Wiz Cloud Fundamentals Practice Test – 308 Free Exam Questions with Answers

Correct answer: D. Wiz Runtime Sensor

The Wiz Runtime Sensor is the correct choice because it uses eBPF to provide real-time threat detection inside running workloads. Remember to distinguish it from the agentless scanner, which relies on disk snapshots rather than runtime analysis.

Correct answer: C. To perform workload scanning within the customer's cloud environment, keeping sensitive data snapshots within their cloud boundary, often due to data sovereignty or compliance needs.

The Outpost deployment model keeps workload scanning within the customer cloud boundary to satisfy strict data sovereignty rules. Standard SaaS deployments centrally analyze snapshots, which violates strict data residency compliance requirements.

Correct answer: A. The workload scanner detects malware using YARA rules on disk snapshots, while the Runtime Sensor detects malicious behavior in real-time within the live workload.

The agentless workload scanner statically analyzes disk snapshots for malware using YARA rules. The optional Runtime Sensor provides dynamic, real-time threat detection based on actual behavior inside the running workload.

Correct answer: B. Code library dependencies (direct and transient).

Software Composition Analysis evaluates code library dependencies, including both direct and transitive packages, to find known vulnerabilities. Exam tip: SCA strictly focuses on open-source libraries, so it will never analyze operating systems, network rules, or hardcoded API keys.

Correct answer: C. Every time your environment is scanned and the Security Graph is updated.

Controls act as security graph queries that run immediately after every scan cycle to guarantee your security posture is completely up to date. Avoid options relying on strict hourly or weekly schedules, as Wiz evaluates issues dynamically based on graph updates.

Correct answer: C. Inventory > Technologies page

The Technologies page under the Inventory section provides a consolidated view of all hosted software and services discovered across your environment. Use the Resources page for individual assets, and remember that discovery dashboards summarize posture rather than listing specific technologies.

Correct answer: C. Custom data classifiers.

Custom data classifiers allow you to define specific keywords or formats unique to your business, such as internal product codes. Built-in rules only cover standard compliance data like PII, and text search lacks the active scanning integration required for DSPM discovery.

Correct answer: B. Bearer Token (JWT) derived from service account credentials.

Wiz API authentication requires exchanging service account credentials for a bearer token to authorize GraphQL queries. Basic authentication and custom certificates are unsupported, while OAuth signatures belong to legacy patterns rather than current Wiz service account workflows.

Correct answer: C. Access to Terraform state files or CloudTrail logs.

Code-to-cloud correlation requires granting Wiz access to Terraform state files or CloudTrail logs via the connector configuration. Runtime sensors and malware scanners detect active threats, but they cannot map a live cloud resource back to its original infrastructure code declaration.

Correct answer: C. A Wiz abstraction representing a specific vulnerability or risk identified on a single resource, such as a misconfiguration or CVE.

A finding accurately represents a specific risk on a single resource, such as a misconfiguration or vulnerability. Be careful not to confuse this with an issue, which groups multiple findings and context together to represent a broader security problem.

Correct answer: B. Wiz provides preconfigured stacks, templates, and response functions as a bundle for the customer's environment (e.g., AWS, Azure, GCP).

Remediation and Response deploys preconfigured infrastructure as code templates and response functions directly into the customer cloud environment. Remember that Wiz is agentless, so it relies on cloud native deployment bundles rather than installing agents.

Correct answer: D. On premises databases.

Wiz is explicitly a cloud only solution, meaning it does not scan or assess on premises databases. The platform relies entirely on cloud provider APIs and agentless cloud scanning to evaluate risk for cloud hosted infrastructure.

Correct answer: C. Which Wiz projects can use this deployment as a gateway to remediate findings.

Defining the project scope restricts which Wiz projects can utilize the deployment to execute automated remediations. This is a critical guardrail, ensuring development projects cannot trigger actions in production environments.

Correct answer: B. IT professionals, systems and security administrators, and developers who use Wiz in their daily tasks.

The exam targets IT professionals, security administrators, and developers who manage or operate the platform daily. It is not restricted to internal staff or architects, though candidates should possess hands-on cloud security experience beforehand.

Correct answer: C. Support for custom data classifiers.

Wiz enables the creation of custom data classifiers to identify unique or proprietary sensitive information specific to an organization. Manual tagging is a distractor because the platform prioritizes automated detection logic over manual label assignment.

Correct answer: B. The full path, including network interfaces, VPCs, and gateways, mapped to the internet.

Effective exposure requires mapping the entire network path from the internal resource through interfaces and gateways out to the internet. Avoid picking options that only look at direct public IPs or focus solely on IAM permissions.

Correct answer: D. 180 days.

Resolved Wiz Issues are retained for 180 days to support historical analysis and compliance reporting. Be careful not to confuse this with shorter audit log retention periods common in standard cloud provider tools.

Correct answer: B. Deploying Remediation & Response resources (like serverless functions) in the customer's cloud environment, triggered by Automation Rules based on Issues/Findings.

Wiz deploys Remediation and Response resources like serverless functions directly into your environment to automate fixes. Do not confuse this automated remediation with manual API exploration or CLI commands.

Correct answer: C. Wiz Broker

The Wiz Broker acts as a secure reverse proxy tunnel connecting the backend to private or isolated resources. The Runtime Sensor and Admission Controller handle workload protection and policy enforcement, not network bridging.

Correct answer: C. AWS EKS (Elastic Kubernetes Service).

AWS EKS requires an additional specific onboarding step beyond the standard connector to scan its configuration. Remember that Wiz handles Azure AKS and GCP GKE automatically through their native connectors.

Correct answer: C. Wiz does not indicate the user is an Admin, as there is little to no risk of account takeover.

Limiting permissions to a single resource minimizes account takeover risk, so Wiz does not flag the user as an Admin. Wiz reserves the Admin risk indicator for broad, high-impact access scopes.

Correct answer: D. GraphQL, providing flexibility and efficiency over multiple REST requests.

Wiz uses GraphQL for its API to give you flexible and efficient data retrieval. This architecture lets you query exact data needs in a single request instead of chaining multiple REST endpoints.

Correct answer: C. A Cloud Configuration Finding.

Failed Cloud Configuration Rules generate Cloud Configuration Findings on the Security Graph. Distinguish this from Host Configuration Findings, which focus on vulnerabilities inside the operating system.

Correct answer: B. The user must be familiar with Rego, the language in which CCRs are written.

You must know the Rego policy language because Wiz custom rules for the Admission Controller are written using it. Admin rights or deploying a Broker will not help you write the actual policy logic.

Correct answer: A. Use a Service Account with appropriate permission scopes.

Service accounts provide secure, non-interactive authentication with specific permission scopes for automation. Hardcoded API keys are legacy or meant for basic testing, while device code flows and interactive MFA logins fail unattended scripts.

Correct answer: B. A Service Principal created in Azure, identified by a Client ID and Client Secret.

Wiz requires a Service Principal with appropriate permissions, authenticated via a Client ID and Secret, to access an Azure Container Registry. Standard administrative credentials are unsupported because least-privilege programmatic access is expected.

Correct answer: D. Global roles with Write permissions on the Settings > Deployments page.

Global roles with Write permissions are required to create organization-wide Integrations and Automation Rules. Project-scoped roles lack the necessary cross-tenant visibility, causing integrations and triggered rules to fail outside their projects.

Correct answer: B. Rule type, severity, binding types, target resources, and project scope.

Ignore Rules offer granular scoping using rule type, severity, binding types, target resources, and project scope. This flexibility ensures false positives or accepted risks are suppressed precisely without hiding unrelated critical security issues.

Correct answer: A. The JSON tab in the resource's detail drawer.

The raw metadata fetched from the cloud provider API for a resource can be viewed by opening the resource detail drawer and navigating to the JSON tab. Configuration history tracks changes over time, while the graph builder visualizes relationships.

Correct answer: B. Configuring customer-managed SAML identity providers for Single-Sign On (SSO).

Configuring an external SAML identity provider for single sign-on is the recommended best practice because it centralizes identity management. Creating local accounts is only for break-glass scenarios, and API tokens are strictly for automation.

Correct answer: C. To ensure that all sensitive workload scanning (snapshots/disk clones) occurs entirely within the customer's environment, satisfying data residency and access regulatory requirements.

Wiz Outpost keeps workload scanning entirely within the customer environment to satisfy strict data residency and access regulatory requirements. Standard deployments send snapshot analysis back to the Wiz SaaS infrastructure.

Correct answer: C. Effective permissions and their usage.

The Identity Analyzer assesses effective permissions versus actual usage to identify overly privileged roles and potential lateral movement vectors. Network flow logs show traffic patterns but do not evaluate identity permissions directly.

Correct answer: C. WizCloudCostPolicy

The WizCloudCostPolicy is the optional managed policy required to retrieve cost data from AWS accounts for cloud cost features. Data scanning and defend policies focus on vulnerability analysis and runtime threat detection respectively.

Correct answer: C. Vulnerability findings and Cloud configuration findings.

Wiz generates vulnerability findings for software flaws and cloud configuration findings for misconfigurations like public storage buckets. While secrets and exposures are important risk vectors, they are ultimately correlated into issues rather than representing the primary scanning modules here.

Correct answer: C. Effective Exposure.

The correct answer is Effective Exposure because the Network Analyzer calculates this by mapping architecture, elements, and internet paths. Do not confuse this with Toxic Combinations, which represent chained risks rather than the baseline network path analysis.

Correct answer: B. Wiz for Cost Optimization framework

The Wiz for Cost Optimization framework is explicitly built to identify waste and architectural improvements to lower cloud bills. Security frameworks like CIS or MITRE ATT&CK focus on compliance and threat modeling, not financial savings.

Correct answer: C. Building the network architecture (the Wiz graph mapping)

The process starts by building the network architecture, which maps resources and network elements into the graph. Calculating exposure based on security rules happens after this initial architectural mapping phase is fully completed.

Correct answer: B. Global AD Administrator role

Although the permissions requested are read-only, Azure requires a Global AD Admin to approve the broad scope of permissions needed for identity analysis and audit log reading. Remember that subscription roles like Reader do not have the authority to grant directory-level consents.

Correct answer: C. A single Wiz Broker instance can only be mapped to one parent Integration, Connector, or cluster deployment.

A Wiz Broker operates with a strict one-to-one mapping requirement, meaning a single instance serves only one integration or connector. Do not assume a broker can aggregate multiple underlying connections, as this architectural limit is frequently tested.

Correct answer: C. Cloud events (security logs) that match specific criteria defined by Wiz.

Near real-time scanning is triggered by cloud events or security logs that match specific criteria defined by Wiz. Scheduled full scans are too slow for rapid assessment, so remember that event-driven architecture powers the timely updates.

Correct answer: C. A serverless parser function.

A dedicated serverless parser function inside the customer environment translates the JSON payload into actionable metadata for remediation playbooks. The Wiz Control Engine triggers the action but relies entirely on this localized parser.

Correct answer: B. Navigate to Settings > Integrations and add a GCS Integration.

Report export functionality relies on integrations, so you must configure a Google Cloud Storage integration under Settings before selecting the bucket. Avoid choosing report-level menus, as destinations are managed centrally via integrations.

Correct answer: C. The representation of the toxic combination as a Wiz Issue.

The policy management chain starts with resource collection, leading to findings, which feed controls, and finally culminates in a Wiz Issue representing a toxic combination. Automated remediation is a potential response, not the representation itself.

Correct answer: B. Findings are correlated with other risk factors to provide a full risk assessment of infected resources.

Wiz correlates malware findings with other risk factors like exposure and access to provide a contextualized and prioritized risk assessment. Findings are not automatically critical unless contextual risk elevates them.

Correct answer: B. Directory.Read.All, AuditLog.Read.All, and RoleManagement.Read.All.

The three key read permissions required for Entra ID identity analysis are Directory.Read.All, AuditLog.Read.All, and RoleManagement.Read.All. Watch for options containing write or delete permissions, as Wiz strictly uses read-only access.

Correct answer: D. WizLightsailScanningPolicy.

The WizLightsailScanningPolicy is specifically designed to grant the necessary permissions for workload and data scanning on Amazon Lightsail resources. General policies lack the specific service actions required for Lightsail enumeration.

Correct answer: C. Near real-time scanning feature enablement.

Enabling near real-time scanning uses Cloud Event Connectors to trigger rescans immediately after specific infrastructure changes. Broker deployments handle access, while admission controllers focus on Kubernetes deployment blocking.

Correct answer: B. Internal network exposure analysis.

Internal network exposure analysis requires the Advanced license because it calculates complex internal connectivity. Essential licenses include external exposure analysis, software bill of materials generation, and basic secrets scanning functionality.

Correct answer: B. GET /v2/_catalog

The standard Docker Registry API requires a successful GET request to the endpoint to retrieve a list of repositories. This allows Wiz to properly enumerate container images before pulling tags or manifests for vulnerability scanning.

Correct answer: C. The user's Wiz Administrator (to update their Role Based Access Control).

Portal permissions are governed by Wiz's Role Based Access Control. The user must contact their Wiz Administrator to adjust their assigned role or access scope within the tenant. The cloud provider admin manages cloud infrastructure, not portal access.

Correct answer: C. 'Trusted Service' must be enabled for CloudFormation StackSets in AWS Organization settings.

Enabling CloudFormation StackSets as a trusted service in AWS Organizations is required to automatically provision the necessary roles across multiple accounts. The root user should never be used for standard deployments.

Correct answer: D. Ignore Rules.

Ignore Rules explicitly suppress alerts when a finding and resource combination is deemed an acceptable risk or false positive. Custom Controls create new detections rather than tuning out existing noise for specific scenarios.

Correct answer: B. The user's role does not have the necessary permissions to view the requested data or perform the action.

An RBAC error means the user lacks the necessary permissions for their requested action or data view. Multi-factor authentication failures prevent portal login entirely rather than generating specific access errors.

Correct answer: B. Cloud Certificates (SSL/TLS certificates)

SSL or TLS certificates secure web communications and are managed via dedicated cloud services like AWS Certificate Manager. For the exam, remember that keys and certificates are treated as secrets, but standard KMS keys and SSH keys serve different encryption or access functions.

Correct answer: A. Remediation within 48 hours.

Wiz policy mandates remediating critical vulnerabilities on publicly exposed development and production systems within forty-eight hours. Shorter timeframes apply to internet-facing assets, whereas internal or low-severity findings typically allow longer remediation windows like fourteen days.

Correct answer: C. Enrich

The Enrich behavior allows Wiz to ingest external findings to add context to the Security Graph. Watch out for Consume, which can seem correct for ingesting data, but Enrich is the specific terminology for adding third-party security context.

Correct answer: C. roles/iam.serviceAccountAdmin, roles/iam.organizationRoleAdmin, and roles/iam.securityAdmin.

Connecting Wiz to a GCP organization requires specific administrative roles including service account admin, organization role admin, and security admin. Remember that standard project level roles are insufficient for organization wide access deployment.

Correct answer: C. The API Explorer.

The API Explorer is the in-app tool used to write, validate, and test GraphQL queries, which are essential for navigating the Security Graph. The Inventory page provides graphical filtering rather than direct programmatic querying.

Correct answer: D. Apache Struts

Among the provided options, Apache Struts features explicit support for end-of-life detection within Wiz's workload scanning capabilities. Standard SaaS platforms like Asana typically lack local workload EOL scanning, while frameworks might only trigger general package vulnerability alerts.

Correct answer: C. User Icon > Developer and using the keyboard shortcut Ctrl +

Developer tools are accessible via the User Icon menu and the Ctrl keyboard shortcut. Settings and Connect to Wiz pages handle infrastructure connectors and licensing, not direct API exploration or interactive GraphQL queries.

Correct answer: C. Secrets

The Secrets risk domain handles scanning repository branches and commits to uncover exposed credentials. External Exposure focuses on internet-facing attack surfaces, while Cloud Entitlements analyzes permissions.

Correct answer: B. Findings represent atomic, low-context risks; Issues represent high-context, toxic combinations/attack paths.

Findings represent low-context, atomic risks, whereas Issues aggregate those risks into highly contextual attack paths. Remembering that Issues highlight toxic combinations is a crucial conceptual distinction.

Correct answer: B. Connecting via the Organization level using CloudFormation or Terraform.

Connecting at the Organization level using CloudFormation or Terraform ensures both existing and future AWS accounts are automatically discovered. Avoid connecting individual accounts manually, as this creates administrative overhead and leaves new accounts vulnerable to visibility gaps.

Correct answer: A. Wiz temporarily processes sensitive data during SaaS scanning but avoids storing intact copies in its backend.

Wiz adheres to a strict metadata-only design principle for its backend storage. While sensitive data might be temporarily processed during scans, it is never stored intact, and sensitive values like discovered secrets are redacted before anything is saved.

Correct answer: C. Write (W) permission on service accounts.

Creating a new Service Account requires Write permissions specifically on service accounts. Remember that read access only allows viewing existing configurations, while global roles are typically too broad and lack the specific write access needed for account creation.

Correct answer: B. On your existing Wiz tenant.

The remote Model Context Protocol server runs directly on your existing Wiz tenant. Do not confuse the remote server with older or local implementations, which require separate infrastructure and are no longer actively maintained.

Correct answer: A. Created, Resolved, or Due.

Posture Issues can reliably trigger Automation Rules when they are created, resolved, or approaching their due date. Options like ignored or archived statuses represent terminal states that do not actively initiate new automated workflows.

Correct answer: C. Custom data classifiers

Custom data classifiers allow customers to detect unique business-specific information beyond standard categories like PII. For the exam, associate custom classifiers strictly with proprietary data detection, whereas built-in rules cover standard regulatory information.

Correct answer: B. It flags the action so that only privileged users are permitted to execute it.

Marking a response action as disruptive restricts its execution to privileged users only. This provides a necessary guardrail against accidental outages, ensuring standard operators cannot accidentally trigger destructive auto-remediation workflows on critical resources.

Correct answer: C. Building the network architecture, calculating effective ingress (analysis), and dynamic scanner validation.

Calculating effective network exposure involves mapping the architecture, calculating potential ingress paths, and validating them dynamically. Remember that Wiz relies on static graph analysis combined with active scanner validation, rather than runtime monitoring or policy enforcement.

Correct answer: D. GraphQL

The Wiz API uses GraphQL, which provides greater flexibility than older REST endpoints, enabling users to request only the specific data needed in a single call. Expect to see GraphQL as the correct choice whenever questions emphasize API efficiency and defining precise data payloads.

Correct answer: B. Wiz Outpost deployment.

Due to regulatory and connectivity constraints in sovereign environments like AWS GovCloud, the Wiz Outpost deployment architecture is required for workload scanning. A standard SaaS deployment cannot reach these isolated environments, making the Outpost the mandatory architecture.

Correct answer: B. An API connection to the vCenter server that orchestrates the ESXi hosts.

The VMware vSphere Connector requires an API connection established with the vCenter server, which manages and orchestrates the ESXi hosts. Connecting directly to individual ESXi hosts is incorrect because vCenter provides the centralized management plane required for environment-wide scanning.

Correct answer: C. The Malware Analyzer using proprietary YARA rules

The Wiz malware analyzer uses a proprietary engine and YARA rules maintained by the Wiz research team to identify pattern-based generative malware commonly found in cloud environments. Rule out vulnerability management, as that focuses on known software flaws rather than identifying novel malicious code.

Correct answer: C. By assigning the Marketing department's resources to a dedicated Wiz Project, and then scoping the user's Role Based Access Control (RBAC) permissions to that Project.

Projects allow you to subdivide resources by department, and scoping RBAC permissions to that project restricts visibility. Ignore rules are for filtering alert noise, while configuration rules evaluate compliance rather than access.

Correct answer: C. National Vulnerability Database (NVD)

The National Vulnerability Database is one of the public sources Wiz uses to ingest vulnerability data alongside cloud service provider feeds. Watch for valid vulnerability databases versus unrelated enumeration frameworks.

Correct answer: D. Storage Blob Data Reader

The Storage Blob Data Reader role provides the explicit read access needed for the Wiz application to scan blob contents. The standard Reader role only grants management plane access and cannot see the actual data.

Correct answer: C. https://app.wiz.us

The FedRAMP authorized Wiz for Gov environment specifically uses the app dot wiz dot us base URL. Remember that standard commercial tenants simply use the app dot wiz dot io domain.

Correct answer: B. Profile Icon > Developer > API Explorer

The API Explorer is located under the Profile Icon and Developer menu, allowing you to test queries safely. Remember that integrations are configured in system settings, not the developer workspace.

Correct answer: A. SOAR systems (like Cortex XSOAR/QRadar) or SIEMs (like Azure Sentinel/Splunk apps).

Wiz exports vulnerability data to security operations systems like SOARs and SIEMs to aid in incident response. Ticketing systems like Jira receive broader issue tracking data rather than just raw vulnerability feeds.

Correct answer: B. Discovering complex risk correlations by traversing connected components.

The graph database model allows the Security Graph to efficiently discover complex risk correlations and attack paths by traversing connected components. SQL queries are incorrect because the underlying structure is a graph, not a relational database.

Correct answer: B. Common Vulnerability Scoring System (CVSS) and ingestion from sources like NVD and CSPs.

Wiz uses the Common Vulnerability Scoring System alongside external ingestion sources like NVD to assign vulnerability severities. CIS Benchmarks are a distractor because they evaluate cloud configurations rather than software vulnerabilities.

Correct answer: A. The Technology Inventory

The Technology Inventory is the designated portal feature for identifying hosted technologies and cloud services in the environment. The Threat Center fails as a distractor because it displays active security alerts rather than mapping the software landscape.

Correct answer: C. Wiz Projects

Projects establish logical boundaries that assign clear risk ownership to specific teams or business units. For gamification to work effectively, accountability must map exactly to these projects, rather than to broad policies or raw graph data.

Correct answer: B. Via workload scanning, which extracts information from disk snapshots/clones.

Host Configuration Rules are evaluated using data extracted during agentless workload scanning. Because these rules analyze the operating system state, Wiz relies on disk snapshots rather than standard API metadata, which only provides a surface-level resource overview.

Correct answer: B. Wiz is granted read-only permissions (Wiz Access Role) to fetch cloud metadata.

The standard SaaS connector deploys a read-only role to safely fetch cloud metadata. Wiz avoids requiring administrator or write permissions for environmental scanning to strictly adhere to least privilege principles, using external identifiers solely for role assumption.

Correct answer: B. API keys, passwords, encryption keys, tokens, and credentials.

Secrets include digital authentication mechanisms like API keys, passwords, and tokens used to secure access. Public configurations and audit logs are not secrets because they do not inherently provide privileged system access like compromised credentials would.

Correct answer: B. To analyze permissions granted and used to discover lateral movement paths and highlight high-privileged roles.

The Identity Analyzer evaluates effective permissions to uncover lateral movement paths and over-privileged identities. It goes beyond basic network mapping by highlighting risky permission combinations, whereas scanning for keys relies on workload analysis.

Correct answer: B. To prevent the creation of new Wiz Issues for specific types of findings or resources in particular use cases.

Ignore rules prevent the creation of issues for specific findings or resources in approved scenarios. This allows teams to reduce noise without disabling scanning entirely, which is critical for maintaining operational focus and accurate reporting metrics.

Correct answer: B. Wiz uses agentless scanning via API connectors to interrogate cloud APIs and perform out-of-band analysis on workloads.

Wiz performs agentless scanning by querying cloud APIs and analyzing disk snapshots out-of-band. This approach avoids the performance overhead and management complexity of persistent agents while providing deep visibility into vulnerabilities and configurations.

Correct answer: C. Boards (Dashboards).

Boards provide customizable dashboards that summarize security metrics and compliance health for executives. While the inventory page details raw resource data, boards aggregate this information into role-specific, high-level visuals needed for strategic decision-making.

Correct answer: C. Automated Platform Actions

Automated Platform Actions execute internal workflows like updating issue statuses without external integrations. This keeps lifecycle management self-contained within Wiz, unlike integration-specific actions which are strictly built to interface with third-party tools.

Correct answer: C. Custom Graph Control or Cloud Configuration Rule.

Custom Cloud Configuration Rules or Graph Controls must be created first to detect the unique tagging violation and generate an Issue. Remember that response actions rely on these generated issues, as threat detection rules focus on runtime events rather than configuration states.

Correct answer: C. Tenant Info > General page

The Tenant ID used for the external ID is found under the Tenant Info General page in your settings. While deployment connectors list your cloud accounts, the actual tenant identifier needed for your IAM trust policy is located in the general settings.

Correct answer: B. Policies > Graph Controls.

The management interface for reviewing or creating controls is located under Policies, Graph Controls. For the exam, remember that Wiz separates policy creation from general inventory views, making Policies the central hub for configuring and tuning graph-based security rules.

Correct answer: B. Cloud Identity and Entitlement Management (CIEM) using effective permissions analysis.

Wiz performs effective permissions analysis on IAM policies to understand the actual actions that principals can perform, which is central to Cloud Entitlements Management. Avoid confusing this with configuration auditing, as CIEM specifically focuses on identity and access.

Correct answer: A. Grouping resources based on organizational units, purpose (e.g., prod/test), or business units.

Wiz Projects are used to logically subdivide the cloud estate to group resources by organizational units, purpose, or business unit for focused management and access control. They are not used for network segmentation, but rather for creating isolated logical boundaries within the Wiz tenant.

Correct answer: C. Wiz Access Role

The Wiz Access Role is the read-only role assumed by the Wiz backend to fetch cloud metadata, and its Trust Policy defines the required security credentials allowing Wiz to assume it. Distinguish this from the scanner role, which is specifically used during agentless workload disk scanning.

Correct answer: B. Configure scope limitations or update matchers within the TDR configuration.

Policy fine-tuning is accomplished by editing the TDR definition, where you can configure the project scope, adjust the matcher conditions, or modify the severity to ensure it targets only genuinely malicious events. Raising the severity alone will not reduce the volume of generated alerts.

Correct answer: B. Developer

The Developer role provides the exact minimum permissions needed for local CLI scanning and testing. Global Admin offers excessive standing privilege, violating least privilege principles and making it a distractor for security-conscious deployments.

Correct answer: B. Utilizing agentless scanning via CSP APIs (Cloud Scanner).

Wiz uses agentless scanning via read-only cloud provider APIs to pull configuration metadata into the Security Graph. Runtime sensors and disk cloning are used for deeper OS or vulnerability analysis, not baseline configuration drift detection.

Correct answer: B. Python SDK and Postman collections

Wiz provides a Python SDK and Postman collections to help developers interact programmatically with the API. Look for standard developer integration tools rather than native infrastructure-as-code modules or runtime tools.

Correct answer: C. They are not suitable for offline or air-gapped environments, requiring network connectivity to Wiz.

Kubernetes connectors require continuous outbound internet access to communicate with the Wiz backend, making them unsuitable for air-gapped environments. Use a Wiz Broker if you need to traverse strict internal network boundaries.

Correct answer: B. Connecting the Wiz backend to an on-premises Jira instance for ticket creation.

The Wiz Broker acts as a reverse proxy to bridge the backend with internal resources like an on-premises Jira instance. It handles ticketing integrations rather than runtime threat detection or direct bucket vulnerability scanning.

Correct answer: B. Inventory > Technologies page.

Partially covered services are cataloged on the Inventory Technologies page to show what is detected but not fully analyzed. Settings only displays configured connectors, while the Security Graph maps fully supported resource relationships.

Correct answer: C. Every 5 minutes.

The Admission Controller polls the backend every five minutes to cache and enforce the latest policies locally. Real-time blocking is a distractor, as the controller relies on this polling interval rather than synchronous cloud calls.

Correct answer: B. A Wiz Disk Analyzer – Scanner app and a Wiz Enterprise application.

Azure Outpost requires the Wiz Enterprise application to fetch metadata and a dedicated Disk Analyzer scanner app for snapshots. Runtime sensors handle in-memory threat detection, which is different from disk snapshot analysis.

Correct answer: B. Centralizing Connector management via a single Stack in the Management Account.

Converting to an Organization deployment centralizes management into a single Management Account CloudFormation stack. You still need local roles in child accounts for scanning, so eliminating IAM entirely is a distractor.

Correct answer: B. The Reset password page

Users with local accounts must use the designated reset password page to recover their credentials. Single sign-on portals handle corporate identities, while command-line tools are for infrastructure configuration.

Correct answer: B. The user must be logged in as a Wiz user with Write (W) permission on service accounts.

Service account creation requires Write permissions on service accounts within Wiz. The strongest distractor, Global Admin, fails because Wiz RBAC governs access internally rather than relying on cloud provider roles.

Correct answer: B. The Network Analyzer (Network exposure module).

The Network Analyzer is responsible for analyzing cloud configurations to map connectivity and build the architecture used for risk assessment. The Workload Scanner is a distractor because it inspects workloads for vulnerabilities, not network topology.

Correct answer: C. A unique, high-entropy connector token generated for the customer's Connector.

The Wiz Broker authenticates to the backend using a unique, high-entropy connector token generated for the specific connector. It does not use cluster administrator credentials, ensuring secure, least-privilege communication.

Correct answer: B. CPE (Common Platform Enumeration).

Wiz uses Common Platform Enumeration, or CPE, as the standardized naming convention to identify software components and their versions. CVSS is incorrect because it scores vulnerability severity rather than naming the software itself.

Correct answer: B. In a dedicated S3 bucket, within a folder named wiz/response_functions.

Custom Python response functions must be stored in a dedicated S3 bucket inside the specific folder path wiz/response_functions. Storing them in the root directory is incorrect and prevents the Wiz platform from properly locating the script.

Correct answer: C. It required admin/highly privileged roles in the customer environment.

The legacy auto-remediation feature required highly privileged roles in the customer environment. This conflicted with least privilege principles, prompting the shift to Remediation and Response, which offers secure, granular playbooks and better access controls.

Correct answer: A. roles/iam.serviceAccountAdmin, roles/iam.organizationRoleAdmin, and roles/iam.securityAdmin.

Deploying at the GCP organization level requires specific administrative roles for service accounts, organization roles, and security. Simple viewer roles lack the necessary permissions to establish the required service accounts and ingest security data.

Correct answer: B. Near real-time scanning/CSPM assessment and Cloud events & detections.

Connecting to cloud event logs enables near real-time scanning for configuration changes and powers Cloud Detection and Response. The question asks for two outcomes, but provides single-letter options instead of combinations, creating a mismatch.

Correct answer: B. Wiz shows KB version as hosted technology both on the Windows and the Windows server/estop hosted technologies.

Wiz displays the Windows KB version as hosted technology directly within both Windows and Windows Server listings. Expect to see KB articles translated into numerical build versions during the exam rather than querying Microsoft directly.

Correct answer: D. Rego

Open Policy Agent uses the Rego declarative language to define Wiz Cloud Configuration Rules as code. For the exam, permanently associate Rego with custom configuration rules, while YAML and JSON are simply used for structural data formatting.

Correct answer: D. Compliance Management tools

Compliance Management tools focus on consolidating findings to automate evidence collection and manage regulatory adherence. For the exam, distinguish this category clearly from SOAR and automation, which generally handles broader incident response and ticketing workflows rather than strict audits.

Correct answer: C. It uses cloud provider functionality to create an out-of-band snapshot or disk clone for scanning.

Wiz uses cloud provider functionality to create an out-of-band snapshot or disk clone for scanning. This ensures the analysis occurs entirely on ephemeral copies, separating the heavy scanning processes from the live workload to prevent any operational disruption.

Correct answer: A. A finding is the result of a single policy violation, while an issue is the result of a toxic combination of multiple findings and risks.

A finding represents a single policy violation, while an issue is generated by a toxic combination of multiple findings and risk factors. Remember that issues represent critical attack paths, rather than just raw vulnerability data or simple network exposure.

Correct answer: C. The Security Graph

The Security Graph aggregates configuration details, resource relationships, and findings from various scanners to enable complex risk analysis. It maps these connections to identify toxic combinations, distinguishing it from the Network Analyzer or Configuration Rule Engine.

Correct answer: C. Periodically validating the status of potentially exposed ports and IP addresses.

The dynamic scanner periodically validates the actual operational status of potentially exposed ports and IP addresses identified during initial exposure analysis. Remember that the security graph builds the theoretical exposure model, while the scanner verifies if those paths are actually live.

Correct answer: C. responseFunctionId

The responseFunctionId specifies the exact remediation function that your custom automation stack needs to execute. When integrating Remediation and Response workflows, map this payload field carefully to ensure your serverless function triggers the correct corrective action.

Correct answer: B. To assess host configurations against official hardening benchmarks for OS and applications.

Host Configuration Rules assess host configurations by validating operating systems and applications against official hardening benchmarks. Do not confuse these with cloud configuration rules, which focus entirely on cloud control plane settings rather than internal workload hardening.

Correct answer: B. Agentless scanning via snapshot/disk clone.

Agentless scanning via disk snapshots allows deep analysis without impacting live workload performance. By analyzing an offline copy of the disk, Wiz extracts vulnerabilities and misconfigurations safely. The Runtime Sensor is used for live protection, not agentless scanning.

Correct answer: B. Utilizing the vSphere API via the Wiz Broker to list installed VIBs and their versions.

Wiz retrieves installation bundle information by utilizing the vSphere API. Because vSphere environments are frequently internal, the Wiz Broker is deployed to facilitate secure communication between the Wiz backend and your private vCenter API.

Correct answer: C. Container Registry Connector

The Container Registry Connector relies on the Wiz Broker to fetch images if the registry is private or lacks internet access. The Broker acts as a secure bridge, allowing the Wiz backend to communicate with isolated internal registry APIs.

Correct answer: C. Using Automation Rules with integrations like Slack or Jira.

Automation Rules link Issue state changes to integrated actions, enabling automated communication to external platforms like Slack or Jira. Manual actions require human intervention, which defeats the requirement for automated messaging.

Correct answer: D. 180 days.

Resolved Wiz Issues are retained for 180 days after resolution by default. Memorize the standard data retention timelines for Wiz Issues, as these lifecycles frequently appear on the certification exam.

Correct answer: B. The Network Analyzer, which calculates the effective exposure based on cloud service provider (CSP) network information.

The Network Analyzer builds a model of the network architecture and calculates the effective exposure of public-facing resources using information gathered directly from the cloud service provider. The Dynamic Scanner verifies exposure paths but does not model them initially.

Correct answer: C. Metadata, such as resource identifiers and security findings (redacted where necessary).

The Wiz backend is designed only to store metadata and security findings, with sensitive data redacted to avoid storing intact copies. Wiz does not permanently retain full copies of customer data from VM disks or databases.

Correct answer: B. By identifying the latest installed kernel version via the OS package manager and checking the vendor's update stream.

Wiz uses the OS package manager to identify the installed kernel version and checks the vendor's update stream for associated vulnerabilities. Avoid options suggesting runtime sensors or API queries, as agentless scanning leverages existing package data and external threat intelligence.

Correct answer: B. It has a very small resource footprint, usually not requiring more than 100 milliCPU and 128MiB of memory.

The Wiz Broker is designed to be lightweight, requiring minimal resources like one hundred milliCPU and one hundred twenty-eight mebibytes of memory. Avoid options claiming it requires heavy compute or full administrative privileges, since its primary role is secure tunneling.

Correct answer: C. Information taken directly from the cloud service provider (CSP).

The Network Analyzer calculates effective exposure using configuration information retrieved directly from cloud service provider APIs. It does not rely on synthetic traffic generation or audit logs, making CSP integration essential for accurate network modeling.

Correct answer: B. Policy Rules (like CCRs and HCRs)

Policy Rules, such as Cloud Configuration Rules and Host Configuration Rules, generate the foundational findings on the Security Graph. Remember that automation rules act on existing issues, while configuration rules actually discover the raw ingredients.

Correct answer: A. Settings > Ask AI page (Remote MCP Server must be enabled)

The remote Model Context Protocol Server must be enabled on the Settings, Ask AI page. While the graph search bar handles typed queries, the artificial intelligence assistant integration requires activating the remote server specifically in settings.

Correct answer: C. Known and unknown threats and malicious behaviors in real-time runtime.

The Runtime Sensor is specifically designed to detect known and unknown threats and malicious behaviors in real time. In contrast, the agentless scanner focuses on static analysis, like finding disk vulnerabilities or exposed secrets.

Correct answer: A. Resource Tag rules.

Resource Tag rules allow you to dynamically apply tags to resources based on Security Graph query results. Cloud Configuration Rules evaluate baselines, but Resource Tag rules specifically handle this dynamic graph-based tagging workflow.

Correct answer: C. Full-stack Visibility

The Full-stack Visibility phase focuses on comprehensive coverage, normalization, and context mapping. Preventive and Proactive security phases come later in the framework, focusing on shifting left and reducing risk.

Correct answer: C. Wiz Outpost deployment

Wiz Outpost performs all workload scanning directly within the customer environment, ensuring Wiz never accesses VM volumes. The default SaaS deployment relies on snapshot sharing, which violates strict data isolation regulations.

Correct answer: A. Python

Custom response functions for Remediation and Response across all supported clouds must be written in Python. Rego is used for policy rules, and Terraform handles infrastructure provisioning, but neither builds custom automated responses.

Correct answer: B. It enables the Wiz backend to perform continuous monitoring of the broker's health and activity.

The persistent connection enables the Wiz backend to perform continuous monitoring of the broker's health and activity directly from the portal. This improves reliability over older polling models, though it is important to remember that outbound internet connectivity is still required.

Correct answer: B. Authentication using a dedicated Wiz service account.

A dedicated Wiz service account is the recommended method for automating tasks in production environments, including CI/CD pipelines. Service accounts provide secure, non-interactive authentication, whereas API tokens generated via the GUI are typically tied to individual users and expire.

Correct answer: B. API keys, passwords, encryption keys, tokens, and credentials.

Cloud secrets are technical credentials enabling system access, such as API keys, passwords, and tokens. Remember that secrets management in Wiz focuses strictly on authentication artifacts, not broader sensitive business data like financial records or employee information.

Correct answer: B. The Customer must manage service accounts and keep Wiz credentials confidential.

The customer is explicitly responsible for managing accounts within their Wiz tenant and keeping associated credentials confidential. While Wiz handles platform security, securing your service account keys ensures safe non-human access to the environment.

Correct answer: B. To trigger changes to Issues and Threats on Wiz itself (e.g., closing an Issue or changing its severity).

Platform Actions are used to trigger changes to objects directly within the Wiz portal, such as modifying issue severity or status. Do not confuse these with cloud actions, which interact with your actual cloud provider to quarantine resources.

Correct answer: B. The Settings > Audit Log page.

Remote Wiz MCP Server activity is specifically logged on the Settings > Audit Log page. For the exam, remember that user interactions with AI assistants via MCP are treated as auditable platform events, which differ from runtime cloud events.

Correct answer: B. Uploading the hash for the file or set of files as a custom file detection.

Custom file detections allow users to upload hashes for specific files, allowing Wiz to monitor their presence based on defined policy tuning needs. Modifying Rego code is used for configuration assessments, not for identifying specific intellectual property files.

Correct answer: C. AWS Lambda function.

In AWS Remediation and Response, a serverless parser function running on Lambda receives the event payload and converts the Issue data into details needed by the remediation playbooks. SQS and SNS handle message routing rather than parsing the JSON payload.

Correct answer: B. Wiz must calculate the effective exposure of all detected resources.

Wiz calculates effective exposure and permissions before initiating the data scanner process, as context on exposure and access is necessary to properly assess risk. Threat detection rules trigger alerts, whereas exposure determines if data scanning is warranted.

Correct answer: B. Correlating the vulnerabilities in Cycode with relevant information from the source code for remediation.

Cycode pulls container image vulnerabilities from Wiz to correlate them with source code information, facilitating root cause analysis and code-level remediation. Wiz does not automatically fix the container vulnerabilities, nor does Cycode enrich the Wiz Security Graph directly.

Correct answer: C. Python

Custom response functions for AWS remediation in Wiz must be written in Python to align with the AWS Lambda execution environment. Rego is used for policy authoring, while other languages are not supported for these specific custom remediation scripts.

Correct answer: B. A common scenario where Wiz lacks direct access due to non-onboarded external components.

Incomplete exposure modeling often occurs when third-party firewalls or network virtual appliances are not properly onboarded into Wiz. Because Wiz relies on visibility, unmanaged external proxies create blind spots rather than indicating an agentless scanning failure.

Correct answer: C. Infrastructure-as-code (IaC)

Infrastructure-as-code enforces automated and traceable changes, establishing a strict change management baseline. On the exam, remember that immutable infrastructure replaces servers instead of modifying them, making it the wrong choice for governing manual code changes.

Correct answer: C. Reversing Labs.

Wiz augments its proprietary malware engine with threat intelligence from Reversing Labs for hash-based detection. Note that Virus Total is a distractor, but Reversing Labs is the specific integrated provider for this workflow.

Correct answer: A. The VMware vCenter API.

Wiz retrieves information on vSphere Installation Bundles on ESXi hosts by utilizing the vCenter API, often facilitated by the Wiz Broker for on-premises connections. The NSX API is a distractor meant for networking rather than host package analysis.

Correct answer: B. Via a container image containing the core packages and built-in functions.

The Remediation and Response components for GCP are bundled within a single container image containing the necessary Python packages and built-in functions. Eliminate options mentioning Cloud Storage buckets or pre-installed service accounts.

Correct answer: C. The CCR must be explicitly set to function as a Control to generate an Issue.

Remediation actions rely on Issues as triggers, so a rule must be configured to function as a Control to generate an Issue when violated. Rules merely generate Findings unless promoted to Controls.

Correct answer: C. Wiz Admission Controller (Wiz AC).

The Wiz Admission Controller is deployed in Kubernetes clusters to enforce policies defined using rules, auditing or blocking resource creation that violates policy. The Wiz Broker is only for access brokering, not Kubernetes deployment enforcement.

Correct answer: B. Findings generated by policies are aggregated by controls to identify a toxic combination (Issue).

Policies generate individual Findings, which Controls then consume to identify toxic combinations that result in creating an Issue. A practical exam cue is remembering that Policies create Findings, and Controls create Issues.

Correct answer: B. To perform the VM scan (creation and scanning of snapshots).

The Scanner application is dedicated to performing the agentless workload scan function, creating and analyzing snapshots of virtual machines on behalf of the Outpost. It does not handle metadata fetching or event payload parsing.

Correct answer: C. On the Wiz security graph.

Findings, including vulnerabilities, are modeled and placed directly on the Wiz security graph, where they are correlated with other risks to form Issues. Avoid choosing dedicated dashboards, as they merely visualize data rather than store it.

Correct answer: B. Settings > Automations > Create Rule

Automation Rules linking triggers to actions are created under Settings, Automations, and Create Rule. Remember that you cannot add actions directly inside the Cloud Configuration Rules interface, making the Policies option a trap.

Correct answer: C. Wiz Orchestrator Node Pool Role (with Data Policy)

The Wiz Orchestrator Node Pool Role, when configured with the Data Policy, grants the EKS nodes permissions to execute DSPM database scans. The standard Wiz Access Role is for the main SaaS connector, not Outpost data scanning.

Correct answer: C. Wiz Orchestrator Node Pool Role.

The Wiz Orchestrator Node Pool Role is assumed by the EKS worker nodes to execute low-level snapshot scanning tasks. The Wiz Access Role is used by the SaaS platform for general read-only API access, not snapshot operations.

Correct answer: B. Python 3.11.

Custom response functions for Azure remediation must support Python version three point eleven. This specific version is supplied directly within the Wiz container image and is the supported requirement for the Azure Functions environment as of two thousand twenty six.

Correct answer: B. Defining whether the infrastructure will be allowed to run in 'All resources' or a 'Selected projects' list.

Selecting deployment scope acts as a guardrail by restricting remediation infrastructure to explicitly approved projects. You will choose between all resources or selected projects to ensure response actions only execute within properly authorized boundaries.

Correct answer: C. Wiz MCP Server via 'Get account team contacts' tool

The Wiz MCP Server provides a dedicated tool to retrieve details for the account team and tenant contacts configured for escalation. Familiarize yourself with administrative toolsets, as portal contact retrieval is increasingly handled via programmatic interfaces.

Correct answer: B. Inventory > Technology Inventory page

The Technology Inventory page specifically lists the hosted technologies, coding languages, operating systems, and applications detected across workloads by Wiz. For the exam, rely on this page whenever you need to locate specific software or OS environments.

Correct answer: C. The Findings pages (e.g., Vulnerability Findings, Cloud Configuration Findings).

A finding represents a single instance of a risk on a specific resource, and the individual findings pages are used to view these. Distinguish this from the Issues page, which aggregates multiple findings to track broader remediation workflows.

Correct answer: B. Scanning the workload by creating disk snapshots or clones 'out of band'.

The correct answer works because Wiz scans out of band using disk snapshots, keeping the live workload untouched. For the exam, remember that Wiz avoids heavy agents; continuous live monitoring or runtime API polling would defeat the agentless design goal.

Correct answer: D. It highlights which vulnerabilities are involved in a critical attack path leading to sensitive data or lateral movement, helping to prioritize remediation.

The correct answer works because Wiz maps vulnerabilities to attack paths, showing exactly which flaws lead to sensitive data. Avoid options relying solely on CVSS scores; the practical exam cue is that context transforms raw vulnerabilities into prioritized, actionable risk.

Correct answer: B. –multi-tenant

The multi-tenant parameter must be added to the deployment script to allow scanning across different Azure tenants. This is a highly specific command-line flag, so memorizing the exact parameter names for Outpost deployments is crucial for exam success.

Correct answer: C. The API Explorer.

The API Explorer serves as the native tool for writing, validating, and testing GraphQL queries against the Security Graph. While Inventory provides a visual UI, the Explorer is the direct interface for programmatic querying and relationship mapping.

Correct answer: C. External Enrichment Integration.

External Enrichment integrations are specifically designed to ingest findings from third-party tools and layer them onto the Security Graph. A standard Push Integration simply sends Wiz alerts outbound rather than pulling context into the graph.

Correct answer: B. Defining security policies as code over complex hierarchical data structures (CSP JSON objects).

Rego is the declarative policy language used with Open Policy Agent to evaluate complex JSON data structures from cloud providers. It does not execute scripts or perform network analysis, but rather defines the configuration rules as code.

Correct answer: C. By using template variables surrounded by double curly braces (e.g., {{resourceName}}).

Template variables enclosed in double curly braces allow dynamic injection of resource data into the payload sent to external tools. You cannot alter the third-party API schema from within Wiz, so native templating provides the required customization.

Correct answer: C. Wiz Cloud Advanced

Container registry scanning, Threat Detection Rules, and Outpost are exclusive features of the Wiz Cloud Advanced commercial license. Knowing which capabilities belong to the Essential versus Advanced tiers frequently appears on the exam.

Correct answer: C. Toxic Combination (Issue).

A Toxic Combination synthesizes multiple individual findings across different risk categories into a single prioritized issue. A standalone configuration rule violation is just a finding, whereas an issue requires correlating multiple security risks.

Correct answer: B. A sensitive data finding combined with a real-time data exfiltration attempt.

Data Leakage specifically requires pairing a sensitive data finding with evidence of a near real-time exfiltration attempt. Simply pairing sensitive data with external exposure results in a different risk category, such as Unprotected Data, rather than active leakage.

Correct answer: B. TLS 1.2 or greater encryption.

Wiz secures all communications between its backend and the customer cloud environment using TLS 1.2 or higher encryption. No proprietary protocols or dedicated VPN tunnels are required for the standard SaaS scanning architecture.

Correct answer: B. Cloud Cost

The Cloud Cost feature provides cloud spending visibility and optimization recommendations for AWS and Azure. Remember that FinOps capabilities in Wiz are tied directly to this specific module, rather than being driven by resource tags or dynamic scanners.

Correct answer: B. Because it combines with other signals to potentially model toxic combinations.

Public exposure is an inherent risk because Wiz combines it with other security signals to model exploitable attack paths, known as toxic combinations. Intentional exposure does not automatically violate compliance rules, but it acts as a critical multiplier.

Correct answer: B. roles/iam.serviceAccountAdmin, roles/iam.organizationRoleAdmin, roles/iam.securityAdmin

Deploying Wiz at the GCP Organization level requires specific administrative roles for service accounts, organization roles, and security. For the exam, focus on this exact combination of IAM roles rather than general compute or storage privileges.

Correct answer: C. Wiz CLI

The Wiz CLI shifts security left by detecting risks like host misconfigurations and secrets directly within the command line or CI/CD pipeline. Use this as your exam cue for developer integrations, contrasting it with runtime sensors for production environments.

Correct answer: C. A Docker host with the Wiz Broker installed.

A Docker host running the Wiz Broker is required to act as a reverse proxy when the vCenter API is not internet-facing. This broker bridges the gap between your isolated vSphere environment and the Wiz backend for scanning.

Correct answer: B. Infrastructure lacks persistent storage, ensuring metadata is stored only in secured databases.

Immutable infrastructure means components lack persistent storage, ensuring metadata is stored only in secured, external databases. A solid exam takeaway is that this architecture prevents post-deployment modifications, directly supporting Wiz's security and data isolation model.

Correct answer: C. Partially covered cloud services.

The correct answer is partially covered cloud services, as Wiz lists them on the Technologies page as technology usage objects. A strong distractor is fully covered services, which instead receive dedicated resource objects and full risk analysis within the Security Graph.

Correct answer: C. The API Console.

The API Console is correct because it captures exact GraphQL payloads as you click through the portal, which is perfect for building custom scripts. Do not confuse this with the API Explorer, which only helps you manually write and test queries.

Correct answer: B. According to the maximum number of unique matches found.

The correct answer works because Wiz calculates severity based on the maximum number of unique matches across all files on that resource. Ignore options suggesting averages or severity caps; Wiz uses the highest count to reflect the true exposure accurately.

Correct answer: B. The Principal value (Wiz account ID) and the sts:ExternalId value (Tenant ID).

The correct answer works because the trust policy must map the Wiz account ID as the Principal and the Tenant ID as the external ID. Distractors listing policy ARNs fail because those belong in the permissions policy, not the trust relationship section.

Correct answer: B. Wiz Cloud Advanced or Wiz for Gov Advanced.

The correct answer works because integrating identity providers like Okta requires the higher feature thresholds found in Wiz Cloud Advanced. For the exam, associate identity and secrets scanning with advanced licensing rather than basic entry level tiers.

Correct answer: B. Policy Update trigger: Created.

Policy Update triggers are specifically designed to notify users when changes or new policies are introduced by Wiz, allowing customers to review implementation schedules. Cloud Event triggers handle runtime occurrences, not platform policy announcements.

Correct answer: C. In SaaS, Wiz infrastructure performs the workload scan; in Outpost, customer infrastructure performs the scan, and only security metadata results are sent to Wiz.

The primary distinction is the location where workload scanning executes. In the SaaS model, Wiz infrastructure scans the data, whereas the Outpost model executes scans within customer infrastructure, sending only security metadata back to the Wiz SaaS backend.

Correct answer: B. Cloud platform access keys or SSH keys

Wiz detects hardcoded credentials like cloud platform access keys and SSH keys left exposed on system volumes. Customer-managed encryption keys are managed cloud services, while multi-factor authentication tokens are temporary runtime sessions.

Correct answer: C. Open Policy Agent (OPA) and Rego.

Wiz uses the Open Policy Agent framework to evaluate cloud configuration checks against raw resource data. The rules are written in the Rego declarative language. Terraform and HCL are infrastructure provisioning tools, not policy engines.

Correct answer: D. Wiz Broker

The Wiz Broker acts as a lightweight reverse proxy creating a secure tunnel to isolated resources. It allows the Wiz backend to communicate securely with internal instances like Jira without requiring inbound internet access.

Correct answer: B. Policy Update trigger.

The Policy Update trigger allows you to notify external systems when Wiz announces new or updated policies. Cloud Event triggers handle cloud provider logs, while Audit Log triggers monitor user actions within the Wiz platform itself.

Correct answer: C. The Windows Knowledge Base (KB) updates.

For Windows environments, Wiz scans the installed Windows Knowledge Base updates to identify missing security patches and vulnerabilities. For the exam, remember that Wiz maps detected vulnerabilities to specific KB updates rather than analyzing the host firewall or kernel.

Correct answer: C. Correlation Rules.

Correlation rules are used for detecting complex sequences of events that indicate a broader threat pattern, as opposed to cloud event rules, which monitor single events. Use this distinction to easily separate sequence-based detections from isolated alerts.

Correct answer: B. Overprivileging (Excessive Access)

The identity analyzer focuses heavily on identifying overprivileging or excessive access, where identities possess permissions that are unused or exceed least privilege. The exam cue here is equating unused identity rights directly with excessive access.

Correct answer: C. Explicit and Effective IAM policies.

Wiz analyzes both explicit and effective IAM policies as part of its effective permissions analysis to identify risks like over-privileging and lateral movement. Explicit policies are assigned directly, while effective policies include inherited group memberships.

Correct answer: C. Python (supporting version 3.12 in Lambda).

Custom response functions for AWS Remediation and Response are written in Python, designed to run within the AWS Lambda environment. For the exam, associate remediation automation directly with Python, while remembering that Rego is used strictly for defining Wiz configuration rules.

Correct answer: B. It scans files using proprietary YAR rules which may detect patterns not malicious in public databases.

Wiz uses proprietary YARA rules to scan for cloud-specific malware behaviors, catching threats not yet in public hash databases. A helpful exam tip is to differentiate static scanning from runtime analysis, as the malware analyzer does not strictly require the runtime sensor.

Correct answer: B. Wiz CLI and Wiz Admission Controller deployments.

The correct answer is Wiz CLI and Admission Controller deployments, as these are enablement tools excluded from billable unit counts. Remember that compute workloads, container images, and Wiz OS instances are the actual licensed entities you must track.

Correct answer: C. Managing the EKS cluster, assumed by the Wiz Orchestrator Role.

The Orchestrator EKS Role specifically manages the EKS cluster that hosts Outpost scanner components and is assumed by the primary Orchestrator Role. Remember that the EKS role handles orchestration infrastructure, while a separate read-only connector role fetches the actual IAM policies.

Correct answer: B. Use device code flow tied to their Wiz user account, requiring a Wiz Code license add-on.

Local directory scans use device code flow tied to the user's identity, which requires the Wiz Code license add-on. Service accounts or pipeline tokens are meant for automated automation, whereas interactive developer workflows rely on interactive authentication.

Correct answer: C. Threat Center

The Threat Center is the dedicated hub for tracking emerging global threats and analyzing their impact on your resources. While configuration findings show misconfigurations, Threat Center specifically contextualizes active risks and zero-day advisories.

Correct answer: D. Metadata related to VM properties, networking rules (like Security Groups), and resource tags.

The Cloud Scanner uses API calls to gather control-plane metadata, such as VM properties, tags, and networking rules. Deep inspection tasks, like finding OS packages or exposed keys, are handled by the agentless workload scanner looking at disk volumes.

Correct answer: B. Severities are assigned based on the Common Vulnerability Scoring System (CVSS) and data ingested from dozens of public sources, including NVD and cloud service providers (CSPs).

Wiz determines vulnerability severity primarily using industry-standard CVSS scores, enriching the data with threat intelligence from public databases like NVD. Wiz does not rely on arbitrary proprietary scales, ensuring alignment with standard CVE assessments.

Correct answer: B. The Wiz Runtime Sensor.

The Wiz Runtime Sensor provides live behavioral telemetry for real-time threat detection inside active workloads like Kubernetes clusters. The agentless workload scanner only provides a static point-in-time snapshot of vulnerabilities on disk.

Correct answer: C. Cataloging hosted software, operating systems, and partially covered cloud services found across workloads.

The Technology Inventory catalogs software, operating systems, and partially covered services found across workloads. It focuses strictly on application stacks, distinguishing it from the resource graph which tracks cloud infrastructure objects like buckets.

Correct answer: C. By organizational unit (e.g., Dev team 1), purpose (e.g., production), or business unit.

Projects segment cloud estates by organizational structures like business units, teams, or environments to enforce accountability. They are not limited to a single cloud provider or resource type, enabling flexible ownership tracking across diverse assets.

Correct answer: B. Configured network security rules

The exposure path is calculated using configured network security rules like security groups and network ACLs. This simulates allowed traffic flow across mapped resources, ignoring real-time telemetry which is not part of this graph calculation.

Correct answer: B. The user must navigate to the 'Forgot Password' link on the login page, initiating an email reset process that expires in 1 day.

Local user password recovery is done through an automated email reset link initiated by the user, which is valid for only one day. If a user logs in via an identity provider, password resets must happen there, not in Wiz.

Correct answer: B. Redacted snippets of code and masked data samples.

Wiz stores only minimal, heavily redacted metadata, such as masked data samples or code snippets necessary for remediation. Full disk images and complete files are intentionally excluded to maintain strict privacy and security boundaries.

Correct answer: D. A single broker instance cannot serve multiple different Connectors or third-party integrations.

A design constraint is that a single Wiz Broker instance is dedicated per connector or third-party integration. It cannot multiplex connections for several different services. Brokers are deployed within the customer environment using various methods.

Correct answer: B. AWS SQS queue

Remediation and response deployments often utilize an SQS queue to receive event payloads, which are then processed by a serverless function like Lambda. Remember that SNS is a push pub sub service, while SQS holds the message buffer.

Correct answer: C. WizCloudCostPolicy.

The optional WizCloudCostPolicy is attached to the Wiz IAM role to fetch cost data for cloud cost visibility. The other options handle runtime protection or EKS scanning, but they do not provide the specific permissions required for cost retrieval.

Correct answer: D. Creating an Automation Rule.

Automation Rules link triggers like issue creation to actions such as sending tickets to Jira. Action templates only define the payload, but the automation rule itself is required to execute the workflow automatically.

Correct answer: B. Monitored Metrics

Monitored metrics track custom framework performance over time to assess compliance and gamification success. The security graph maps relationships, but it does not provide the longitudinal reporting needed for scorecards.

Correct answer: B. Virtual machine disk files, public and private buckets, and PaaS/IaaS databases.

The default scanning scope targets cloud infrastructure including virtual machine disks, buckets, and platform databases. It does not scan external SaaS applications or on-premises file servers, which require separate connectors.

Correct answer: B. The Issue is due, will be due in X days, or is overdue by X days (Due trigger).

The due trigger fires an automation rule when an issue is due, upcoming, or overdue, allowing teams to manage risk timelines. Severity and status changes are valid triggers, but they do not evaluate mitigation timeliness.

Correct answer: C. Every 5 minutes.

Version 2.5.9 and later fetch admission policies from the backend every five minutes to maintain enforcement. This polling interval replaced older static deployment models to ensure Kubernetes clusters receive prompt updates.

Correct answer: C. Wiz Terraform Provider

The Wiz Terraform Provider is the recommended tool for bulk user creation and management. While the CLI handles local scans and data sources query existing infrastructure, only the provider actively manages user configurations.

Correct answer: C. They are ingested as Cloud Events and viewable on the Cloud Events Explorer page.

Wiz imports Admission Reviews as Cloud Events, allowing users to analyze them using the dedicated Cloud Events Explorer. Do not confuse these with standard configuration issues; they are processed as runtime events to trigger detections and automations.

Correct answer: C. Wiz Broker

The Wiz Broker functions as a reverse proxy, tunneling communication between the Wiz backend and resources located in private or on-premises networks. A practical cue is to associate the Broker with bridging isolated networks to the SaaS platform.

Correct answer: B. The vulnerability is removed from the Wiz portal 7 days after it is resolved.

Vulnerability findings are retained in the portal for seven days after resolution before automatic removal. This retention window ensures security teams have sufficient time to verify remediation and audit historical issue data.

Correct answer: B. Wiz stores only security metadata and findings, avoiding storage of customer data, files, or intact secrets.

Wiz stores only security metadata and findings, ensuring that copies of customer data, files, or intact secrets are not kept in the backend. This privacy-by-design approach means Wiz never stores actual disk images or databases.

Correct answer: D. The Graph database (Security Graph).

The Security Graph is central to storing all resource data and relationships, allowing analytical modules to enrich entities and identify attack paths. Other analyzers feed data into the graph, but the graph itself maps the correlations.

Correct answer: C. Provisioning the EKS cluster and all other required resources within the dedicated Outpost account.

The Wiz Orchestrator Role provisions and manages the dedicated infrastructure, including the EKS cluster, within the Outpost account. For the exam, remember that Outpost relies on this role for initial resource creation rather than read-only metadata fetching or direct runtime threat detection.

Correct answer: C. Vulnerability Management & Response tools integration.

Integrations with Vulnerability Management and Response tools pull Wiz findings to help prioritize risks by adding attack path context. Do not confuse this with data lineage, which tracks data flows rather than infrastructure vulnerabilities and their exploitation paths.

Correct answer: B. It avoids impacting the performance or operation of the live workload during scanning.

Wiz avoids impacting live workload performance by scanning out-of-band disk snapshots. The strongest distractor suggests forensic capabilities, but remember that the primary benefit of agentless scanning is operational safety rather than deep disk forensics.

Correct answer: B. Only the collected security metadata, such as findings, installed packages, vulnerabilities, and secrets hashes/snippets.

A strict data barrier ensures only security metadata, such as vulnerability findings and package lists, returns to the Wiz backend. It is crucial to remember that full disk snapshots and raw runtime logs never leave the local environment.

Correct answer: C. When there is a known and accepted risk that currently lacks an available fix.

Ignoring a finding is appropriate when there is a known and accepted risk that currently lacks an available fix. Remember that severity levels or age do not justify ignoring issues unless the risk has been explicitly accepted as a temporary exception.

Correct answer: C. A cloud configuration finding is generated and associated with the resource on the security graph.

Failing a Cloud Configuration Rule generates a configuration finding attached to that specific resource within the security graph. This foundational concept is critical because findings feed into controls, which subsequently generate prioritized issues.

Correct answer: C. Policies generate Findings, which are processed by Controls to identify toxic combinations that manifest as Issues.

Policies generate individual findings, which controls then analyze to identify dangerous combinations known as issues. Memorize this exact flow, as understanding how the security graph correlates discrete risks into issues is essential.

Correct answer: D. Wiz Runtime Sensor.

The Wiz Runtime Sensor is an eBPF-powered executable that delivers real-time visibility into cloud workloads. Use this specific detail to separate it from the admission controller, which handles Kubernetes deployment policies.

Correct answer: C. Agentless scanning of a snapshot or disk created from the running workload.

Wiz performs malware analysis using agentless scanning of a snapshot or disk clone, avoiding any impact on the live workload. For the exam, always associate malware detection with offline snapshot analysis rather than agents or network tapping.

Correct answer: C. A sample of related Findings and a mini-graph showing which objects were deleted or changed.

Issue resolution evidence includes a sample of related findings and a mini-graph detailing which objects were modified or deleted, which is retained for 180 days. Be careful not to confuse this with full attack path JSONs, as Wiz only retains a specific snapshot for compliance tracking.

Correct answer: C. Wiz Admission Controller (Wiz AC).

The Wiz Admission Controller enforces policies defined using Cloud Configuration Rules to audit or block resource creation in Kubernetes clusters. Do not confuse this with the Wiz Broker, which acts as an integration gateway rather than an in-cluster enforcement tool.

Correct answer: B. Explorer > Cloud Cost

Cloud spending visibility and optimization recommendations are found on the Explorer menu under the Cloud Cost page. Avoid choosing Inventory or Policies, as those focus on asset tracking and rule configuration rather than financial data.

Correct answer: B. It eliminates the need to handle configuration, token management, rate limiting, and pagination manually.

The Python SDK streamlines programmatic interaction by abstracting away complex operational overhead like configuration, authentication token management, rate limiting, and pagination. The SDK handles the API plumbing automatically rather than supporting custom policy languages.

Correct answer: B. Template variables.

Template variables are used within the action configuration to define and customize specific data fields included in the outgoing payload to third-party tools. You are simply formatting a payload rather than writing GraphQL queries or complex scripts.

Correct answer: C. wiz_remediation_and_response_deployment_v2

The wiz_remediation_and_response_deployment_v2 resource is used to programmatically manage the customer-side infrastructure components needed for Remediation & Response. For the exam, remember that Wiz uses Terraform providers specifically to automate secure remediation deployments.

Correct answer: B. Overprivileging and lateral movement.

Analyzing effective permissions helps identify and remediate risks associated with overprivileging and potential lateral movement paths. Cloud identity and entitlement management focuses on access control, not malware prevention or denial of service mitigation.

Correct answer: B. Load balancers or internet gateways.

The Network Analyzer models external connection points like load balancers and internet gateways as direct links to the internet. When studying exposure paths, focus on infrastructure routing components rather than identities or vulnerability findings.

Correct answer: B. Automated Platform Actions

Automated Platform Actions allow users to directly modify internal Wiz objects, like Issues and Threats, without external integrations. Remember that manual actions typically involve triggering external webhooks or ticketing systems like Jira.

Correct answer: C. Network Analyzer

The Dynamic Scanner depends on the Network Analyzer to properly calculate exposure paths and validate external attack surfaces. Avoid choosing the broker or CLI, because those components handle data transmission or command-line queries instead.

Correct answer: C. admin:all and create:service_accounts.

Permissions like admin:all and create:service_accounts are highly sensitive due to the severe risk of privilege escalation. For the exam, always categorize broad administrative rights as exceptions to standard custom role assignments.

Correct answer: C. Vulnerabilities in the Linux kernel.

Wiz specifically checks the Linux kernel for vulnerabilities to mitigate risks in critical operating system components. You should easily eliminate the Windows KB option here since the question explicitly targets Linux environments.

Correct answer: B. Settings > Compliance Frameworks

Built-in host configuration assessment frameworks are enabled and managed under Settings, then Compliance Frameworks, so the administrator can benchmark operating systems and applications. For the exam, remember that Inventory is for exploration, while Settings governs frameworks and rules.

Correct answer: C. Configuring firewall and port configurations in the Customer-owned cloud environment.

In the Wiz-managed Outpost model, the customer controls firewall and port configurations within their own cloud environment. Wiz handles securing the backend systems and encrypting data in transit between the Outpost and connectors.

Correct answer: C. The Resource Discovery Scripts documentation pages.

Resource discovery scripts are documentation tools that estimate billable usage metrics before full scanning begins. Remember that accurate counts appear on the Licenses page only after the connector successfully integrates with the environment.

Correct answer: A. YARA Rules written and maintained by the Wiz Research Team.

The proprietary Malware Analyzer uses YARA rules written and maintained by the Wiz Research Team to detect generative malware. While it leverages ReversingLabs for hash-based detection, the YARA engine specifically targets novel or generated threats.

Correct answer: C. Scytale (Compliance Management)

Scytale is a compliance management platform that pulls Wiz issues and resources to generate evidence for compliance controls like SOC 2 and ISO 27001. Do not confuse this with DefectDojo, which focuses strictly on vulnerability management rather than audit evidence.

Correct answer: B. Software Composition Analysis (SCA) functionality

Software Composition Analysis functionality analyzes both direct and transient code library dependencies to detect vulnerabilities in open source libraries. Expect to map dependency analysis and SCA together, distinguishing it from dynamic scanning or network analysis.

Correct answer: B. Settings > System Health

System Health Issues for deployed Wiz components like the Broker or Admission Controller are surfaced under Settings > System Health. For the exam, remember that operational connector health lives in Settings, not in the main Issues queue.

Correct answer: A. Cloud Configuration Rules configured in Wiz, and serverless playbooks deployed in the customer's environment.

Auto-remediation uses a hybrid model where Wiz defines the triggering rule, but serverless playbooks execute within the customer environment. Wiz does not host the remediation logic to maintain customer infrastructure boundaries.

Correct answer: C. An Azure Event Hub to stream activity logs.

Wiz ingests Azure activity logs by configuring an Azure Event Hub that streams events via Kafka. Sentinel and Log Analytics are monitoring tools, but the Event Hub is the specific streaming endpoint required.

Correct answer: C. To group resources by organizational unit, purpose, or business unit for focused management and security workflows.

Wiz Projects group resources by organizational unit or business unit to enable focused management. They establish logical boundaries that scope access control and streamline security workflows.

Correct answer: B. They are redacted to avoid storing intact copies of sensitive data.

Wiz redacts sensitive information within Secret and Data Findings before storing the results. This ensures intact sensitive data is never retained, reinforcing compliance while still alerting on the exposure.

Correct answer: B. Scanning code, IaC, and container/VM images locally or in the CI/CD pipeline.

The Wiz CLI supports shift-left security by scanning code, infrastructure-as-code, and container images early in the pipeline to generate SBOMs. While modeling VCS architecture is useful, it is a Wiz feature rather than a direct command-line interface capability.

Correct answer: B. API keys, passwords, encryption keys, tokens, and credentials.

Secrets include authentication data like API keys, passwords, tokens, and encryption keys. Wiz scans specifically for these hardcoded credentials to prevent unauthorized access, rather than scanning for general customer data like database records.

Correct answer: C. Automation Rules.

Automation Rules trigger actions based on Issue updates to notify teams via integrations like Slack and Jira. Unlike scheduled reports that simply summarize activity, automation creates real-time, targeted alerts for faster remediation.

Correct answer: C. Organization level deployment via AWS CloudFormation StackSets from the Management Account.

Deploying via AWS CloudFormation StackSets from the Management Account is recommended for managing multi-account organizations. This centralized method streamlines onboarding significantly compared to manually deploying individual roles across accounts.

Correct answer: C. GraphQL.

GraphQL provides the flexibility to query only the specific data needed, making it the standard for the Wiz API. For the exam, remember that GraphQL replaces rigid REST calls for dynamic, highly customizable data retrieval.

Correct answer: B. The basic remediation & response infrastructure must already be deployed in the customer's cloud environment.

Remediation and Response operates directly within the customer's cloud environment using their own permissions. You must deploy the foundational infrastructure stack, including the worker role and messaging services, into the target cloud before custom functions can execute.

Correct answer: B. A Finding is a single representation of a vulnerability/misconfiguration on a resource; an Issue represents a prioritized toxic combination of multiple findings/risks.

A Finding is a single security signal on one resource, while an Issue represents a prioritized toxic combination of multiple findings. This distinction is a crucial exam concept because Issues provide the actionable context needed for effective prioritization.

Correct answer: D. Wiz Terraform Provider

The Wiz Terraform Provider is the designated tool for managing Wiz resources, custom policies, and integrations as Infrastructure as Code. While the API allows mutations, the Terraform provider is specifically built for declarative deployment.

Correct answer: B. A Finding is a singular security signal (e.g., a vulnerability or misconfiguration), while an Issue is a 'toxic combination' modeling a critical, exploitable attack path.

A Finding is an individual security signal, whereas an Issue models a toxic combination of those findings into an exploitable attack path. Understanding this relationship is vital, as Issues drive Wiz's core approach to risk prioritization.

Correct answer: C. By using context to prioritize vulnerabilities that are involved in a critical attack path (toxic combinations) leading to sensitive data or lateral movement.

Wiz correlates findings using context to highlight only the vulnerabilities that form a critical attack path or toxic combination. Relying strictly on vendor severity scores without context is a trap, as it perpetuates alert fatigue rather than solving it.

Correct answer: C. The API Explorer

The API Explorer serves as the built-in playground for developers to write, validate, and test GraphQL queries against the live Wiz schema. The Wiz CLI is a separate terminal tool used for scanning rather than interactive query construction.

Correct answer: C. Cloud Connector with additional permissions and setup.

Ingesting Cloud Events for real-time threat detection relies on the Cloud Connector configured with additional permissions. The Broker handles scanning traffic, but event streaming requires expanding the connector's IAM access.

Correct answer: C. Explorer > Data Findings

The Explorer menu hosts the Data Findings page, which is dedicated to filtering DSPM classification results. Settings only configures the scanning rules, while Explorer visualizes the actual discovered sensitive data.

Correct answer: A. Owner or User Access Administrator role on the subscription/management group.

Users need the Owner or User Access Administrator role to connect Wiz at the Azure Subscription or Management Group level. This high privilege is required specifically to assign the necessary roles to the Wiz Enterprise App during setup.

Correct answer: B. Outpost is required for workload scanning, and only metadata results are sent to the Wiz backend.

Using Wiz Outpost in a China cloud requires local workload scanning because only metadata is sent back to the SaaS backend. This architecture maintains compliance with strict data sovereignty laws while still delivering full vulnerability analysis.

Correct answer: C. Highly regulated personally identifiable data, financial data, or health data findings.

Wiz Projects determine ownership for data security findings involving highly regulated information like PII, financial, or health data. Assigning these specific DSPM categories ensures the correct teams are notified for data governance remediation.

Correct answer: C. Settings > Deployments > Integrations.

Pull integrations for enriching the Security Graph are configured within the Wiz portal under Settings, then Deployments, and finally Integrations. Remember that this specific configuration requires write permissions on the deployments page.

Correct answer: C. Security Graph Analysis

The Security Graph is the core engine that correlates and analyzes complex relationships across configurations, vulnerabilities, and entitlements to calculate critical risks. Remember that graph analysis is what enables contextual attack path mapping, distinguishing it from simple compliance reporting.

Correct answer: B. As Cloud Events.

Admission Reviews processed by the Wiz Admission Controller are ingested and managed in the portal as Cloud Events. For the exam, link Kubernetes admission control activities directly to the Cloud Events processing pipeline rather than standard vulnerability findings.

Correct answer: C. Malware Analyzer

The Wiz Malware Analyzer leverages proprietary YARA rules alongside hash-based threat intelligence to detect malicious files. Distinguish this from the Vulnerability or Data Scanners, which look for software bugs or sensitive data, rather than malicious patterns.

Correct answer: A. By modeling the DAST findings on the Security Graph against Application Endpoint objects.

Dynamic black-box testing findings are modeled directly onto Application Endpoint objects within the Wiz Security Graph. This graph-based correlation is a core concept, unlike generating configuration findings or simply tagging results as malware.

Correct answer: B. Read-only permissions.

Wiz DSPM adheres to the principle of least privilege and requires only read-only permissions to sample data and provide continuous visibility. It does not need administrative or write permissions because it simply inventories and classifies the discovered resources.

Correct answer: C. They should be inserted directly without quotation marks.

Template variables that output JSON structures must be inserted directly without any surrounding quotation marks. If you wrap them in quotes, the JSON payload will be treated as a plain string, which will break the integration request body formatting.

Correct answer: C. Workload Scanning in China Clouds.

Due to strict data residency regulations, workload scanning in Chinese cloud environments requires an explicit Wiz Outpost deployment. This ensures that all scanning and data processing happen locally within the customer boundary, separate from the standard connector.

Correct answer: C. It identifies the latest installed kernel version via the OS package manager and checks the vendor's update stream for associated vulnerabilities.

The correct answer works because Wiz checks the OS package manager for the installed kernel version and maps it against the vendor update stream. For the exam, remember that Wiz relies on package manager data for Linux vulnerabilities, not real-time runtime sensors.

Correct answer: B. The dedicated Data Security Dashboard

The dedicated Data Security Dashboard is correct because it specifically summarizes critical toxic combinations involving sensitive data findings. While you could use the Security Graph manually, the dashboard provides the out-of-the-box summarized view needed for quick prioritization.

Correct answer: C. Global roles

Global roles is correct because they possess the tenant-wide scope required to build integrations spanning all projects and to configure their automation rules. Project-scoped roles lack the necessary breadth, making them a common trap if you overlook cross-project requirements.

Correct answer: B. Configuring Single Sign-On (SSO) using SAML identity providers.

Configuring Single Sign-On using SAML is correct because it centralizes identity management and enforces robust access controls for the tenant. While removing expired service accounts is good hygiene, establishing SSO is the primary shared responsibility requirement.

Correct answer: B. Create disk snapshot/clone -> Mount to Wiz-managed cluster in the same region -> Scan statically -> Send only security metadata to Wiz backend -> Delete disk representation.

Creating a disk snapshot to scan statically on a regional cluster is correct because it highlights the agentless out-of-band scanning process. A key exam takeaway is that Wiz only sends extracted security metadata back to its backend, never full disk contents.

Correct answer: B. Client ID, Client Secret, API Endpoint URL, and API Authentication URL.

The Client ID, Client Secret, and endpoint URLs are correct because these credentials authorize external systems to pull data via the API. Remember that Wiz only displays these specific secret values once during creation, making immediate copying essential.

Correct answer: A. Creating custom Controls by defining a custom Security Graph query linked to a specific severity.

Creating custom Controls with graph queries is correct because it lets you tailor risk detection to specific environmental needs. You cannot directly modify the underlying logic of built-in rules, which is a frequent distractor on the exam.

Correct answer: C. Issue

An Issue is correct because it represents the contextual aggregation of multiple findings into a prioritized, exploitable toxic combination. A Control is simply the query rule that detects the risk, while the Issue is the actual resulting alert.

Correct answer: B. To enforce security policies by auditing or blocking resource deployments or modifications that violate pre-defined policies.

Enforcing security policies by auditing or blocking deployments is correct because the Admission Controller acts as a Kubernetes gatekeeper. It operates preemptively at deployment time, contrasting with continuous network monitoring or agentless scanning options.

Correct answer: C. Spin up an entirely new, standalone Wiz tenant for each TC.

Creating a completely standalone Wiz tenant for each target company ensures maximum data segregation during mergers and acquisitions. Relying on projects or RBAC within a shared tenant risks accidental data leakage between the parties.

Correct answer: C. Automation > Automation Rules > Create Rule.

Automation Rules are configured in the dedicated Automation section by defining a trigger and a corresponding action. Do not confuse global automation triggers with control actions, which are configured separately within the Policies menu.

Correct answer: C. Inventory > Container Registries.

The Container Registries page under the Inventory tab lists all manually connected and auto-discovered registries in the environment. Reviewing the SBOM is helpful for package vulnerabilities but does not map the actual registry infrastructure connections.

Correct answer: B. Hosted Technology detection

Hosted Technology detection identifies frameworks like Angular and Go through application fingerprinting. Software Bill of Materials focuses on package dependencies, whereas this feature profiles the running infrastructure.

Correct answer: C. Workload scanning.

Workload scanning is responsible for generating Host Configuration and Vulnerability findings by examining the actual machine snapshots. While API interrogation gathers high-level cloud control plane data, deep host analysis relies entirely on agentless workload scanning.

Correct answer: B. Enterprise support

Enterprise support is the level that provides access to Technical Account Managers and specific training offerings like certifications. Note that Elite is not a standard tier, making Enterprise the definitive choice for large organizations needing dedicated resources.

Correct answer: C. APIs and Required Permission Scopes documentation

The dedicated APIs and Required Permission Scopes documentation provides the mapping between GraphQL queries and their necessary scopes. Do not confuse this with the in-product audit log, which tracks historical user activity rather than serving as a development reference.

Correct answer: C. Python version 3.11.

When creating custom Azure response functions, you must use Python version 3.11 to match the container image provided by Wiz. The exam expects you to know the specific technical constraints for deploying these automated remediation scripts in cloud environments.

Correct answer: B. A fully deployed Azure Self-managed Network Outpost.

Scanning a private Azure Container Registry without internet access requires deploying a self-managed network Outpost inside your environment. A standard Broker handles external API connections, while the Outpost architecture provides the necessary local network reachability.

Correct answer: B. Infrastructure-as-Code (IaC)

Infrastructure-as-Code is the correct security design principle because it ensures changes are made via automated code with strict controls over manual interventions. Do not confuse this with immutable infrastructure, which focuses on replacing components rather than modifying them.

Correct answer: D. Wiz AC requires either a Wiz Cloud Advanced or Wiz for Gov Advanced license.

The key requirement is that the Wiz Admission Controller requires an Advanced license tier for deployment. While licensing is an important implementation prerequisite, the phrasing comparing it to agent-based limitations makes this a slightly flawed but valid question.