You type this query: event where user = 'root'. Where would the events you see originate?

The correct answer is A. AWS. In Prisma Cloud's Resource Query Language (RQL), the query 'event where user = root' returns audit events associated with the 'root' user. In AWS, the root user is the special super-administrator account created when an AWS account is first set up - it is explicitly named 'root'

Cloud Infrastructure Entitlement Management (CIEM)

Question

Options

AAWS
BAzure
CGCP
DGoogle Cloud

How the community answered

(41 responses)

A
90% (37)
B
2% (1)
C
2% (1)
D
5% (2)

Explanation

In Prisma Cloud's Resource Query Language (RQL), the query 'event where user = root' returns audit events associated with the 'root' user. In AWS, the root user is the special super-administrator account created when an AWS account is first set up - it is explicitly named 'root' in CloudTrail logs. Azure and GCP do not use 'root' as a user identifier in their audit event schemas; they use different naming conventions (e.g., service principals and IAM roles in Azure/GCP). Therefore, this query specifically targets and returns events originating from AWS.

Topics

#AWS#Cloud Security#Identity and Access Management#Event Monitoring

Community Discussion

No community discussion yet for this question.

Full PCCSE Practice