Given the following audit event activity snippet: Which RQL will be triggered by the audit event? A. B. C. D.

Question

Exhibit

Options

• Aevent from cloud.audit_logs where operation IN ("cloudsql.instances.update", "cloudsql.sslCerts.create", "cloudsql.instances.create", "cloudsql.instances.delete")
• Bevent from cloud.audit_logs where operation IN ('storage.buckets.create', 'storage.setIamPolicy', 'storage.buckets.delete')
• Cevent from cloud.audit_logs where operation IN ("authorization.securitygroupingress.createVPC", "deleteFlowlog", "deleteVPC", "modifyAttributes", "deleteSecurityGroupIngress")
• Devent from cloud.audit_logs where operation IN ("compute.audit_policy", "compute.networks.insert", "v1.compute.firewalls.insert", "v1.compute.firewalls.delete")

• A
  14% (2)
• B
  7% (1)
• C
  7% (1)
• D
  71% (10)

Explanation

Based on the context of the audit event and the available RQL options, option D is correct: it queries GCP compute audit logs for network and firewall-related operations including 'compute.networks.insert', 'v1.compute.firewalls.insert', and 'v1.compute.firewalls.delete'. Option A targets Cloud SQL operations (database service), option B targets GCS storage bucket operations, and option C targets AWS-style security group operations (note the AWS-specific operation names like 'deleteVPC' and 'modifyAttributes'). Option D aligns with GCP VPC network and firewall audit events, which matches the expected audit event activity described in the question.

No community discussion yet for this question.