Practice for the Wiz Cloud Fundamentals exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which of the following activities best describes the functionality provided by the Technology Inventory page?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Wiz Cloud Fundamentals practice test →
What you will practice
- Besides using Ignore Rules, what is a common strategy for fine-tuning Wiz policies?
- A finding in Wiz represents a specific vulnerability or misconfiguration on a resource. What is the term Wiz…
- What is the primary function of the Wiz Admission Controller (AC) in a Kubernetes environment?
- When evaluating multiple Target Companies (TCs) during an M&A using Wiz, what is the best recommended strateg…
- Automation Rules are configured to trigger an action when a Wiz Issue is created. Where in the Wiz portal do…
- When examining potential supply chain attacks, which Inventory page should a security team review to identify…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Besides using Ignore Rules, what is a common strategy for fine-tuning Wiz policies?
Answer: A. Creating custom Controls by defining a custom Security Graph query linked to a specific severity.
Creating custom Controls with graph queries is correct because it lets you tailor risk detection to specific environmental needs. You cannot directly modify the underlying logic of built-in rules, which is a frequent distractor on the exam.
Q2. A finding in Wiz represents a specific vulnerability or misconfiguration on a resource. What is the term Wiz uses for the combination of resources and multiple findings that collectively represent a real, exploitable risk to cloud infrastr…
Answer: C. Issue
An Issue is correct because it represents the contextual aggregation of multiple findings into a prioritized, exploitable toxic combination. A Control is simply the query rule that detects the risk, while the Issue is the actual resulting alert.
Q3. What is the primary function of the Wiz Admission Controller (AC) in a Kubernetes environment?
Answer: B. To enforce security policies by auditing or blocking resource deployments or modifications that violate pre-defined policies.
Enforcing security policies by auditing or blocking deployments is correct because the Admission Controller acts as a Kubernetes gatekeeper. It operates preemptively at deployment time, contrasting with continuous network monitoring or agentless scanning options.
Q4. When evaluating multiple Target Companies (TCs) during an M&A using Wiz, what is the best recommended strategy for segregating the TCs' data from the Acquiring Company's (AC) environment?
Answer: C. Spin up an entirely new, standalone Wiz tenant for each TC.
Creating a completely standalone Wiz tenant for each target company ensures maximum data segregation during mergers and acquisitions. Relying on projects or RBAC within a shared tenant risks accidental data leakage between the parties.
Q5. Automation Rules are configured to trigger an action when a Wiz Issue is created. Where in the Wiz portal do you define the trigger (WHEN) and the action (THEN) for such an automation?
Answer: C. Automation > Automation Rules > Create Rule.
Automation Rules are configured in the dedicated Automation section by defining a trigger and a corresponding action. Do not confuse global automation triggers with control actions, which are configured separately within the Policies menu.
Q6. When examining potential supply chain attacks, which Inventory page should a security team review to identify all manually and auto-connected registries discovered in their environment?
Answer: C. Inventory > Container Registries.
The Container Registries page under the Inventory tab lists all manually connected and auto-discovered registries in the environment. Reviewing the SBOM is helpful for package vulnerabilities but does not map the actual registry infrastructure connections.
Q7. Wiz classifies security findings based on the type of technology detected. Which feature supports application fingerprinting under the networking section, identifying frameworks like Angular and Go?
Answer: B. Hosted Technology detection
Hosted Technology detection identifies frameworks like Angular and Go through application fingerprinting. Software Bill of Materials focuses on package dependencies, whereas this feature profiles the running infrastructure.
Q8. Policies are used to generate findings that eventually become Issues. In the data flow diagram, which scanning component generates Host Configuration Findings and Vulnerability Findings?
Answer: C. Workload scanning.
Workload scanning is responsible for generating Host Configuration and Vulnerability findings by examining the actual machine snapshots. While API interrogation gathers high-level cloud control plane data, deep host analysis relies entirely on agentless workload scanning.
Q9. Which Wiz Support license level, typically intended for large enterprises, includes access to Technical Account Managers (TAMs) and specific training offerings like training labs and certifications?
Answer: B. Enterprise support
Enterprise support is the level that provides access to Technical Account Managers and specific training offerings like certifications. Note that Elite is not a standard tier, making Enterprise the definitive choice for large organizations needing dedicated resources.
Q10. Where would an experienced user go to review the current list of API permission scopes and their corresponding accessible GraphQL APIs (queries and mutations) within the Wiz documentation?
Answer: C. APIs and Required Permission Scopes documentation
The dedicated APIs and Required Permission Scopes documentation provides the mapping between GraphQL queries and their necessary scopes. Do not confuse this with the in-product audit log, which tracks historical user activity rather than serving as a development reference.
Q11. When creating a custom response function in Azure using Remediation & Response, which language version is required for the function code?
Answer: C. Python version 3.11.
When creating custom Azure response functions, you must use Python version 3.11 to match the container image provided by Wiz. The exam expects you to know the specific technical constraints for deploying these automated remediation scripts in cloud environments.
Q12. If an organization wants to integrate Wiz with a private Azure Container Registry (ACR) that has no direct internet access, what additional deployment model is required to facilitate scanning?
Answer: B. A fully deployed Azure Self-managed Network Outpost.
Scanning a private Azure Container Registry without internet access requires deploying a self-managed network Outpost inside your environment. A standard Broker handles external API connections, while the Outpost architecture provides the necessary local network reachability.
Q13. Which of the following describes the key security design principle used by Wiz, meaning all infrastructure changes are performed via automated code, and manual changes are strictly governed and monitored?
Answer: B. Infrastructure-as-Code (IaC)
Infrastructure-as-Code is the correct security design principle because it ensures changes are made via automated code with strict controls over manual interventions. Do not confuse this with immutable infrastructure, which focuses on replacing components rather than modifying them.
Q14. What is the key limitation of using the Wiz Admission Controller (Wiz AC) compared to standard agent-based security solutions in Kubernetes?
Answer: D. Wiz AC requires either a Wiz Cloud Advanced or Wiz for Gov Advanced license.
The key requirement is that the Wiz Admission Controller requires an Advanced license tier for deployment. While licensing is an important implementation prerequisite, the phrasing comparing it to agent-based limitations makes this a slightly flawed but valid question.
More Wiz Cloud Fundamentals drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.