Wiz Certified Cloud User Practice Test – 101 Free Exam Questions with Answers

Correct answer: D. It establishes clear ownership for remediation and tracking

Assigning an issue establishes clear ownership so the right team drives remediation and tracks progress. The strongest distractors fail because assigning a user does not encrypt resources, disable policies, or delete underlying findings.

Correct answer: D. Whether the affected workload is internet-exposed and has access to sensitive data

Wiz prioritizes vulnerabilities using context like internet exposure and access to sensitive data rather than just raw CVSS scores. The incorrect options fail because tags, regions, and package names do not meaningfully drive risk prioritization.

Correct answer: B. To organize and visualize data/metrics for tracking and reporting on security posture

Boards are used to organize and visualize security data, providing tracked metrics and reporting for your cloud posture. Distractors mentioning runtime sensors or secrets are incorrect, as those belong to completely different feature sets within the platform.

Correct answer: B. Review and validate the recommendation against context before applying it

The recommended best practice is to carefully review and validate any AI remediation against your environmental context before applying it. Expect exam questions to emphasize human validation for artificial intelligence, treating automated suggestions as helpful guidance rather than absolute directives.

Correct answer: B. An AI assistant that helps users investigate, query, and understand security data in natural language

Wiz Assistant is an artificial intelligence tool that helps users investigate and query security data using natural language. It simply analyzes data rather than performing system installations, so dismiss options suggesting it actively deploys sensors or encrypts infrastructure.

Correct answer: C. To bring Wiz security context to the user directly within the browser experience

The browser extension brings Wiz security context directly into the user experience, allowing developers to see issues without switching tools. It provides contextual insights rather than replacing foundational architecture like the cloud connector or executing agentless disk scans.

Correct answer: C. Agentless scanning analyzes cloud state and workload contents without installed software, while Runtime Sensors collect live runtime telemetry from within workloads

Agentless scanning analyzes workload contents and cloud state without requiring installed software, while runtime sensors capture live telemetry from within active machines. A strong exam cue is remembering that agentless provides static analysis, whereas sensors grant deep process visibility.

Correct answer: C. Wiz performs automated scans on a schedule and also supports manual (on-demand) scans

The platform performs scheduled automated scans continuously, while also providing users the flexibility to trigger manual on-demand scans when needed. Dismiss extreme options suggesting manual exclusivity or total dependency on external ticketing systems for basic scanning operations.

Correct answer: A. Runtime Sensors

Runtime sensors are required to gain process-level visibility and actively validate vulnerabilities directly inside running workloads. Agentless scanning alone lacks this deep contextual telemetry, as it only provides a static snapshot of the disk and configuration state.

Correct answer: C. Rules generate Findings, while Graph Controls correlate data on the Security Graph to generate Issues

Rules detect single misconfigurations and generate findings, while graph controls correlate those findings to create contextual issues. Understand this pipeline because it defines how Wiz turns raw cloud data into prioritized risk.

Correct answer: D. Risk Issues representing active or imminent exploitable exposure are typically prioritized more urgently than baseline posture Issues

Risk issues representing exploitable toxic combinations are prioritized over baseline posture hygiene issues. For the exam, dismiss strict rules demanding equal remediation timelines, because Wiz prioritizes dynamically based on context.

Correct answer: D. Active suspicious process execution detected on a running workload by a Runtime Sensor

Threat detection issues stem from active malicious behavior observed at runtime. A practical exam cue is looking for runtime sensor alerts, while the other options describe static misconfigurations.

Correct answer: C. Prioritize and remediate it as a high-risk toxic combination, then assign for fix

Wiz Issues combine multiple risks into toxic combinations, prioritizing immediate remediation. On the exam, remember that ignoring critical attack paths or waiting for automated policy updates violates fundamental triage principles and leaves the environment exposed.

Correct answer: D. An Ignore Rule, which targets Findings directly and therefore affects Issues only indirectly

Ignore Rules directly target Findings, meaning they will indirectly affect correlated Issues across resources. Remember that temporarily ignoring an Issue only applies a time-bound suppression for a single instance, whereas bulk deletion is not supported.

Correct answer: D. When a single Issue needs short-term, time-bound suppression while a specific fix is in progress

Temporarily ignoring an Issue provides a short-term suppression while an active fix is underway. Use Ignore Rules when you need to permanently suppress a recurring pattern across the entire environment rather than managing a one-off situation.

Correct answer: A. On the next scan, the underlying Finding no longer matches, so Wiz automatically resolves the Issue

When the next scan runs and no longer detects the misconfiguration, the underlying Finding clears and automatically resolves the Issue. Users do not need to manually delete closed items, as automation handles lifecycle management based on live cloud state.

Correct answer: A. The Remediation tab

The Remediation tab provides the specific actionable steps and commands needed to fix the underlying problem. The Evidence tab only shows the technical context and configuration data that triggered the alert without offering remediation guidance.

Correct answer: A. Likelihood and impact

Issue severity is calculated by combining the likelihood of an attack with its potential impact. The platform contextualizes these factors using its Security Graph, deliberately avoiding arbitrary metrics like resource age, tags, or cost.

Correct answer: C. Correlation of multiple data points and relationships on the Security Graph

Graph Control Issues are generated by correlating multiple data points and relationships within the Security Graph. Unlike simple posture rules that evaluate a single resource in isolation, graph controls map complex toxic combinations.

Correct answer: A. Prioritize which Issues to address first

The severity rating primarily helps analysts prioritize which Issues demand immediate attention based on risk. It serves as a triage indicator for security teams, rather than dictating operational details like billing, owner emails, or deployment regions.

Correct answer: C. Severity weighs both likelihood and impact, so a high-impact scenario may still warrant attention

Severity in Wiz incorporates both likelihood and impact, meaning high impact risks demand attention even when probability is low. For the exam, remember that a low likelihood never automatically means an issue can be safely ignored.

Correct answer: C. Sensitive data exposure combined with network exposure significantly raises breach risk

Combining sensitive data with internet exposure dramatically increases the risk of a serious breach. A practical exam cue is to watch for toxic combinations, because contextual exposure is a primary driver of issue severity in Wiz.

Correct answer: D. Excessive permissions / identity-based risk

An identity granting administrative permissions beyond workload requirements is an excessive permissions risk. The other options are incorrect because broad IAM roles do not indicate malware infections, container drift, or compliance reports.

Correct answer: D. A container image running with a known vulnerable package and excessive privileges

A vulnerable package running with excessive privileges inside an image is a finding unique to containerized environments. The distractors fail because public buckets, DNS issues, and IAM users are general cloud risks not exclusive to containers.

Correct answer: C. By scanning workload disks/snapshots (agentlessly) and, with Runtime Sensors, observing runtime behavior

Wiz detects malware through agentless disk scanning and runtime behavior observation. Expect runtime sensors to add active threat detection on top of the baseline agentless snapshot scans.

Correct answer: C. It validates real exploitability, reducing noise from non-running vulnerable code

Verifying if vulnerable code is loaded validates real exploitability and eliminates noise from dormant packages. Focus on how runtime context filters out theoretical risks to highlight actual threats.

Correct answer: C. The lateral-movement impact a single exposed secret can have across the environment

This illustrates the lateral movement impact a single exposed secret can have across an environment. Prepare to map how shared credentials allow attackers to pivot from low-value targets to sensitive assets.

Correct answer: C. A privileged container with a critical vulnerability that is internet-reachable

Wiz escalates risk by combining internet exposure, critical vulnerabilities, and excessive privileges like root access. Look for the intersection of exploitability and high impact when assessing container threat scenarios.

Correct answer: D. To automatically trigger actions like assigning Issues, creating tickets, or sending notifications based on conditions

Automation Rules trigger downstream actions like assigning issues or creating tickets when specific conditions are met. Remember that these rules rely on the Security Graph for context, rather than replacing it.

Correct answer: D. Amazon S3

Amazon S3 is explicitly supported as an external destination for archiving generated reports from Wiz. On the exam, remember that third-party cloud storage is required for automated external archiving, while the other choices are completely invalid targets.

Correct answer: A. Built-in Reports stored in S3 for the export, plus an Automation Rule sending Slack notifications

Built-in reports exported to S3 handle the scheduled data lake inventory, while automation rules trigger the Slack notifications for new criticals. Remember that runtime sensors collect telemetry, whereas automation rules are your primary mechanism for driving active alerts.

Correct answer: A. Faster detection of configuration changes shortly after they occur, for supported resource types

Near real-time scanning provides faster detection of configuration changes shortly after they occur for supported resource types. It does not actively block API calls or fully replace standard scheduled scans across the entire infrastructure, which is a crucial distinction.

Correct answer: D. Use agentless scanning for broad baseline coverage and add Runtime Sensors selectively on critical workloads

Agentless scanning provides rapid, broad baseline coverage across your cloud accounts with minimal deployment friction. You then selectively deploy Runtime Sensors only on your most critical workloads to gain deeper runtime threat detection.

Correct answer: B. Providing agentless visibility and risk analysis across the running cloud environment

The correct answer works because Wiz Cloud delivers agentless visibility across the running environment. Option A is incorrect because it describes Wiz Defend, while options C and D map to Wiz Code.

Correct answer: C. It provides broad, low-friction visibility without installing software on each workload

Agentless scanning provides immediate, broad visibility without the operational burden of deploying software. Remember that Wiz uses cloud APIs and snapshots, so options requiring sensors or eliminating API access are incorrect.

Correct answer: C. A Finding

A raw configuration data point is called a finding before correlation occurs. Findings are the building blocks that policies evaluate on the security graph to generate actionable issues.

Correct answer: C. The Threat Intel Center curates threat intelligence and advisories, while the Threats page surfaces active malicious activity detected by Runtime Sensors

The threat intel center curates global advisories, while the threats page shows active malicious activity detected by runtime sensors. A practical cue is associating intelligence with advisories and threats with runtime alerts.

Correct answer: D. To organize access, scope, and visibility of data for different teams or applications

Projects and user roles organize data access and visibility for different teams. They scope resources and control permissions, rather than installing sensors, replacing cloud IAM, or acting solely as an auditor tool.

Correct answer: C. A Lens

A lens provides a temporary, filtered view of platform data based on specific criteria like internet exposure. Remember that lenses do not permanently alter configurations, unlike automation or ignore rules.

Correct answer: D. Bulk actions

Bulk actions allow users to simultaneously assign, ignore, or resolve multiple items from the Issues list. This interface feature is the correct tool for managing large volumes, whereas Mika AI or API consoles are inefficient for this specific task.

Correct answer: A. An automatic Wiz Policy update changed how the condition is evaluated, resolving the Issue

Automatic Wiz Policy updates can change condition evaluations, potentially resolving an Issue without direct cloud changes. It is best practice to audit recent policy version changes or ignore rule creations before suspecting database corruption.

Correct answer: A. Ignore Rules suppress Findings, and the related Issues are affected only indirectly as a result

Ignore rules suppress the underlying findings, which indirectly resolves the associated issues. The strongest distractor fails because ignore rules do not directly close issues or delete them from the security graph.

Correct answer: A. A cloud resource misconfiguration

Unrestricted public access on a storage resource is a classic cloud misconfiguration finding. The other options fail because public buckets do not represent malware detections, compliance certificates, or artificial intelligence pipeline risks.

Correct answer: A. A mapping of resources and Findings to framework controls, highlighting non-compliant resources

Wiz compliance posture maps resources and findings directly to framework controls to highlight non compliant areas. A key exam cue is that Wiz provides visibility rather than automatically deleting resources or guaranteeing legal certification.

Correct answer: C. Exposed secrets and sensitive training data in AI pipelines can lead to data leakage and unauthorized model/service access

Exposed secrets and sensitive data in AI pipelines create direct paths to data leakage and unauthorized access. For the exam, remember that security issues in AI pipelines are treated just like traditional cloud risks, ignoring synthetic data assumptions.

Correct answer: A. Remove the unnecessary internet exposure (e.g., restrict the security group/route)

Removing unnecessary internet exposure directly breaks the attack path by blocking initial access. When prioritizing remediation on the exam, always look for the control that severs the external entry point.

Correct answer: A. Identifying insecure configuration of cloud resources against best practices and policies

CSPM analysis identifies insecure cloud resource configurations by comparing them against best practices. Distinguish this static configuration analysis from active malware detection or code compilation processes.

Correct answer: A. The AI service's excessive permissions could be abused to reach resources unrelated to its purpose

Excessive permissions on AI services risk lateral movement to unrelated resources. Treat AI identities like any other non-human identity, ensuring least privilege to prevent unauthorized access to other services.

Correct answer: A. Attack path analysis

Attack path analysis visually maps the chained exploitable conditions leading to a critical resource. Distractors like the heatmap or remediation tab fail because they show compliance scores and fixes, not the attack chain.

Correct answer: A. The secret could be used by an attacker to authenticate and access cloud resources

A hardcoded cloud key in a public location allows attackers to authenticate and access your environment. The strongest distractor fails because exposed secrets remain a critical risk even after a security tool detects them.

Correct answer: A. Public listing still constitutes a sensitive-data exposure risk despite encryption at rest

Public listing remains a sensitive data exposure risk even when data is encrypted at rest. Remember that attackers can easily download and decrypt exposed objects if they have the necessary access keys.

Correct answer: D. Wiz Code

Wiz Code is the correct choice because it specifically evaluates infrastructure-as-code and application code during the pre-deployment phase. The other options focus on runtime or general cloud posture, not shifting security left into the development pipeline.

Correct answer: B. A Finding is a single data point from a Rule; an Issue is correlated context on the Security Graph

A Finding is a single data point generated by a rule, while an Issue combines multiple findings and context using the Security Graph. Knowing this distinction is crucial, as Issues represent correlated risks rather than isolated configuration failures.

Correct answer: B. The Policies page; Wiz regularly updates Policies automatically, which can create or resolve Issues without user action

Wiz regularly updates built-in policies automatically, so users should check the Policies page to review these changes. This automation ensures coverage stays current, meaning new issues might appear or old ones might resolve without manual intervention.

Correct answer: D. Curated threat intelligence and advisories about the broader landscape

The Threat Intel Center provides curated intelligence and advisories about the broader threat landscape, whereas the Threats page shows active detections. Remember that Threats focuses on your environment while the Intel Center looks externally.

Correct answer: C. Filter and view platform data through a particular perspective without changing configuration

A Lens allows users to filter and view platform data through a specific perspective without altering underlying configurations. This makes Lenses ideal for quick reporting or analysis, contrasting with Projects which actually segment administrative access.

Correct answer: B. A security group allowing unrestricted inbound access on a sensitive port

An unrestricted inbound security group rule is a static configuration risk, which perfectly exemplifies a Posture Issue. The other options describe active, real-time threats that require runtime monitoring to detect and alert.

Correct answer: B. Create an Ignore Rule that suppresses the underlying Finding pattern

Creating an Ignore Rule targeting the underlying Finding pattern is the best approach because it permanently stops the recurring false positive. Temporarily ignoring the single Issue only resolves it once and fails to prevent future duplicates.

Correct answer: D. By using contextual risk (exposure, permissions, data access) to elevate the exposed, over-permissioned workload

Wiz uses contextual risk, combining exposure, permissions, and data access, to prioritize the internet-exposed workload over the isolated one. Treating items by CVE alone ignores the actual blast radius, which is a core Wiz security concept.

Correct answer: D. Excessive/unused permissions, which expand the attack surface if the principal is compromised

Wiz identifies unused administrative permissions as excessive privileges that dangerously expand the blast radius if compromised. This is a core identity risk management concept, completely separate from malware infections or compliance certifications.

Correct answer: B. Indirectly internet-exposed through the load balancer path

Wiz graph technology maps traffic flows, characterizing the workload as indirectly internet-exposed through the load balancer. Focusing strictly on missing public IPs misses attack paths, which is a fundamental aspect of Wiz contextual analysis.

Correct answer: A. It provides broad coverage rapidly without per-workload software deployment

Agentless scanning is preferred because it provides rapid coverage without requiring software installations on individual workloads. The other options are incorrect because agentless scanning still requires cloud permissions and does not depend on runtime sensors.

Correct answer: B. The Threats page, because Runtime Sensors are the prerequisite for Wiz Cloud to generate Threats

The Threats page becomes active because Runtime Sensors provide the necessary telemetry for Wiz Cloud to generate runtime threat detections. Other pages like Compliance or Boards rely on posture data rather than live runtime telemetry.

Correct answer: A. Projects and User Roles

Using Projects to group resources and User Roles to assign permissions correctly scopes visibility for the application team. Lenses are incorrect because they only filter views for existing data rather than restricting access.

Correct answer: D. Because ignoring an Issue acts on that Issue, while Ignore Rules act on Findings directly across resources

Ignoring an issue only suppresses that specific instance, while ignore rules target the underlying finding across all resources. Remember that findings generate issues, so you must target the finding if you want to suppress the pattern globally.

Correct answer: C. It is automatically resolved because the underlying Finding no longer matches

The issue is automatically resolved because the underlying finding no longer matches during the next scan. Wiz continuously monitors the environment, meaning issues dynamically close when the detected misconfiguration or vulnerability is fixed.

Correct answer: B. Remediation

The remediation tab provides the best starting point because it outlines recommended steps to fix the underlying problem. Other tabs focus on contextual graph data or metadata rather than actionable resolution paths.

Correct answer: B. Use attack path and context (exposure, sensitivity) to prioritize the externally reachable one first

Analysts should use attack path and context to prioritize the externally reachable issue first. In Wiz, business context like exposure and data sensitivity heavily influences risk scoring, making contextual prioritization highly effective.

Correct answer: C. Severity combines likelihood (how probable/exploitable) and impact (potential damage)

Severity combines likelihood, which is how exploitable a vulnerability is, and impact, representing potential damage. This contrasts with traditional tools that might rank severity strictly by counting findings or using theoretical scores.

Correct answer: C. Threat Detection Issues come from active runtime activity (via Runtime Sensors); Graph Control Issues come from correlating data on the Security Graph

Threat detection issues come from active runtime activity via runtime sensors, while graph control issues come from correlating data on the security graph. Remember that graph controls evaluate configurations, not live execution events.

Correct answer: D. Wiz updated a Policy so the condition is now evaluated/created again

Wiz updated a policy so the condition is now evaluated and created again. Automatic policy updates can reopen previously resolved issues if the new logic detects a match, ensuring continuous compliance enforcement.

Correct answer: B. Issue severity

Issue severity directly drives remediation priority in Wiz, allowing analysts to resolve the most critical risks first. Tags and timestamps provide metadata but do not determine the immediate risk level requiring attention.

Correct answer: D. Automation Rules, which trigger assignment and ticket creation based on Issue conditions

Automation Rules automatically trigger actions like ticket creation and assignment based on specified Issue conditions. Lenses and Boards are used for filtering and organizing, while Ignore Rules suppress findings rather than orchestrate remediation workflows.

Correct answer: B. A Wiz Policy update changed evaluation logic so the condition no longer applies

Wiz automatically resolves an Issue when a policy update changes the evaluation logic and the resource no longer violates the rule. Boards and renaming are manual actions that change state but do not evaluate security conditions.

Correct answer: B. Cloud resource misconfiguration

A publicly accessible database with weak authentication is a classic cloud resource misconfiguration. Wiz flags these posture issues distinctly from runtime malware infections or vulnerabilities found inside container images.

Correct answer: B. Rotate/revoke the secret promptly and remove it from the exposed location

Exposed secrets require immediate rotation and removal from the exposed location to prevent unauthorized access. Adding tags or resizing resources does not mitigate the actual security risk of compromised credentials.

Correct answer: B. An internet-exposed workload with a critical exploitable vulnerability and a role granting access to sensitive data

A critical exploitable vulnerability on an internet-exposed workload with access to sensitive data is the classic toxic combination. Expect exam questions to prioritize issues combining external exposure, severe flaws, and privileged data access.

Correct answer: A. It still represents a sensitive-data exposure due to overly broad access, regardless of encryption at rest

Overly permissive access policies create a sensitive data exposure regardless of encryption at rest. Remember that encryption protects data at rest, but it does not prevent unauthorized users from reading it if access is allowed.

Correct answer: D. To identify vulnerable software/packages on workloads and prioritize them by context

Vulnerability management identifies vulnerable software packages on workloads and prioritizes them using contextual security data. Always look for options focusing on risk-based prioritization rather than isolated ticketing or generic compliance tasks.

Correct answer: D. Indirect attack paths and lateral movement enabled by an exposed secret

Finding an exposed secret enabling access to a datastore via another workload illustrates indirect attack paths and lateral movement. The exam emphasizes how security graph analysis links isolated risks into explosive attack chains across cloud environments.

Correct answer: D. A vector/training data store exposing sensitive data or secrets used by a model

Exposed sensitive training data or model secrets are AI-specific findings distinguished from general cloud risks. Look for machine learning keywords like vector stores or training pipelines to identify these specialized exam scenarios quickly.

Correct answer: B. Whether it is exploitable, exposed, and connected to sensitive data or privileges

Context showing a vulnerability is exploitable, internet-exposed, and grants access to sensitive data is the most decisive prioritization factor. Always elevate risks that combine multiple threats into dangerous attack paths over isolated flaws.

Correct answer: D. Auto-assigning Issues based on defined conditions

Automation rules auto-assign issues, create tickets, and send notifications based on defined conditions to streamline remediation workflows. Do not confuse workflow automation with core scanning operations or backend graph schema definitions.

Correct answer: C. Generating built-in Reports and storing them in third-party tools like S3

Wiz supports generating built-in reports and automatically exporting or archiving them to third-party tools like cloud object storage. Know that report integrations extend visibility, while runtime sensors handle active threat detection.

Correct answer: D. It detects supported configuration changes shortly after they occur, reducing the window of unnoticed drift

Near real-time scanning detects supported configuration changes shortly after they occur, shrinking the window of unnoticed drift. It does not actively block malicious traffic or capture full packet data.

Correct answer: C. Runtime Sensors

Runtime Sensors must be added to capture process trees and provide live behavioral detection on workloads. Agentless scanning and dashboards like Boards do not provide deep runtime telemetry.

Correct answer: C. It does not require installing software on each workload and relies on cloud connector access

Agentless scanning relies on cloud connector access and does not require installing software on each workload. This deployment model avoids the operational overhead of managing agents.

Correct answer: B. Start with agentless scanning for broad baseline coverage, then add Runtime Sensors where deeper runtime detection is needed

Starting with agentless scanning provides immediate broad baseline visibility across multi-cloud environments. Runtime Sensors are then layered on specific sensitive workloads for deeper behavioral detection.

Correct answer: B. To automatically create tickets so remediation work is tracked in the team's existing system

Ticketing integrations like ServiceNow automatically create tickets so remediation work is tracked in the team's existing system. Wiz does not replace the configuration management database, but rather feeds actionable security context directly into it.

Correct answer: A. Use bulk actions

Using bulk actions allows the analyst to process multiple issues simultaneously, saving significant time. Opening each issue individually is inefficient, and creating separate reports or rules defeats the purpose of streamlined administration.

Correct answer: A. Recommended remediation flows for the underlying problem

The remediation tab helps users identify recommended remediation flows for the underlying problem. It translates complex security graph data into actionable steps, making it easier to resolve issues without guessing the fix.

Correct answer: A. Compliance posture mapping against the framework, highlighting non-compliant resources

Compliance posture mapping aligns cloud resources against specific frameworks to highlight violations and non-compliant assets. Runtime process trees and browser extensions focus on active threats rather than demonstrating regulatory compliance.

Correct answer: A. Exposure of sensitive training data and an embedded secret that could enable data theft and unauthorized access

The priority concern is the exposure of sensitive training data and an embedded secret that could enable unauthorized access. File formats and storage costs are operational concerns that do not address this critical security risk.

Correct answer: C. It allows observing malicious behavior at runtime, complementing agentless content scanning

Runtime sensors monitor active processes to detect malicious behavior in real time, adding execution context to static agentless scans. For the exam, remember that agentless scanning finds files, while runtime sensors confirm if malware actually executes.

Correct answer: C. Whether the vulnerable component is actually loaded/running, indicating real exploitability

Runtime validation confirms whether a vulnerable package is actually loaded and running, proving its exploitability. Use this to prioritize active critical vulnerabilities over dormant ones that pose no immediate threat.

Correct answer: C. Organize and visualize security data/metrics for tracking and communication

Boards organize and visualize security data, making tracking and communication easier. Defining user roles or rotating secrets are administrative or remediation actions, not core dashboard functions.

Correct answer: C. It provides programmatic access to Wiz data and capabilities for automation and integration

The Wiz API provides programmatic access to Wiz capabilities, enabling automation and integration with other systems. It does not bypass authentication or replace native scanning features.

Correct answer: C. An AI assistant that helps users query and understand Wiz security data conversationally

Mika AI acts as a conversational assistant to help users query and understand Wiz security data. It is not an infrastructure component like a cloud connector or a runtime sensor.

Correct answer: B. The Wiz Browser Extension

The Wiz Browser Extension surfaces relevant security context inline as users navigate public cloud provider consoles. Ignore rules and compliance frameworks do not provide inline user interface context.

Correct answer: A. Review and validate the recommendation against your environment and context before applying

Mika AI recommendations should be validated against your specific environment before applying changes. Blindly implementing AI suggestions everywhere introduces risk because context matters for safe remediation.

Correct answer: A. Agentless = no installed software, broad config/content visibility; Sensors = installed, live runtime telemetry

Agentless scanning requires no installed software and provides broad visibility, while Runtime Sensors require installation to capture live telemetry. The two methods serve distinct architectural purposes.