One of the resources on the network has triggered an alert for a Default Config policy. Given the following resource JSON snippet: Which RQL detected the vulnerability? A. B. C. D.

Question

Exhibits

Options

• Aconfig from cloud.resource where api.name = 'aws-ecs-service' AND json.rule = launchType equals EC2 as Xi config from cloud.resource where api.name = 'aws-ecs-cluster' AND json.rule = status equals ACTIVE and resource.metadata.tags.key exists ('test') as Xj, combine Xi, Xj with (resource.name = 'test') | show Yi
• Bconfig from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-credential-report' AND json.rule = 'report.LastCredentialRotation' < days_ago(90) AND (access_key_1_active is true and access_key_2_activated by N/A and date_time.apiKeyDays(access_key_2_last_rotated) > 90)
• Cconfig from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-images' AND json.rule = 'image.platform contains windows and image.imageid contains ami-1e542176'
• Dconfig from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-security-groups' AND json.rule = 'egress.IpPermissions[] contains (ipProtocol equals tcp AND (IpRanges[] contains 0.0.0.0/0 OR IpRanges[] contains ::/0) OR IpProtocol equals icmpv6 OR ipProtocol equals udp) AND (IpRanges[] contains 0.0.0.0/0 OR IpRanges[] contains ::/0)'

• A
  4% (1)
• B
  71% (20)
• C
  18% (5)
• D
  7% (2)

Explanation

Option B queries the IAM credential report (aws-iam-get-credential-report) to find AWS access keys that have not been rotated in more than 90 days. This is a common default Config policy in Prisma Cloud focused on IAM hygiene. Option A uses a multi-resource join query for ECS, Option C targets EC2 AMIs, and Option D checks overly permissive security group egress rules - none of which match the described IAM credential-related resource JSON snippet.

No community discussion yet for this question.