Which two types of Resource Query Language (RQL) queries can be used to create policies? (Choose two.)

Question

Options

• Ahose from
• Bnetwork from
• Csystem from
• Devent from

• A
  93% (43)
• B
  2% (1)
• C
  4% (2)

Explanation

Option A ("config from" - likely a typo for "hose from" in the source material) and D (event from) are the two RQL query types used to create policies in Prisma Cloud. config from queries resource configuration state and is used to build Config policies, while event from queries audit logs and is used to build Audit Event policies - both are supported as policy types in the Prisma Cloud policy framework.

B (network from) is incorrect here because while network from is a valid RQL query type for investigating network flow data, it does not directly map to a supported policy creation type in this context. C (system from) is a distractor - no such RQL query type exists in the standard Prisma Cloud RQL syntax.

Memory tip: Think of the two policy-friendly RQL types as covering what your resources look like (config from) and what happened in your environment (event from) - configuration state and audit events are the two pillars of policy enforcement, while network queries are investigative tools rather than policy builders.

No community discussion yet for this question.