string, which will break the integration request body formatting.

Correct answer: C. Workload Scanning in China Clouds.

Due to strict data residency regulations, workload scanning in Chinese cloud environments requires an explicit Wiz Outpost deployment. This ensures that all scanning and data processing happen locally within the customer boundary, separate from the standard connector.

Correct answer: C. It identifies the latest installed kernel version via the OS package manager and checks the vendor's update stream for associated vulnerabilities.

The correct answer works because Wiz checks the OS package manager for the installed kernel version and maps it against the vendor update stream. For the exam, remember that Wiz relies on package manager data for Linux vulnerabilities, not real-time runtime sensors.

Correct answer: B. The dedicated Data Security Dashboard

The dedicated Data Security Dashboard is correct because it specifically summarizes critical toxic combinations involving sensitive data findings. While you could use the Security Graph manually, the dashboard provides the out-of-the-box summarized view needed for quick prioritization.

Correct answer: C. Global roles

Global roles is correct because they possess the tenant-wide scope required to build integrations spanning all projects and to configure their automation rules. Project-scoped roles lack the necessary breadth, making them a common trap if you overlook cross-project requirements.

Correct answer: B. Configuring Single Sign-On (SSO) using SAML identity providers.

Configuring Single Sign-On using SAML is correct because it centralizes identity management and enforces robust access controls for the tenant. While removing expired service accounts is good hygiene, establishing SSO is the primary shared responsibility requirement.

Correct answer: B. Create disk snapshot/clone -> Mount to Wiz-managed cluster in the same region -> Scan statically -> Send only security metadata to Wiz backend -> Delete disk representation.

Creating a disk snapshot to scan statically on a regional cluster is correct because it highlights the agentless out-of-band scanning process. A key exam takeaway is that Wiz only sends extracted security metadata back to its backend, never full disk contents.

Correct answer: B. Client ID, Client Secret, API Endpoint URL, and API Authentication URL.

The Client ID, Client Secret, and endpoint URLs are correct because these credentials authorize external systems to pull data via the API. Remember that Wiz only displays these specific secret values once during creation, making immediate copying essential.

Correct answer: A. Creating custom Controls by defining a custom Security Graph query linked to a specific severity.

Creating custom Controls with graph queries is correct because it lets you tailor risk detection to specific environmental needs. You cannot directly modify the underlying logic of built-in rules, which is a frequent distractor on the exam.

Correct answer: C. Issue

An Issue is correct because it represents the contextual aggregation of multiple findings into a prioritized, exploitable toxic combination. A Control is simply the query rule that detects the risk, while the Issue is the actual resulting alert.

Correct answer: B. To enforce security policies by auditing or blocking resource deployments or modifications that violate pre-defined policies.

Enforcing security policies by auditing or blocking deployments is correct because the Admission Controller acts as a Kubernetes gatekeeper. It operates preemptively at deployment time, contrasting with continuous network monitoring or agentless scanning options.

Correct answer: C. Spin up an entirely new, standalone Wiz tenant for each TC.

Creating a completely standalone Wiz tenant for each target company ensures maximum data segregation during mergers and acquisitions. Relying on projects or RBAC within a shared tenant risks accidental data leakage between the parties.

Correct answer: C. Automation > Automation Rules > Create Rule.

Automation Rules are configured in the dedicated Automation section by defining a trigger and a corresponding action. Do not confuse global automation triggers with control actions, which are configured separately within the Policies menu.

Correct answer: C. Inventory > Container Registries.

The Container Registries page under the Inventory tab lists all manually connected and auto-discovered registries in the environment. Reviewing the SBOM is helpful for package vulnerabilities but does not map the actual registry infrastructure connections.

Correct answer: B. Hosted Technology detection

Hosted Technology detection identifies frameworks like Angular and Go through application fingerprinting. Software Bill of Materials focuses on package dependencies, whereas this feature profiles the running infrastructure.

Correct answer: C. Workload scanning.

Workload scanning is responsible for generating Host Configuration and Vulnerability findings by examining the actual machine snapshots. While API interrogation gathers high-level cloud control plane data, deep host analysis relies entirely on agentless workload scanning.

Correct answer: B. Enterprise support

Enterprise support is the level that provides access to Technical Account Managers and specific training offerings like certifications. Note that Elite is not a standard tier, making Enterprise the definitive choice for large organizations needing dedicated resources.

Correct answer: C. APIs and Required Permission Scopes documentation

The dedicated APIs and Required Permission Scopes documentation provides the mapping between GraphQL queries and their necessary scopes. Do not confuse this with the in-product audit log, which tracks historical user activity rather than serving as a development reference.

Correct answer: C. Python version 3.11.

When creating custom Azure response functions, you must use Python version 3.11 to match the container image provided by Wiz. The exam expects you to know the specific technical constraints for deploying these automated remediation scripts in cloud environments.

Correct answer: B. A fully deployed Azure Self-managed Network Outpost.

Scanning a private Azure Container Registry without internet access requires deploying a self-managed network Outpost inside your environment. A standard Broker handles external API connections, while the Outpost architecture provides the necessary local network reachability.

Correct answer: B. Infrastructure-as-Code (IaC)

Infrastructure-as-Code is the correct security design principle because it ensures changes are made via automated code with strict controls over manual interventions. Do not confuse this with immutable infrastructure, which focuses on replacing components rather than modifying them.

Correct answer: D. Wiz AC requires either a Wiz Cloud Advanced or Wiz for Gov Advanced license.

The key requirement is that the Wiz Admission Controller requires an Advanced license tier for deployment. While licensing is an important implementation prerequisite, the phrasing comparing it to agent-based limitations makes this a slightly flawed but valid question.