WAZUH practice examsIn development

Wazuh Open Source Security Platform

Wazuh · intermediate · Self-paced

In developmentThis course is still being brought to our full standard. The questions and notes are usable, but they have not yet been checked line by line against the vendor’s own training.

Deploy, operate and tune Wazuh as a unified XDR and SIEM. Covers the manager, agent, indexer and dashboard architecture, log collection and the decoder and rule pipeline, file integrity monitoring, security configuration assessment and vulnerability detection, and active response, integrations and the API.

What you get

350practice questions

6full papers of 48

12course chapters · 65 minutes

100%answers explained

Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.

What the exam covers

The domains our question bank is built on. We have not yet transcribed this vendor’s own outline for this exam.

Architecture and Deployment	25%
Log Analysis, Decoders and Rules	30%
Endpoint Security Capabilities	25%
Response, Integration and Operations	20%

Two sample questions

Two of the 350, with the answer and the explanation.

1. An agent is installed and started, but the manager never sees it and the agent log reports it is not registered. What is missing?

An entry in client.keys — correct
A localfile block in ossec.conf
An agent group assignment
A rule matching the agent events

Why: Without a key in client.keys the agent has no identity and remoted refuses its events. Enrolment through authd or agent-auth is what creates that entry.

2. Why should report_changes be used carefully on files holding secrets?

It slows each scheduled scan noticeably
It turns off hash checking for that path
It stops realtime monitoring from working
The stored copy sits on the manager — correct

Why: Showing the difference requires keeping the content, so a monitored credential file ends up duplicated where it was not expected to be.

The real WAZUH exam

Length	Self-paced
Questions	48 in this bank
Pass mark	75% on practice, set by this platform
Price	Free — Wazuh is open source under GPLv2
Recommended before you sit it	Comfort on the Linux command line, basic networking, and familiarity with how logs are produced by operating systems and applications.
Valid for	Not applicable

Exam facts as published by Wazuh; always check the vendor’s page before you book.

Study WAZUH with Chiron

Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.