Wiz Cloud Fundamentals

Correct answer: B. Findings represent atomic, low-context risks; Issues represent high-context, toxic combinations/attack paths.

Findings represent low-context, atomic risks, whereas Issues aggregate those risks into highly contextual attack paths. Remembering that Issues highlight toxic combinations is a crucial conceptual distinction.

Correct answer: B. Connecting via the Organization level using CloudFormation or Terraform.

Connecting at the Organization level using CloudFormation or Terraform ensures both existing and future AWS accounts are automatically discovered. Avoid connecting individual accounts manually, as this creates administrative overhead and leaves new accounts vulnerable to visibility gaps.

Correct answer: A. Wiz temporarily processes sensitive data during SaaS scanning but avoids storing intact copies in its backend.

Wiz adheres to a strict metadata-only design principle for its backend storage. While sensitive data might be temporarily processed during scans, it is never stored intact, and sensitive values like discovered secrets are redacted before anything is saved.

Correct answer: C. Write (W) permission on service accounts.

Creating a new Service Account requires Write permissions specifically on service accounts. Remember that read access only allows viewing existing configurations, while global roles are typically too broad and lack the specific write access needed for account creation.

Correct answer: A. Created, Resolved, or Due.

Posture Issues can reliably trigger Automation Rules when they are created, resolved, or approaching their due date. Options like ignored or archived statuses represent terminal states that do not actively initiate new automated workflows.

Correct answer: C. Custom data classifiers

Custom data classifiers allow customers to detect unique business-specific information beyond standard categories like PII. For the exam, associate custom classifiers strictly with proprietary data detection, whereas built-in rules cover standard regulatory information.

Correct answer: B. It flags the action so that only privileged users are permitted to execute it.

Marking a response action as disruptive restricts its execution to privileged users only. This provides a necessary guardrail against accidental outages, ensuring standard operators cannot accidentally trigger destructive auto-remediation workflows on critical resources.

Correct answer: C. Building the network architecture, calculating effective ingress (analysis), and dynamic scanner validation.

Calculating effective network exposure involves mapping the architecture, calculating potential ingress paths, and validating them dynamically. Remember that Wiz relies on static graph analysis combined with active scanner validation, rather than runtime monitoring or policy enforcement.

Correct answer: D. GraphQL

The Wiz API uses GraphQL, which provides greater flexibility than older REST endpoints, enabling users to request only the specific data needed in a single call. Expect to see GraphQL as the correct choice whenever questions emphasize API efficiency and defining precise data payloads.

Correct answer: B. Wiz Outpost deployment.

Due to regulatory and connectivity constraints in sovereign environments like AWS GovCloud, the Wiz Outpost deployment architecture is required for workload scanning. A standard SaaS deployment cannot reach these isolated environments, making the Outpost the mandatory architecture.

Correct answer: B. An API connection to the vCenter server that orchestrates the ESXi hosts.

The VMware vSphere Connector requires an API connection established with the vCenter server, which manages and orchestrates the ESXi hosts. Connecting directly to individual ESXi hosts is incorrect because vCenter provides the centralized management plane required for environment-wide scanning.

Correct answer: C. The Malware Analyzer using proprietary YARA rules

The Wiz malware analyzer uses a proprietary engine and YARA rules maintained by the Wiz research team to identify pattern-based generative malware commonly found in cloud environments. Rule out vulnerability management, as that focuses on known software flaws rather than identifying novel malicious code.

Correct answer: D. Storage Blob Data Reader

The Storage Blob Data Reader role provides the explicit read access needed for the Wiz application to scan blob contents. The standard Reader role only grants management plane access and cannot see the actual data.

Correct answer: C. https://app.wiz.us

The FedRAMP authorized Wiz for Gov environment specifically uses the app dot wiz dot us base URL. Remember that standard commercial tenants simply use the app dot wiz dot io domain.

Correct answer: B. Profile Icon > Developer > API Explorer

The API Explorer is located under the Profile Icon and Developer menu, allowing you to test queries safely. Remember that integrations are configured in system settings, not the developer workspace.

Correct answer: A. SOAR systems (like Cortex XSOAR/QRadar) or SIEMs (like Azure Sentinel/Splunk apps).

Wiz exports vulnerability data to security operations systems like SOARs and SIEMs to aid in incident response. Ticketing systems like Jira receive broader issue tracking data rather than just raw vulnerability feeds.

Correct answer: B. Common Vulnerability Scoring System (CVSS) and ingestion from sources like NVD and CSPs.

Wiz uses the Common Vulnerability Scoring System alongside external ingestion sources like NVD to assign vulnerability severities. CIS Benchmarks are a distractor because they evaluate cloud configurations rather than software vulnerabilities.

Correct answer: A. The Technology Inventory

The Technology Inventory is the designated portal feature for identifying hosted technologies and cloud services in the environment. The Threat Center fails as a distractor because it displays active security alerts rather than mapping the software landscape.

Correct answer: C. Wiz Projects

Projects establish logical boundaries that assign clear risk ownership to specific teams or business units. For gamification to work effectively, accountability must map exactly to these projects, rather than to broad policies or raw graph data.

Correct answer: B. Via workload scanning, which extracts information from disk snapshots/clones.

Host Configuration Rules are evaluated using data extracted during agentless workload scanning. Because these rules analyze the operating system state, Wiz relies on disk snapshots rather than standard API metadata, which only provides a surface-level resource overview.

Correct answer: B. API keys, passwords, encryption keys, tokens, and credentials.

Secrets include digital authentication mechanisms like API keys, passwords, and tokens used to secure access. Public configurations and audit logs are not secrets because they do not inherently provide privileged system access like compromised credentials would.

Correct answer: B. Wiz uses agentless scanning via API connectors to interrogate cloud APIs and perform out-of-band analysis on workloads.

Wiz performs agentless scanning by querying cloud APIs and analyzing disk snapshots out-of-band. This approach avoids the performance overhead and management complexity of persistent agents while providing deep visibility into vulnerabilities and configurations.

Correct answer: C. Automated Platform Actions

Automated Platform Actions execute internal workflows like updating issue statuses without external integrations. This keeps lifecycle management self-contained within Wiz, unlike integration-specific actions which are strictly built to interface with third-party tools.

Correct answer: C. Custom Graph Control or Cloud Configuration Rule.

Custom Cloud Configuration Rules or Graph Controls must be created first to detect the unique tagging violation and generate an Issue. Remember that response actions rely on these generated issues, as threat detection rules focus on runtime events rather than configuration states.

Correct answer: C. Tenant Info > General page

The Tenant ID used for the external ID is found under the Tenant Info General page in your settings. While deployment connectors list your cloud accounts, the actual tenant identifier needed for your IAM trust policy is located in the general settings.

Correct answer: B. Policies > Graph Controls.

The management interface for reviewing or creating controls is located under Policies, Graph Controls. For the exam, remember that Wiz separates policy creation from general inventory views, making Policies the central hub for configuring and tuning graph-based security rules.

Correct answer: B. Cloud Identity and Entitlement Management (CIEM) using effective permissions analysis.

Wiz performs effective permissions analysis on IAM policies to understand the actual actions that principals can perform, which is central to Cloud Entitlements Management. Avoid confusing this with configuration auditing, as CIEM specifically focuses on identity and access.

Correct answer: A. Grouping resources based on organizational units, purpose (e.g., prod/test), or business units.

Wiz Projects are used to logically subdivide the cloud estate to group resources by organizational units, purpose, or business unit for focused management and access control. They are not used for network segmentation, but rather for creating isolated logical boundaries within the Wiz tenant.

Correct answer: C. Wiz Access Role

The Wiz Access Role is the read-only role assumed by the Wiz backend to fetch cloud metadata, and its Trust Policy defines the required security credentials allowing Wiz to assume it. Distinguish this from the scanner role, which is specifically used during agentless workload disk scanning.

Correct answer: B. Configure scope limitations or update matchers within the TDR configuration.

Policy fine-tuning is accomplished by editing the TDR definition, where you can configure the project scope, adjust the matcher conditions, or modify the severity to ensure it targets only genuinely malicious events. Raising the severity alone will not reduce the volume of generated alerts.

Correct answer: B. Developer

The Developer role provides the exact minimum permissions needed for local CLI scanning and testing. Global Admin offers excessive standing privilege, violating least privilege principles and making it a distractor for security-conscious deployments.

Correct answer: B. Utilizing agentless scanning via CSP APIs (Cloud Scanner).

Wiz uses agentless scanning via read-only cloud provider APIs to pull configuration metadata into the Security Graph. Runtime sensors and disk cloning are used for deeper OS or vulnerability analysis, not baseline configuration drift detection.

Correct answer: B. Python SDK and Postman collections

Wiz provides a Python SDK and Postman collections to help developers interact programmatically with the API. Look for standard developer integration tools rather than native infrastructure-as-code modules or runtime tools.

Correct answer: C. They are not suitable for offline or air-gapped environments, requiring network connectivity to Wiz.

Kubernetes connectors require continuous outbound internet access to communicate with the Wiz backend, making them unsuitable for air-gapped environments. Use a Wiz Broker if you need to traverse strict internal network boundaries.

Correct answer: B. Connecting the Wiz backend to an on-premises Jira instance for ticket creation.

The Wiz Broker acts as a reverse proxy to bridge the backend with internal resources like an on-premises Jira instance. It handles ticketing integrations rather than runtime threat detection or direct bucket vulnerability scanning.

Correct answer: C. Every 5 minutes.

The Admission Controller polls the backend every five minutes to cache and enforce the latest policies locally. Real-time blocking is a distractor, as the controller relies on this polling interval rather than synchronous cloud calls.

Correct answer: B. A Wiz Disk Analyzer - Scanner app and a Wiz Enterprise application.

Azure Outpost requires the Wiz Enterprise application to fetch metadata and a dedicated Disk Analyzer scanner app for snapshots. Runtime sensors handle in-memory threat detection, which is different from disk snapshot analysis.

Correct answer: B. The Reset password page

Users with local accounts must use the designated reset password page to recover their credentials. Single sign-on portals handle corporate identities, while command-line tools are for infrastructure configuration.

Correct answer: B. The user must be logged in as a Wiz user with Write (W) permission on service accounts.

Service account creation requires Write permissions on service accounts within Wiz. The strongest distractor, Global Admin, fails because Wiz RBAC governs access internally rather than relying on cloud provider roles.

Correct answer: B. The Network Analyzer (Network exposure module).

The Network Analyzer is responsible for analyzing cloud configurations to map connectivity and build the architecture used for risk assessment. The Workload Scanner is a distractor because it inspects workloads for vulnerabilities, not network topology.

Correct answer: C. A unique, high-entropy connector token generated for the customer's Connector.

The Wiz Broker authenticates to the backend using a unique, high-entropy connector token generated for the specific connector. It does not use cluster administrator credentials, ensuring secure, least-privilege communication.

Correct answer: B. CPE (Common Platform Enumeration).

Wiz uses Common Platform Enumeration, or CPE, as the standardized naming convention to identify software components and their versions. CVSS is incorrect because it scores vulnerability severity rather than naming the software itself.

Correct answer: B. In a dedicated S3 bucket, within a folder named wiz/response_functions.

Custom Python response functions must be stored in a dedicated S3 bucket inside the specific folder path wiz/response_functions. Storing them in the root directory is incorrect and prevents the Wiz platform from properly locating the script.

Correct answer: C. It required admin/highly privileged roles in the customer environment.

The legacy auto-remediation feature required highly privileged roles in the customer environment. This conflicted with least privilege principles, prompting the shift to Remediation and Response, which offers secure, granular playbooks and better access controls.

Correct answer: B. Near real-time scanning/CSPM assessment and Cloud events & detections.

Connecting to cloud event logs enables near real-time scanning for configuration changes and powers Cloud Detection and Response. The question asks for two outcomes, but provides single-letter options instead of combinations, creating a mismatch.

Correct answer: B. Wiz shows KB version as hosted technology both on the Windows and the Windows server/estop hosted technologies.

Wiz displays the Windows KB version as hosted technology directly within both Windows and Windows Server listings. Expect to see KB articles translated into numerical build versions during the exam rather than querying Microsoft directly.