Practice for the Wiz Cloud Fundamentals exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which Wiz component is an eBPF-based executable that focuses on providing real-time visibility and detecting threats/mal. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Wiz Cloud Fundamentals practice test →
What you will practice
- Which Wiz component is an eBPF-based executable that focuses on providing real-time visibility and detecting…
- Why would an organization choose the Wiz Outpost deployment model over the standard SaaS model?
- What is the key difference between the Wiz workload scanner's method for malware detection and the Wiz Runtim…
- In the context of vulnerability management, what components are analyzed by Software Composition Analysis (SC…
- When are all enabled Wiz controls re-evaluated against the cloud environment, ensuring that Issues reflect th…
- Where can you find a comprehensive list of hosted technologies (software running directly on the workload) id…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which Wiz component is an eBPF-based executable that focuses on providing real-time visibility and detecting threats/malicious behaviors inside workloads, distinct from the agentless workload scanner?
Answer: D. Wiz Runtime Sensor
The Wiz Runtime Sensor is the correct choice because it uses eBPF to provide real-time threat detection inside running workloads. Remember to distinguish it from the agentless scanner, which relies on disk snapshots rather than runtime analysis.
Q2. Why would an organization choose the Wiz Outpost deployment model over the standard SaaS model?
Answer: C. To perform workload scanning within the customer's cloud environment, keeping sensitive data snapshots within their cloud boundary, often due to data sovereignty or compliance needs.
The Outpost deployment model keeps workload scanning within the customer cloud boundary to satisfy strict data sovereignty rules. Standard SaaS deployments centrally analyze snapshots, which violates strict data residency compliance requirements.
Q3. What is the key difference between the Wiz workload scanner's method for malware detection and the Wiz Runtime Sensor's method?
Answer: A. The workload scanner detects malware using YARA rules on disk snapshots, while the Runtime Sensor detects malicious behavior in real-time within the live workload.
The agentless workload scanner statically analyzes disk snapshots for malware using YARA rules. The optional Runtime Sensor provides dynamic, real-time threat detection based on actual behavior inside the running workload.
Q4. In the context of vulnerability management, what components are analyzed by Software Composition Analysis (SCA) functionality?
Answer: B. Code library dependencies (direct and transient).
Software Composition Analysis evaluates code library dependencies, including both direct and transitive packages, to find known vulnerabilities. Exam tip: SCA strictly focuses on open-source libraries, so it will never analyze operating systems, network rules, or hardcoded API keys.
Q5. When are all enabled Wiz controls re-evaluated against the cloud environment, ensuring that Issues reflect the most current state of risk?
Answer: C. Every time your environment is scanned and the Security Graph is updated.
Controls act as security graph queries that run immediately after every scan cycle to guarantee your security posture is completely up to date. Avoid options relying on strict hourly or weekly schedules, as Wiz evaluates issues dynamically based on graph updates.
Q6. Where can you find a comprehensive list of hosted technologies (software running directly on the workload) identified across your scanned environment?
Answer: C. Inventory > Technologies page
The Technologies page under the Inventory section provides a consolidated view of all hosted software and services discovered across your environment. Use the Resources page for individual assets, and remember that discovery dashboards summarize posture rather than listing specific technologies.
Q7. When configuring DSPM, which functionality allows a customer to define specific formats or keywords unique to their business (e.g., internal product codes or specific client identifiers) for detection?
Answer: C. Custom data classifiers.
Custom data classifiers allow you to define specific keywords or formats unique to your business, such as internal product codes. Built-in rules only cover standard compliance data like PII, and text search lacks the active scanning integration required for DSPM discovery.
Q8. When retrieving data via the Wiz API for custom automations, which format must the API token be obtained through?
Answer: B. Bearer Token (JWT) derived from service account credentials.
Wiz API authentication requires exchanging service account credentials for a bearer token to authorize GraphQL queries. Basic authentication and custom certificates are unsupported, while OAuth signatures belong to legacy patterns rather than current Wiz service account workflows.
Q9. To trace back a cloud resource (like a VM) to the exact Infrastructure as Code (IaC) file that declared it, which feature must be enabled in the Wiz Connector configuration?
Answer: C. Access to Terraform state files or CloudTrail logs.
Code-to-cloud correlation requires granting Wiz access to Terraform state files or CloudTrail logs via the connector configuration. Runtime sensors and malware scanners detect active threats, but they cannot map a live cloud resource back to its original infrastructure code declaration.
Q10. How does Wiz define a 'Finding'?
Answer: C. A Wiz abstraction representing a specific vulnerability or risk identified on a single resource, such as a misconfiguration or CVE.
A finding accurately represents a specific risk on a single resource, such as a misconfiguration or vulnerability. Be careful not to confuse this with an issue, which groups multiple findings and context together to represent a broader security problem.
Q11. In the context of Remediation & Response, how does Wiz deploy the necessary components (like response functions and templates) for automated configuration fixing in a customer's cloud environment?
Answer: B. Wiz provides preconfigured stacks, templates, and response functions as a bundle for the customer's environment (e.g., AWS, Azure, GCP).
Remediation and Response deploys preconfigured infrastructure as code templates and response functions directly into the customer cloud environment. Remember that Wiz is agentless, so it relies on cloud native deployment bundles rather than installing agents.
Q12. Which type of resource is explicitly stated as not being scanned by Wiz DSPM, as the solution is cloud-only and risk-only?
Answer: D. On premises databases.
Wiz is explicitly a cloud only solution, meaning it does not scan or assess on premises databases. The platform relies entirely on cloud provider APIs and agentless cloud scanning to evaluate risk for cloud hosted infrastructure.
Q13. When configuring Remediation & Response, defining the Project Scope determines what key factor for the deployment?
Answer: C. Which Wiz projects can use this deployment as a gateway to remediate findings.
Defining the project scope restricts which Wiz projects can utilize the deployment to execute automated remediations. This is a critical guardrail, ensuring development projects cannot trigger actions in production environments.
Q14. Which of the following is the intended audience for the Wiz Certified Cloud Fundamentals Exam?
Answer: B. IT professionals, systems and security administrators, and developers who use Wiz in their daily tasks.
The exam targets IT professionals, security administrators, and developers who manage or operate the platform daily. It is not restricted to internal staff or architects, though candidates should possess hands-on cloud security experience beforehand.
Q15. In addition to providing built-in classification rules for common data types (PII, PHI, PCI), what capability does Wiz offer to detect unique business-critical information?
Answer: C. Support for custom data classifiers.
Wiz enables the creation of custom data classifiers to identify unique or proprietary sensitive information specific to an organization. Manual tagging is a distractor because the platform prioritizes automated detection logic over manual label assignment.
More Wiz Cloud Fundamentals drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.