PCCSE Question #102: Real Exam Question with Answer & Explanation

Question

One of the resources on the network has triggered an alert for a Default Config policy. Given the following resource JSON snippet: Which RQL detected the vulnerability? A. B. C. D.

Options

• Aconfig from cloud.resource where api.name = 'aws-ecs-service' AND json.rule = launchType equals EC2 as Xi config from cloud.resource where api.name = 'aws-ecs-cluster' AND json.rule = status equals ACTIVE and resource.metadata.tags.key exists ('test') as Xj, combine Xi, Xj with (resource.name = 'test') | show Yi
• Bconfig from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-credential-report' AND json.rule = 'report.LastCredentialRotation' < days_ago(90) AND (access_key_1_active is true and access_key_2_activated by N/A and date_time.apiKeyDays(access_key_2_last_rotated) > 90)
• Cconfig from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-images' AND json.rule = 'image.platform contains windows and image.imageid contains ami-1e542176'
• Dconfig from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-security-groups' AND json.rule = 'egress.IpPermissions[] contains (ipProtocol equals tcp AND (IpRanges[] contains 0.0.0.0/0 OR IpRanges[] contains ::/0) OR IpProtocol equals icmpv6 OR ipProtocol equals udp) AND (IpRanges[] contains 0.0.0.0/0 OR IpRanges[] contains ::/0)'