Practice for the Wiz Cloud Fundamentals exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which AWS IAM Policy is required for Wiz to perform workload and data scans on Amazon Lightsail resources?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Wiz Cloud Fundamentals practice test →
What you will practice
- Which AWS IAM Policy is required for Wiz to perform workload and data scans on Amazon Lightsail resources?
- Which deployment allows customers to perform CSPM assessment and workload scanning in near real-time to rapid…
- Which security feature is supported only in the Wiz Cloud Advanced license (or Wiz for Gov Advanced) and is g…
- When connecting Wiz to a Container Registry, what specific API request must Wiz be able to successfully execu…
- If a Wiz user is blocked from performing an action in the portal and receives a 'Missing Permissions' error…
- When connecting Wiz to an AWS environment, what must be set up in the AWS Organization to allow CloudFormatio…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which AWS IAM Policy is required for Wiz to perform workload and data scans on Amazon Lightsail resources?
Answer: D. WizLightsailScanningPolicy.
The WizLightsailScanningPolicy is specifically designed to grant the necessary permissions for workload and data scanning on Amazon Lightsail resources. General policies lack the specific service actions required for Lightsail enumeration.
Q2. Which deployment allows customers to perform CSPM assessment and workload scanning in near real-time to rapidly update Graph objects based on specific cloud events?
Answer: C. Near real-time scanning feature enablement.
Enabling near real-time scanning uses Cloud Event Connectors to trigger rescans immediately after specific infrastructure changes. Broker deployments handle access, while admission controllers focus on Kubernetes deployment blocking.
Q3. Which security feature is supported only in the Wiz Cloud Advanced license (or Wiz for Gov Advanced) and is generally unavailable in the Wiz Cloud Essential license?
Answer: B. Internal network exposure analysis.
Internal network exposure analysis requires the Advanced license because it calculates complex internal connectivity. Essential licenses include external exposure analysis, software bill of materials generation, and basic secrets scanning functionality.
Q4. When connecting Wiz to a Container Registry, what specific API request must Wiz be able to successfully execute to retrieve image metadata, as per Docker specifications?
Answer: B. GET /v2/_catalog
The standard Docker Registry API requires a successful GET request to the endpoint to retrieve a list of repositories. This allows Wiz to properly enumerate container images before pulling tags or manifests for vulnerability scanning.
Q5. If a Wiz user is blocked from performing an action in the portal and receives a 'Missing Permissions' error, which component is primarily responsible for resolving this issue?
Answer: C. The user's Wiz Administrator (to update their Role Based Access Control).
Portal permissions are governed by Wiz's Role Based Access Control. The user must contact their Wiz Administrator to adjust their assigned role or access scope within the tenant. The cloud provider admin manages cloud infrastructure, not portal access.
Q6. When connecting Wiz to an AWS environment, what must be set up in the AWS Organization to allow CloudFormation StackSets to automatically provision the required Wiz roles across multiple accounts?
Answer: C. 'Trusted Service' must be enabled for CloudFormation StackSets in AWS Organization settings.
Enabling CloudFormation StackSets as a trusted service in AWS Organizations is required to automatically provision the necessary roles across multiple accounts. The root user should never be used for standard deployments.
Q7. What policy management mechanism is used to fine-tune the balance of generated issues by allowing users to exclude specific combinations of findings and resources from generating issues in defined use cases?
Answer: D. Ignore Rules.
Ignore Rules explicitly suppress alerts when a finding and resource combination is deemed an acceptable risk or false positive. Custom Controls create new detections rather than tuning out existing noise for specific scenarios.
Q8. A user is experiencing an 'RBAC Error' and cannot see data or use the Wiz portal. What is the most likely cause of this issue?
Answer: B. The user's role does not have the necessary permissions to view the requested data or perform the action.
An RBAC error means the user lacks the necessary permissions for their requested action or data view. Multi-factor authentication failures prevent portal login entirely rather than generating specific access errors.
Q9. Which type of encryption keys are defined as 'Secrets' and are essential for securing communications to websites, often stored and managed in dedicated services like AWS Certificate Manager?
Answer: B. Cloud Certificates (SSL/TLS certificates)
SSL or TLS certificates secure web communications and are managed via dedicated cloud services like AWS Certificate Manager. For the exam, remember that keys and certificates are treated as secrets, but standard KMS keys and SSH keys serve different encryption or access functions.
Q10. According to Wiz's internal Vulnerability Management Policy, what is the required remediation timeframe for Critical vulnerabilities identified on publicly exposed systems in the development and production environments?
Answer: A. Remediation within 48 hours.
Wiz policy mandates remediating critical vulnerabilities on publicly exposed development and production systems within forty-eight hours. Shorter timeframes apply to internet-facing assets, whereas internal or low-severity findings typically allow longer remediation windows like fourteen days.
Q11. Which of the following integration behaviors allows Wiz to receive security scan results from a third-party tool (like Checkmarx or BigID) and use them to enhance the Security Graph?
Answer: C. Enrich
The Enrich behavior allows Wiz to ingest external findings to add context to the Security Graph. Watch out for Consume, which can seem correct for ingesting data, but Enrich is the specific terminology for adding third-party security context.
Q12. When connecting Wiz to GCP at the Organization level, what specific set of roles must the user performing the connection possess?
Answer: C. roles/iam.serviceAccountAdmin, roles/iam.organizationRoleAdmin, and roles/iam.securityAdmin.
Connecting Wiz to a GCP organization requires specific administrative roles including service account admin, organization role admin, and security admin. Remember that standard project level roles are insufficient for organization wide access deployment.
Q13. A team wishes to visualize the architecture, risk, and relationships between resources programmatically using a query language. Which page in the Wiz portal offers the most direct tools for building these queries?
Answer: C. The API Explorer.
The API Explorer is the in-app tool used to write, validate, and test GraphQL queries, which are essential for navigating the Security Graph. The Inventory page provides graphical filtering rather than direct programmatic querying.
Q14. Which specific hosted technology, supported by Wiz's workload scanning capabilities, has detection support for End of Life (EOL) detection?
Answer: D. Apache Struts
Among the provided options, Apache Struts features explicit support for end-of-life detection within Wiz's workload scanning capabilities. Standard SaaS platforms like Asana typically lack local workload EOL scanning, while frameworks might only trigger general package vulnerability alerts.
Q15. Which two locations in the Wiz portal can experienced users navigate to access developer tools such as the API Explorer and API Console?
Answer: C. User Icon > Developer and using the keyboard shortcut Ctrl +
Developer tools are accessible via the User Icon menu and the Ctrl keyboard shortcut. Settings and Connect to Wiz pages handle infrastructure connectors and licensing, not direct API exploration or interactive GraphQL queries.
More Wiz Cloud Fundamentals drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.