Practice for the Wiz Cloud Fundamentals exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which risk domain involves scanning repository branches and commits to find exposed credentials and keys?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Wiz Cloud Fundamentals practice test →
What you will practice
- Which risk domain involves scanning repository branches and commits to find exposed credentials and keys?
- In the context of the Wiz portal, what is the key difference between a Wiz Issue and a Finding when investiga…
- You need to connect Wiz to an AWS environment. What is the strongly recommended approach for connecting to en…
- Which statement accurately describes the data flow principle related to Wiz's handling of sensitive findings?
- Which role permission is necessary for a Wiz user to successfully create a new Service Account within the Wiz…
- When using an AI Assistant (like Claude Desktop) to connect to the remote Wiz Model Context Protocol (MCP) se…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which risk domain involves scanning repository branches and commits to find exposed credentials and keys?
Answer: C. Secrets
The Secrets risk domain handles scanning repository branches and commits to uncover exposed credentials. External Exposure focuses on internet-facing attack surfaces, while Cloud Entitlements analyzes permissions.
Q2. In the context of the Wiz portal, what is the key difference between a Wiz Issue and a Finding when investigating risks?
Answer: B. Findings represent atomic, low-context risks; Issues represent high-context, toxic combinations/attack paths.
Findings represent low-context, atomic risks, whereas Issues aggregate those risks into highly contextual attack paths. Remembering that Issues highlight toxic combinations is a crucial conceptual distinction.
Q3. You need to connect Wiz to an AWS environment. What is the strongly recommended approach for connecting to ensure comprehensive visibility, including for future accounts?
Answer: B. Connecting via the Organization level using CloudFormation or Terraform.
Connecting at the Organization level using CloudFormation or Terraform ensures both existing and future AWS accounts are automatically discovered. Avoid connecting individual accounts manually, as this creates administrative overhead and leaves new accounts vulnerable to visibility gaps.
Q4. Which statement accurately describes the data flow principle related to Wiz's handling of sensitive findings?
Answer: A. Wiz temporarily processes sensitive data during SaaS scanning but avoids storing intact copies in its backend.
Wiz adheres to a strict metadata-only design principle for its backend storage. While sensitive data might be temporarily processed during scans, it is never stored intact, and sensitive values like discovered secrets are redacted before anything is saved.
Q5. Which role permission is necessary for a Wiz user to successfully create a new Service Account within the Wiz portal?
Answer: C. Write (W) permission on service accounts.
Creating a new Service Account requires Write permissions specifically on service accounts. Remember that read access only allows viewing existing configurations, while global roles are typically too broad and lack the specific write access needed for account creation.
Q6. When using an AI Assistant (like Claude Desktop) to connect to the remote Wiz Model Context Protocol (MCP) server, where does this server run?
Answer: B. On your existing Wiz tenant.
The remote Model Context Protocol server runs directly on your existing Wiz tenant. Do not confuse the remote server with older or local implementations, which require separate infrastructure and are no longer actively maintained.
Q7. When defining an Automation Rule using a Posture Issue trigger, which of the following statuses can reliably trigger the action?
Answer: A. Created, Resolved, or Due.
Posture Issues can reliably trigger Automation Rules when they are created, resolved, or approaching their due date. Options like ignored or archived statuses represent terminal states that do not actively initiate new automated workflows.
Q8. When using Wiz's DSPM feature, which classification rule type must customers use if they need to detect information unique to their business (e.g., proprietary client codes)?
Answer: C. Custom data classifiers
Custom data classifiers allow customers to detect unique business-specific information beyond standard categories like PII. For the exam, associate custom classifiers strictly with proprietary data detection, whereas built-in rules cover standard regulatory information.
Q9. When setting up auto-remediation, what is the primary consequence of marking a response action as 'disruptive' in the Response Actions Catalog?
Answer: B. It flags the action so that only privileged users are permitted to execute it.
Marking a response action as disruptive restricts its execution to privileged users only. This provides a necessary guardrail against accidental outages, ensuring standard operators cannot accidentally trigger destructive auto-remediation workflows on critical resources.
Q10. What are the three main phases involved when Wiz calculates a resource's effective network exposure?
Answer: C. Building the network architecture, calculating effective ingress (analysis), and dynamic scanner validation.
Calculating effective network exposure involves mapping the architecture, calculating potential ingress paths, and validating them dynamically. Remember that Wiz relies on static graph analysis combined with active scanner validation, rather than runtime monitoring or policy enforcement.
Q11. Which language does the Wiz API primarily use, offering significant flexibility by allowing integrators to define precisely the data they want and replace multiple previous-generation requests with a single call?
Answer: D. GraphQL
The Wiz API uses GraphQL, which provides greater flexibility than older REST endpoints, enabling users to request only the specific data needed in a single call. Expect to see GraphQL as the correct choice whenever questions emphasize API efficiency and defining precise data payloads.
Q12. To scan a sovereign AWS environment (like GovCloud), what type of deployment architecture is mandatory for workload scanning capabilities?
Answer: B. Wiz Outpost deployment.
Due to regulatory and connectivity constraints in sovereign environments like AWS GovCloud, the Wiz Outpost deployment architecture is required for workload scanning. A standard SaaS deployment cannot reach these isolated environments, making the Outpost the mandatory architecture.
Q13. To connect Wiz to a VMware vSphere environment, what API connection must be established?
Answer: B. An API connection to the vCenter server that orchestrates the ESXi hosts.
The VMware vSphere Connector requires an API connection established with the vCenter server, which manages and orchestrates the ESXi hosts. Connecting directly to individual ESXi hosts is incorrect because vCenter provides the centralized management plane required for environment-wide scanning.
Q14. You need to detect new, generative malware families, such as webshells or crypto miners, that are not yet recorded in public hash-based databases. Which Wiz component and rule set are specifically responsible for this pattern-based detecti…
Answer: C. The Malware Analyzer using proprietary YARA rules
The Wiz malware analyzer uses a proprietary engine and YARA rules maintained by the Wiz research team to identify pattern-based generative malware commonly found in cloud environments. Rule out vulnerability management, as that focuses on known software flaws rather than identifying novel malicious code.
Q15. A Global Administrator wants to limit a new user's visibility so they only see cloud resources belonging to the 'Marketing' department. How can this visibility scope be applied using Wiz management components?
Answer: C. By assigning the Marketing department's resources to a dedicated Wiz Project, and then scoping the user's Role Based Access Control (RBAC) permissions to that Project.
Projects allow you to subdivide resources by department, and scoping RBAC permissions to that project restricts visibility. Ignore rules are for filtering alert noise, while configuration rules evaluate compliance rather than access.
More Wiz Cloud Fundamentals drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.