Practice for the Wiz Cloud Fundamentals exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Where are vulnerability findings initially placed once identified by Wiz?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Wiz Cloud Fundamentals practice test →
What you will practice
- Cloud Configuration Rules define configuration checks applied to specific cloud resource types. What open-sou…
- A customer needs to connect Wiz to an on-premises Jira instance for ticket management, but the Jira instance…
- Which type of Automation Rule trigger would you use to create notifications regarding new security standards…
- When Wiz detects a vulnerability on a Windows Virtual Machine, what component does it scan to identify missin…
- Which specific type of Threat Detection Rule (TDR) in Wiz is designed to check for malicious or risky operati…
- Wiz analyzes permissions granted to various cloud principals. Which core concept does Wiz use to describe the…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Cloud Configuration Rules define configuration checks applied to specific cloud resource types. What open-source project and high-level declarative language power the Cloud Configuration Rule definition engine in Wiz?
Answer: C. Open Policy Agent (OPA) and Rego.
Wiz uses the Open Policy Agent framework to evaluate cloud configuration checks against raw resource data. The rules are written in the Rego declarative language. Terraform and HCL are infrastructure provisioning tools, not policy engines.
Q2. A customer needs to connect Wiz to an on-premises Jira instance for ticket management, but the Jira instance is not publicly accessible over the internet. Which Wiz component must be deployed to facilitate this secure connectivity?
Answer: D. Wiz Broker
The Wiz Broker acts as a lightweight reverse proxy creating a secure tunnel to isolated resources. It allows the Wiz backend to communicate securely with internal instances like Jira without requiring inbound internet access.
Q3. Which type of Automation Rule trigger would you use to create notifications regarding new security standards or updates to existing policies announced by Wiz?
Answer: B. Policy Update trigger.
The Policy Update trigger allows you to notify external systems when Wiz announces new or updated policies. Cloud Event triggers handle cloud provider logs, while Audit Log triggers monitor user actions within the Wiz platform itself.
Q4. When Wiz detects a vulnerability on a Windows Virtual Machine, what component does it scan to identify missing security patches?
Answer: C. The Windows Knowledge Base (KB) updates.
For Windows environments, Wiz scans the installed Windows Knowledge Base updates to identify missing security patches and vulnerabilities. For the exam, remember that Wiz maps detected vulnerabilities to specific KB updates rather than analyzing the host firewall or kernel.
Q5. Which specific type of Threat Detection Rule (TDR) in Wiz is designed to check for malicious or risky operations that occur sequentially or cumulatively over the course of more than one cloud event?
Answer: C. Correlation Rules.
Correlation rules are used for detecting complex sequences of events that indicate a broader threat pattern, as opposed to cloud event rules, which monitor single events. Use this distinction to easily separate sequence-based detections from isolated alerts.
Q6. Wiz analyzes permissions granted to various cloud principals. Which core concept does Wiz use to describe the risk where principals (users or service accounts) have access rights far beyond what they actively use?
Answer: B. Overprivileging (Excessive Access)
The identity analyzer focuses heavily on identifying overprivileging or excessive access, where identities possess permissions that are unused or exceed least privilege. The exam cue here is equating unused identity rights directly with excessive access.
Q7. Wiz's identity analyzer assesses permissions. What two types of identity policies does Wiz analyze to help prevent over-privileging and lateral movement?
Answer: C. Explicit and Effective IAM policies.
Wiz analyzes both explicit and effective IAM policies as part of its effective permissions analysis to identify risks like over-privileging and lateral movement. Explicit policies are assigned directly, while effective policies include inherited group memberships.
Q8. What is the primary language used to define custom response functions within the Remediation & Response framework for AWS?
Answer: C. Python (supporting version 3.12 in Lambda).
Custom response functions for AWS Remediation and Response are written in Python, designed to run within the AWS Lambda environment. For the exam, associate remediation automation directly with Python, while remembering that Rego is used strictly for defining Wiz configuration rules.
Q9. Which statement accurately describes Wiz's Malware Analyzer capability regarding file detection?
Answer: B. It scans files using proprietary YAR rules which may detect patterns not malicious in public databases.
Wiz uses proprietary YARA rules to scan for cloud-specific malware behaviors, catching threats not yet in public hash databases. A helpful exam tip is to differentiate static scanning from runtime analysis, as the malware analyzer does not strictly require the runtime sensor.
Q10. Which component is explicitly not counted as a billable unit in the Wiz licensing model?
Answer: B. Wiz CLI and Wiz Admission Controller deployments.
The correct answer is Wiz CLI and Admission Controller deployments, as these are enablement tools excluded from billable unit counts. Remember that compute workloads, container images, and Wiz OS instances are the actual licensed entities you must track.
More Wiz Cloud Fundamentals drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.