PSE-Prisma CloudDemo

By Palo Alto Networks · Question Mode

QuestionQ52

Investigating Security Issues with RQL

Which Resource Query Language (RQL) query produces a list of all TERMINATED Google Compute Engine (GCE) instances?

  • A config from cloud.resource where api.name = 'gcloud-compute-instances-list' and json.rule = is TERMINATED
  • B config from cloud.resource where api.name = 'gcloud-compute-instances-list' = TERMINATED
  • C config from cloud.resource where api.name = 'gcloud-compute-instances-list* and json.rule = status TERMINATED
  • D config from cloud.resource where api.name = 'gcloud-compute-instances-list' and json.rule = contains TERMINATED status
Explanation

A configuration RQL query filters cloud resources by API name and evaluates the resource condition through json.rule. The gcloud-compute-instances-list API identifies GCE instances, and the TERMINATED state condition limits the result set to instances in that state.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!