Practice for the Wiz Cloud Fundamentals exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which vulnerability source is listed among the dozens of public sources leveraged by Wiz to ingest vulnerability data?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Wiz Cloud Fundamentals practice test →
What you will practice
- Which vulnerability source is listed among the dozens of public sources leveraged by Wiz to ingest vulnerabil…
- If a customer enables Data Security Posture Management (DSPM) scanning in Azure, which optional built-in role…
- A user in a Wiz for Gov environment needs to ensure they are accessing the correct portal URL. What is the ba…
- Where in the Wiz portal can a user go to test and validate GraphQL API queries before integrating them into c…
- Which third-party system categories are explicitly mentioned as suitable destinations for exporting Wiz vulne…
- A security analyst uses the Wiz Security Graph search function. Which capability is enabled because the Secur…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which vulnerability source is listed among the dozens of public sources leveraged by Wiz to ingest vulnerability data?
Answer: C. National Vulnerability Database (NVD)
The National Vulnerability Database is one of the public sources Wiz uses to ingest vulnerability data alongside cloud service provider feeds. Watch for valid vulnerability databases versus unrelated enumeration frameworks.
Q2. If a customer enables Data Security Posture Management (DSPM) scanning in Azure, which optional built-in role is granted to the 'Wiz Enterprise' application to provide read access to Azure Storage blob containers and the data within them?
Answer: D. Storage Blob Data Reader
The Storage Blob Data Reader role provides the explicit read access needed for the Wiz application to scan blob contents. The standard Reader role only grants management plane access and cannot see the actual data.
Q3. A user in a Wiz for Gov environment needs to ensure they are accessing the correct portal URL. What is the base URL for the FedRAMP authorized Wiz for Gov offering?
Answer: C. https://app.wiz.us
The FedRAMP authorized Wiz for Gov environment specifically uses the app dot wiz dot us base URL. Remember that standard commercial tenants simply use the app dot wiz dot io domain.
Q4. Where in the Wiz portal can a user go to test and validate GraphQL API queries before integrating them into custom automations?
Answer: B. Profile Icon > Developer > API Explorer
The API Explorer is located under the Profile Icon and Developer menu, allowing you to test queries safely. Remember that integrations are configured in system settings, not the developer workspace.
Q5. Which third-party system categories are explicitly mentioned as suitable destinations for exporting Wiz vulnerability data to assist in remediation and security operations?
Answer: A. SOAR systems (like Cortex XSOAR/QRadar) or SIEMs (like Azure Sentinel/Splunk apps).
Wiz exports vulnerability data to security operations systems like SOARs and SIEMs to aid in incident response. Ticketing systems like Jira receive broader issue tracking data rather than just raw vulnerability feeds.
Q6. A security analyst uses the Wiz Security Graph search function. Which capability is enabled because the Security Graph uses a graph database model?
Answer: B. Discovering complex risk correlations by traversing connected components.
The graph database model allows the Security Graph to efficiently discover complex risk correlations and attack paths by traversing connected components. SQL queries are incorrect because the underlying structure is a graph, not a relational database.
Q7. Wiz's Vulnerability Management capability uses which standards and sources to assign severities to vulnerabilities?
Answer: B. Common Vulnerability Scoring System (CVSS) and ingestion from sources like NVD and CSPs.
Wiz uses the Common Vulnerability Scoring System alongside external ingestion sources like NVD to assign vulnerability severities. CIS Benchmarks are a distractor because they evaluate cloud configurations rather than software vulnerabilities.
Q8. Which Wiz portal feature is designed for identifying technologies and cloud services present in the environment, helping users understand their software landscape?
Answer: A. The Technology Inventory
The Technology Inventory is the designated portal feature for identifying hosted technologies and cloud services in the environment. The Threat Center fails as a distractor because it displays active security alerts rather than mapping the software landscape.
Q9. In the context of driving security accountability through gamification within Wiz, what feature serves as the foundational structure for defining clear ownership of risks across teams or business units?
Answer: C. Wiz Projects
Projects establish logical boundaries that assign clear risk ownership to specific teams or business units. For gamification to work effectively, accountability must map exactly to these projects, rather than to broad policies or raw graph data.
Q10. Where does Wiz collect the configuration details necessary to evaluate Host Configuration Rules (HCRs)?
Answer: B. Via workload scanning, which extracts information from disk snapshots/clones.
Host Configuration Rules are evaluated using data extracted during agentless workload scanning. Because these rules analyze the operating system state, Wiz relies on disk snapshots rather than standard API metadata, which only provides a surface-level resource overview.
Q11. Which statement correctly describes the nature of the permissions granted to Wiz during the standard AWS SaaS Connector deployment process?
Answer: B. Wiz is granted read-only permissions (Wiz Access Role) to fetch cloud metadata.
The standard SaaS connector deploys a read-only role to safely fetch cloud metadata. Wiz avoids requiring administrator or write permissions for environmental scanning to strictly adhere to least privilege principles, using external identifiers solely for role assumption.
Q12. When talking about secrets in cloud computing, what sensitive items are typically included in this category?
Answer: B. API keys, passwords, encryption keys, tokens, and credentials.
Secrets include digital authentication mechanisms like API keys, passwords, and tokens used to secure access. Public configurations and audit logs are not secrets because they do not inherently provide privileged system access like compromised credentials would.
Q13. In the Wiz platform, what is the role of the Identity Analyzer module?
Answer: B. To analyze permissions granted and used to discover lateral movement paths and highlight high-privileged roles.
The Identity Analyzer evaluates effective permissions to uncover lateral movement paths and over-privileged identities. It goes beyond basic network mapping by highlighting risky permission combinations, whereas scanning for keys relies on workload analysis.
Q14. In the process of fine-tuning policies and reducing noise, what is the function of 'Ignore rules'?
Answer: B. To prevent the creation of new Wiz Issues for specific types of findings or resources in particular use cases.
Ignore rules prevent the creation of issues for specific findings or resources in approved scenarios. This allows teams to reduce noise without disabling scanning entirely, which is critical for maintaining operational focus and accurate reporting metrics.
Q15. Wiz provides security solutions across various phases of the software lifecycle. Which statement accurately reflects Wiz's overall approach to scanning?
Answer: B. Wiz uses agentless scanning via API connectors to interrogate cloud APIs and perform out-of-band analysis on workloads.
Wiz performs agentless scanning by querying cloud APIs and analyzing disk snapshots out-of-band. This approach avoids the performance overhead and management complexity of persistent agents while providing deep visibility into vulnerabilities and configurations.
More Wiz Cloud Fundamentals drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.