Practice for the Wiz Cloud Fundamentals exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What is the primary role of the Wiz Orchestrator EKS Role in the context of Outpost deployments in AWS?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Wiz Cloud Fundamentals practice test →
What you will practice
- What is the primary role of the Wiz Orchestrator EKS Role in the context of Outpost deployments in AWS?
- A developer needs to quickly scan a local directory of Infrastructure-as-Code (IaC) files using the Wiz CLI p…
- A user wants to find which resources are impacted by emerging global threats that require immediate attention…
- Which type of information is primarily gathered by the Wiz Cloud Scanner using read-only API calls?
- In the context of Vulnerability Management, how does Wiz determine the severity of identified vulnerabilities?
- For real-time detection of known and unknown threats and malicious process behaviors within deployed Kubernet…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What is the primary role of the Wiz Orchestrator EKS Role in the context of Outpost deployments in AWS?
Answer: C. Managing the EKS cluster, assumed by the Wiz Orchestrator Role.
The Orchestrator EKS Role specifically manages the EKS cluster that hosts Outpost scanner components and is assumed by the primary Orchestrator Role. Remember that the EKS role handles orchestration infrastructure, while a separate read-only connector role fetches the actual IAM policies.
Q2. A developer needs to quickly scan a local directory of Infrastructure-as-Code (IaC) files using the Wiz CLI prior to committing changes. How must they typically authenticate for this local scan if they want to avoid using a service account?
Answer: B. Use device code flow tied to their Wiz user account, requiring a Wiz Code license add-on.
Local directory scans use device code flow tied to the user's identity, which requires the Wiz Code license add-on. Service accounts or pipeline tokens are meant for automated automation, whereas interactive developer workflows rely on interactive authentication.
Q3. A user wants to find which resources are impacted by emerging global threats that require immediate attention. Which tool in the Wiz portal should they use to analyze these specific risks?
Answer: C. Threat Center
The Threat Center is the dedicated hub for tracking emerging global threats and analyzing their impact on your resources. While configuration findings show misconfigurations, Threat Center specifically contextualizes active risks and zero-day advisories.
Q4. Which type of information is primarily gathered by the Wiz Cloud Scanner using read-only API calls?
Answer: D. Metadata related to VM properties, networking rules (like Security Groups), and resource tags.
The Cloud Scanner uses API calls to gather control-plane metadata, such as VM properties, tags, and networking rules. Deep inspection tasks, like finding OS packages or exposed keys, are handled by the agentless workload scanner looking at disk volumes.
Q5. In the context of Vulnerability Management, how does Wiz determine the severity of identified vulnerabilities?
Answer: B. Severities are assigned based on the Common Vulnerability Scoring System (CVSS) and data ingested from dozens of public sources, including NVD and cloud service providers (CSPs).
Wiz determines vulnerability severity primarily using industry-standard CVSS scores, enriching the data with threat intelligence from public databases like NVD. Wiz does not rely on arbitrary proprietary scales, ensuring alignment with standard CVE assessments.
Q6. For real-time detection of known and unknown threats and malicious process behaviors within deployed Kubernetes clusters, which component provides the necessary runtime context?
Answer: B. The Wiz Runtime Sensor.
The Wiz Runtime Sensor provides live behavioral telemetry for real-time threat detection inside active workloads like Kubernetes clusters. The agentless workload scanner only provides a static point-in-time snapshot of vulnerabilities on disk.
Q7. Which of the following activities best describes the functionality provided by the Technology Inventory page?
Answer: C. Cataloging hosted software, operating systems, and partially covered cloud services found across workloads.
The Technology Inventory catalogs software, operating systems, and partially covered services found across workloads. It focuses strictly on application stacks, distinguishing it from the resource graph which tracks cloud infrastructure objects like buckets.
Q8. To enhance accountability and scope control, how are Wiz Projects commonly defined to subdivide a cloud estate?
Answer: C. By organizational unit (e.g., Dev team 1), purpose (e.g., production), or business unit.
Projects segment cloud estates by organizational structures like business units, teams, or environments to enforce accountability. They are not limited to a single cloud provider or resource type, enabling flexible ownership tracking across diverse assets.
Q9. During the effective mock analysis for network exposure, after mapping all cloud resources and network elements, what provides the core logic used to calculate the final exposure path?
Answer: B. Configured network security rules
The exposure path is calculated using configured network security rules like security groups and network ACLs. This simulates allowed traffic flow across mapped resources, ignoring real-time telemetry which is not part of this graph calculation.
Q10. If a user forgets their password for a local (email/password) user account in Wiz, what is the procedure to regain access?
Answer: B. The user must navigate to the 'Forgot Password' link on the login page, initiating an email reset process that expires in 1 day.
Local user password recovery is done through an automated email reset link initiated by the user, which is valid for only one day. If a user logs in via an identity provider, password resets must happen there, not in Wiz.
Q11. What kind of metadata and security findings are collected and stored in the Wiz backend, following the principle of only storing metadata?
Answer: B. Redacted snippets of code and masked data samples.
Wiz stores only minimal, heavily redacted metadata, such as masked data samples or code snippets necessary for remediation. Full disk images and complete files are intentionally excluded to maintain strict privacy and security boundaries.
Q12. Which statement accurately describes a limitation of the Wiz Broker regarding its deployment and configuration?
Answer: D. A single broker instance cannot serve multiple different Connectors or third-party integrations.
A design constraint is that a single Wiz Broker instance is dedicated per connector or third-party integration. It cannot multiplex connections for several different services. Brokers are deployed within the customer environment using various methods.
Q13. For deployment of Remediation & Response in AWS, what infrastructure component receives the event message from Wiz, passing it to the serverless function for processing?
Answer: B. AWS SQS queue
Remediation and response deployments often utilize an SQS queue to receive event payloads, which are then processed by a serverless function like Lambda. Remember that SNS is a push pub sub service, while SQS holds the message buffer.
More Wiz Cloud Fundamentals drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.