Which IAM Azure RQL query would correctly generate an output to view users who have sufficient permissions to create security groups within Azure AD and create applications?

Question

Options

• Aconfig where api.name = 'azure-active-directory-authorization-policy' AND json.rule =
• Bconfig from cloud.resource where api.name = 'azure-active-directory-authorization-policy' AND
• Cconfig from network where api.name = 'azure-active-directory-authorization-policy' AND json.rule =
• Dconfig from cloud.resource where api.name = 'azure-active-directory-authorization-policy' AND

• A
  3% (1)
• B
  6% (2)
• D
  91% (32)

Explanation

A valid Prisma Cloud RQL query for IAM configuration must begin with 'config from cloud.resource' (not 'config where' or 'config from network'), which scopes the search to cloud resource configurations. Option D uses the correct syntax: 'config from cloud.resource where api.name = 'azure-active-directory-authorization-policy' AND' followed by a json.rule filtering for the relevant permission flags (e.g., allowedToCreateSecurityGroups and allowedToCreateApps). Option A omits the required 'from cloud.resource' clause, option B is nearly identical to D but differs in the json.rule filter logic, and option C incorrectly uses 'from network', which is used for network-based queries, not IAM resource configuration.

No community discussion yet for this question.