Practice for the Wiz Cloud Fundamentals exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: When monitoring the security health of Wiz deployment components (like the Wiz Admission Controller or Wiz Broker), wher. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Wiz Cloud Fundamentals practice test →
What you will practice
- When monitoring the security health of Wiz deployment components (like the Wiz Admission Controller or Wiz Br…
- You decide to enable auto-remediation for a misconfiguration based on a specific Cloud Configuration Rule. Wh…
- A Wiz Cloud Advanced license holder wants to enable near real-time scanning for Azure infrastructure. This re…
- What primary purpose do Wiz Projects serve in managing a cloud environment?
- What happens to Secret Findings and Data Findings before Wiz stores the results in its backend databases?
- What Wiz CLI capability helps organizations 'shift left' security by preventing insecure assets from reaching…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. When monitoring the security health of Wiz deployment components (like the Wiz Admission Controller or Wiz Broker), where are System Health Issues (SHIs) reported in the portal?
Answer: B. Settings > System Health
System Health Issues for deployed Wiz components like the Broker or Admission Controller are surfaced under Settings > System Health. For the exam, remember that operational connector health lives in Settings, not in the main Issues queue.
Q2. You decide to enable auto-remediation for a misconfiguration based on a specific Cloud Configuration Rule. Where are the high-level components of this automated workflow configured and deployed?
Answer: A. Cloud Configuration Rules configured in Wiz, and serverless playbooks deployed in the customer's environment.
Auto-remediation uses a hybrid model where Wiz defines the triggering rule, but serverless playbooks execute within the customer environment. Wiz does not host the remediation logic to maintain customer infrastructure boundaries.
Q3. A Wiz Cloud Advanced license holder wants to enable near real-time scanning for Azure infrastructure. This requires connecting Wiz to Azure cloud event logs. Which type of log collector is created in Azure to stream these events to Wiz?
Answer: C. An Azure Event Hub to stream activity logs.
Wiz ingests Azure activity logs by configuring an Azure Event Hub that streams events via Kafka. Sentinel and Log Analytics are monitoring tools, but the Event Hub is the specific streaming endpoint required.
Q4. What primary purpose do Wiz Projects serve in managing a cloud environment?
Answer: C. To group resources by organizational unit, purpose, or business unit for focused management and security workflows.
Wiz Projects group resources by organizational unit or business unit to enable focused management. They establish logical boundaries that scope access control and streamline security workflows.
Q5. What happens to Secret Findings and Data Findings before Wiz stores the results in its backend databases?
Answer: B. They are redacted to avoid storing intact copies of sensitive data.
Wiz redacts sensitive information within Secret and Data Findings before storing the results. This ensures intact sensitive data is never retained, reinforcing compliance while still alerting on the exposure.
Q6. What Wiz CLI capability helps organizations 'shift left' security by preventing insecure assets from reaching production and supports generating SBOM reports?
Answer: B. Scanning code, IaC, and container/VM images locally or in the CI/CD pipeline.
The Wiz CLI supports shift-left security by scanning code, infrastructure-as-code, and container images early in the pipeline to generate SBOMs. While modeling VCS architecture is useful, it is a Wiz feature rather than a direct command-line interface capability.
Q7. What types of sensitive information are commonly referred to as 'Secrets' in cloud computing, which Wiz analyzes to prevent unauthorized access?
Answer: B. API keys, passwords, encryption keys, tokens, and credentials.
Secrets include authentication data like API keys, passwords, tokens, and encryption keys. Wiz scans specifically for these hardcoded credentials to prevent unauthorized access, rather than scanning for general customer data like database records.
Q8. When a Wiz Issue is created or updated, which feature leverages integrations like Slack and Jira to notify the appropriate team members automatically?
Answer: C. Automation Rules.
Automation Rules trigger actions based on Issue updates to notify teams via integrations like Slack and Jira. Unlike scheduled reports that simply summarize activity, automation creates real-time, targeted alerts for faster remediation.
Q9. When configuring a new AWS Cloud Connector, what deployment method is strongly recommended for managing multiple accounts within an organization?
Answer: C. Organization level deployment via AWS CloudFormation StackSets from the Management Account.
Deploying via AWS CloudFormation StackSets from the Management Account is recommended for managing multi-account organizations. This centralized method streamlines onboarding significantly compared to manually deploying individual roles across accounts.
Q10. Which API standard does the Wiz API primarily use to provide flexibility in defining and retrieving only the required data?
Answer: C. GraphQL.
GraphQL provides the flexibility to query only the specific data needed, making it the standard for the Wiz API. For the exam, remember that GraphQL replaces rigid REST calls for dynamic, highly customizable data retrieval.
Q11. What is the primary architectural requirement for deploying custom response functions in AWS, Azure, or GCP using the Remediation & Response feature?
Answer: B. The basic remediation & response infrastructure must already be deployed in the customer's cloud environment.
Remediation and Response operates directly within the customer's cloud environment using their own permissions. You must deploy the foundational infrastructure stack, including the worker role and messaging services, into the target cloud before custom functions can execute.
Q12. Which of the following describes the key difference in purpose between a Wiz Finding and a Wiz Issue?
Answer: B. A Finding is a single representation of a vulnerability/misconfiguration on a resource; an Issue represents a prioritized toxic combination of multiple findings/risks.
A Finding is a single security signal on one resource, while an Issue represents a prioritized toxic combination of multiple findings. This distinction is a crucial exam concept because Issues provide the actionable context needed for effective prioritization.
Q13. A security engineer wants to automate the deployment and management of Custom Policies (Controls, Cloud Configuration Rules) within Wiz using Infrastructure as Code (IaC). Which specific tool/provider should they use?
Answer: D. Wiz Terraform Provider
The Wiz Terraform Provider is the designated tool for managing Wiz resources, custom policies, and integrations as Infrastructure as Code. While the API allows mutations, the Terraform provider is specifically built for declarative deployment.
More Wiz Cloud Fundamentals drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.