Practice for the Wiz Cloud Fundamentals exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: The concept of 'effective exposure' involves Wiz calculating the network connectivity of resources. What must be modeled. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Wiz Cloud Fundamentals practice test →
What you will practice
- The concept of 'effective exposure' involves Wiz calculating the network connectivity of resources. What must…
- According to Wiz's retention policy summary, what is the retention period for Wiz Issues after they have been…
- What is the primary method offered by the Wiz portal for automating remediation of common cloud misconfigurat…
- You need to integrate Wiz with a self-managed Kubernetes cluster whose API endpoint is located in a private s…
- Wiz uses the cloud provider's API calls for configuration scanning. Which cloud provider service requires a s…
- If a user only has permissions granted to access a single, specific resource, how does Wiz typically categori…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. The concept of 'effective exposure' involves Wiz calculating the network connectivity of resources. What must be modeled when calculating this exposure path?
Answer: B. The full path, including network interfaces, VPCs, and gateways, mapped to the internet.
Effective exposure requires mapping the entire network path from the internal resource through interfaces and gateways out to the internet. Avoid picking options that only look at direct public IPs or focus solely on IAM permissions.
Q2. According to Wiz's retention policy summary, what is the retention period for Wiz Issues after they have been manually or automatically resolved?
Answer: D. 180 days.
Resolved Wiz Issues are retained for 180 days to support historical analysis and compliance reporting. Be careful not to confuse this with shorter audit log retention periods common in standard cloud provider tools.
Q3. What is the primary method offered by the Wiz portal for automating remediation of common cloud misconfigurations?
Answer: B. Deploying Remediation & Response resources (like serverless functions) in the customer's cloud environment, triggered by Automation Rules based on Issues/Findings.
Wiz deploys Remediation and Response resources like serverless functions directly into your environment to automate fixes. Do not confuse this automated remediation with manual API exploration or CLI commands.
Q4. You need to integrate Wiz with a self-managed Kubernetes cluster whose API endpoint is located in a private subnet and is not internet-facing. Which component must be deployed to establish secure connectivity between the cluster and the Wi…
Answer: C. Wiz Broker
The Wiz Broker acts as a secure reverse proxy tunnel connecting the backend to private or isolated resources. The Runtime Sensor and Admission Controller handle workload protection and policy enforcement, not network bridging.
Q5. Wiz uses the cloud provider's API calls for configuration scanning. Which cloud provider service requires a special, separate onboarding step (in addition to the standard Cloud Connector) to be fully scanned for security risks?
Answer: C. AWS EKS (Elastic Kubernetes Service).
AWS EKS requires an additional specific onboarding step beyond the standard connector to scan its configuration. Remember that Wiz handles Azure AKS and GCP GKE automatically through their native connectors.
Q6. If a user only has permissions granted to access a single, specific resource, how does Wiz typically categorize their access level?
Answer: C. Wiz does not indicate the user is an Admin, as there is little to no risk of account takeover.
Limiting permissions to a single resource minimizes account takeover risk, so Wiz does not flag the user as an Admin. Wiz reserves the Admin risk indicator for broad, high-impact access scopes.
Q7. What primary technology does Wiz use for its API endpoint?
Answer: D. GraphQL, providing flexibility and efficiency over multiple REST requests.
Wiz uses GraphQL for its API to give you flexible and efficient data retrieval. This architecture lets you query exact data needs in a single request instead of chaining multiple REST endpoints.
Q8. What is the result object generated on the Security Graph when a Cloud Configuration Rule (CCR) detects that a specific cloud resource does not comply with the rule's defined configuration?
Answer: C. A Cloud Configuration Finding.
Failed Cloud Configuration Rules generate Cloud Configuration Findings on the Security Graph. Distinguish this from Host Configuration Findings, which focus on vulnerabilities inside the operating system.
Q9. What is the security prerequisite that must be satisfied before defining a custom Cloud Configuration Rule that uses the Admission Controller to validate Kubernetes deployments?
Answer: B. The user must be familiar with Rego, the language in which CCRs are written.
You must know the Rego policy language because Wiz custom rules for the Admission Controller are written using it. Admin rights or deploying a Broker will not help you write the actual policy logic.
Q10. What is the recommended method for an automation script in a production environment to authenticate and interact with the Wiz GraphQL API?
Answer: A. Use a Service Account with appropriate permission scopes.
Service accounts provide secure, non-interactive authentication with specific permission scopes for automation. Hardcoded API keys are legacy or meant for basic testing, while device code flows and interactive MFA logins fail unattended scripts.
Q11. When creating a new Container Registry Connector in Wiz, what information is required to authenticate to an Azure Container Registry (ACR)?
Answer: B. A Service Principal created in Azure, identified by a Client ID and Client Secret.
Wiz requires a Service Principal with appropriate permissions, authenticated via a Client ID and Secret, to access an Azure Container Registry. Standard administrative credentials are unsupported because least-privilege programmatic access is expected.
Q12. Which type of Wiz user role possesses the necessary scope to create an Integration that can be utilized and trigger Automation Rules across all Projects?
Answer: D. Global roles with Write permissions on the Settings > Deployments page.
Global roles with Write permissions are required to create organization-wide Integrations and Automation Rules. Project-scoped roles lack the necessary cross-tenant visibility, causing integrations and triggered rules to fail outside their projects.
Q13. What types of resources or findings are used to scope an Ignore Rule?
Answer: B. Rule type, severity, binding types, target resources, and project scope.
Ignore Rules offer granular scoping using rule type, severity, binding types, target resources, and project scope. This flexibility ensures false positives or accepted risks are suppressed precisely without hiding unrelated critical security issues.
Q14. If you are trying to view a resource's full metadata payload as retrieved directly from the Cloud Service Provider (CSP) API, where in the Wiz portal should you look?
Answer: A. The JSON tab in the resource's detail drawer.
The raw metadata fetched from the cloud provider API for a resource can be viewed by opening the resource detail drawer and navigating to the JSON tab. Configuration history tracks changes over time, while the graph builder visualizes relationships.
Q15. What is the recommended best practice for managing application user authentication to the Wiz portal?
Answer: B. Configuring customer-managed SAML identity providers for Single-Sign On (SSO).
Configuring an external SAML identity provider for single sign-on is the recommended best practice because it centralizes identity management. Creating local accounts is only for break-glass scenarios, and API tokens are strictly for automation.
More Wiz Cloud Fundamentals drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.