Which RQL will trigger the following audit event activity?

The correct answer is A. event from cloud.audit_logs where operation = ConsoleLogin AND user = 'root'. The question refers to an audit event triggered by a root console login. The correct RQL is: 'event from cloud.audit_logs where operation = ConsoleLogin AND user = \'root\''. This queries the cloud audit logs for the specific ConsoleLogin operation performed by the root user…

Prisma Cloud Platform

Question

Exhibit

Options

Aevent from cloud.audit_logs where operation = ConsoleLogin AND user = 'root'
Bevent from cloud.audit_logs where cloud.service = 's3.amazonaws.com' AND json.rule =
Cevent from cloud.audit_logs where operation IN
Devent from cloud.audit_logs where operation IN ('GetBucketWebsite', 'PutBucketWebsite',

How the community answered

(49 responses)

A
88% (43)
B
4% (2)
C
2% (1)
D
6% (3)

Explanation

The question refers to an audit event triggered by a root console login. The correct RQL is: 'event from cloud.audit_logs where operation = ConsoleLogin AND user = 'root''. This queries the cloud audit logs for the specific ConsoleLogin operation performed by the root user - a high-risk activity that Prisma Cloud monitors as a default policy. Option B targets S3 service events, option C uses an IN clause with unspecified operations, and option D targets S3 bucket website configuration events. None of B, C, or D relate to console login activity by the root account.

Topics

#RQL#Audit Logs#Cloud Security Monitoring#Root User Access

Community Discussion

No community discussion yet for this question.

Full PCCSE Practice