Practice for the Wiz Cloud Fundamentals exam with 14 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: How often does the Wiz Admission Controller (versions 2.5.9 and above) communicate with the Wiz backend to fetch the lat. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Wiz Cloud Fundamentals practice test →
What you will practice
- How often does the Wiz Admission Controller (versions 2.5.9 and above) communicate with the Wiz backend to fe…
- For a customer deploying Wiz Outpost in an Azure environment, what must be created in the Azure subscription…
- If you are converting an existing AWS Account-level Cloud Connector to the Organization deployment method, wh…
- If a user forgets their password for a local Wiz account, which page should they navigate to immediately to b…
- A Wiz API Service Account needs to be created for a new integration. Which prerequisite must the user creatin…
- Which Wiz component is responsible for analyzing the configurations of assets like VPCs, subnets, and network…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. How often does the Wiz Admission Controller (versions 2.5.9 and above) communicate with the Wiz backend to fetch the latest Admission Policies?
Answer: C. Every 5 minutes.
The Admission Controller polls the backend every five minutes to cache and enforce the latest policies locally. Real-time blocking is a distractor, as the controller relies on this polling interval rather than synchronous cloud calls.
Q2. For a customer deploying Wiz Outpost in an Azure environment, what must be created in the Azure subscription to perform the actual snapshot scanning functionality?
Answer: B. A Wiz Disk Analyzer – Scanner app and a Wiz Enterprise application.
Azure Outpost requires the Wiz Enterprise application to fetch metadata and a dedicated Disk Analyzer scanner app for snapshots. Runtime sensors handle in-memory threat detection, which is different from disk snapshot analysis.
Q3. If you are converting an existing AWS Account-level Cloud Connector to the Organization deployment method, which benefit are you primarily gaining?
Answer: B. Centralizing Connector management via a single Stack in the Management Account.
Converting to an Organization deployment centralizes management into a single Management Account CloudFormation stack. You still need local roles in child accounts for scanning, so eliminating IAM entirely is a distractor.
Q4. If a user forgets their password for a local Wiz account, which page should they navigate to immediately to begin the recovery process?
Answer: B. The Reset password page
Users with local accounts must use the designated reset password page to recover their credentials. Single sign-on portals handle corporate identities, while command-line tools are for infrastructure configuration.
Q5. A Wiz API Service Account needs to be created for a new integration. Which prerequisite must the user creating the Service Account meet?
Answer: B. The user must be logged in as a Wiz user with Write (W) permission on service accounts.
Service account creation requires Write permissions on service accounts within Wiz. The strongest distractor, Global Admin, fails because Wiz RBAC governs access internally rather than relying on cloud provider roles.
Q6. Which Wiz component is responsible for analyzing the configurations of assets like VPCs, subnets, and network security groups to build the foundational architecture for risk assessment?
Answer: B. The Network Analyzer (Network exposure module).
The Network Analyzer is responsible for analyzing cloud configurations to map connectivity and build the architecture used for risk assessment. The Workload Scanner is a distractor because it inspects workloads for vulnerabilities, not network topology.
Q7. When establishing a Kubernetes Connector to a cluster using the Wiz Broker, what key information does the Broker initiate the connection to the Wiz backend with?
Answer: C. A unique, high-entropy connector token generated for the customer's Connector.
The Wiz Broker authenticates to the backend using a unique, high-entropy connector token generated for the specific connector. It does not use cluster administrator credentials, ensuring secure, least-privilege communication.
Q8. When scanning for vulnerabilities, what methodology does Wiz use to identify standardized naming conventions for software components and their versions, making it easier to track affected technologies?
Answer: B. CPE (Common Platform Enumeration).
Wiz uses Common Platform Enumeration, or CPE, as the standardized naming convention to identify software components and their versions. CVSS is incorrect because it scores vulnerability severity rather than naming the software itself.
Q9. If you create custom Python response functions for AWS Remediation & Response, where should the finished script file (e.g., CUSTOM-TERMINATE-EC2.py) be stored?
Answer: B. In a dedicated S3 bucket, within a folder named wiz/response_functions.
Custom Python response functions must be stored in a dedicated S3 bucket inside the specific folder path wiz/response_functions. Storing them in the root directory is incorrect and prevents the Wiz platform from properly locating the script.
Q10. What is the primary limitation of the legacy Secure Auto-remediation feature that led to its replacement by Remediation & Response?
Answer: C. It required admin/highly privileged roles in the customer environment.
The legacy auto-remediation feature required highly privileged roles in the customer environment. This conflicted with least privilege principles, prompting the shift to Remediation and Response, which offers secure, granular playbooks and better access controls.
Q11. When connecting Wiz to a GCP environment at the Organization level, which set of IAM roles must the connecting user have?
Answer: A. roles/iam.serviceAccountAdmin, roles/iam.organizationRoleAdmin, and roles/iam.securityAdmin.
Deploying at the GCP organization level requires specific administrative roles for service accounts, organization roles, and security. Simple viewer roles lack the necessary permissions to establish the required service accounts and ingest security data.
Q12. Which two primary security outcomes are enabled when connecting Wiz to cloud event logs (such as AWS Cloud Events, Azure Activity Logs, or GCP Pub/Sub)?
Answer: B. Near real-time scanning/CSPM assessment and Cloud events & detections.
Connecting to cloud event logs enables near real-time scanning for configuration changes and powers Cloud Detection and Response. The question asks for two outcomes, but provides single-letter options instead of combinations, creating a mismatch.
Q13. When examining a vulnerable Windows workload, Wiz identifies risks associated with knowledge base (KB) updates. How does Wiz identify these KB updates as a hosted technology?
Answer: B. Wiz shows KB version as hosted technology both on the Windows and the Windows server/estop hosted technologies.
Wiz displays the Windows KB version as hosted technology directly within both Windows and Windows Server listings. Expect to see KB articles translated into numerical build versions during the exam rather than querying Microsoft directly.
More Wiz Cloud Fundamentals drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.