Which RQL string monitors all traffic from the Internet and Suspicious IPs destined for your Amazon Web Services databases''

Question

Options

• Anetwork where source.publicnetwork IN ('Suspicious IPs') and dest.resource IN (resource where
• Bnetwork where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest.resource IN
• Cnetwork where dest.resource IN (resource where role = 'Database'}
• Dnetwork where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest resource IN

• A
  8% (3)
• B
  5% (2)
• C
  18% (7)
• D
  70% (28)

Explanation

Option D is correct because it includes both required source networks - 'Suspicious IPs' and 'Internet IPs' - in the source.publicnetwork IN (...) filter, ensuring all inbound internet and suspicious traffic is captured, while correctly targeting destination resources (your AWS databases).

Option A fails because it only lists 'Suspicious IPs' and omits 'Internet IPs', meaning general internet traffic would go unmonitored - only half the threat scope is covered.

Option B appears syntactically similar but uses dest.resource IN with a dot notation that does not conform to the correct Prisma Cloud RQL attribute reference for this query structure, making it invalid.

Option C is wrong on two counts: it has a bracket/brace mismatch (} instead of )) and entirely omits the source.publicnetwork filter, meaning it would match all traffic to databases regardless of where it originated - not just internet and suspicious sources.

Memory tip: Think of the query as a two-part security gate - who's knocking (source must include both 'Internet IPs' and 'Suspicious IPs') and what's the target (dest must point to database resources). If either "who" is missing or the syntax is broken, the gate is incomplete. D is the only option where both halves of the gate are correctly formed.

No community discussion yet for this question.