Which RQL string using network query attributes returns all traffic destined for Internet or for Suspicious IPs that also exceeds 1GB?

Question

Options

• Anetwork where publicnetwork = ('Internet IPs', 'Suspicious IPs') AND bytes > 1000000000
• Bnetwork where dest publicnetwork IN ('Internet IPs', 'Suspicious IPs') AND bytes > 1000000000
• Cshow traffic where destination.network = ('Internet IPs', 'Suspicious IPs') AND bytes > 1000000000
• Dnetwork where bytes > 1GB and destination = 'Internet IPs' OR 'Suspicious IPs'

• A
  7% (3)
• B
  76% (32)
• C
  14% (6)
• D
  2% (1)

Explanation

Option B is correct because it uses the proper RQL syntax for network queries in Prisma Cloud: dest publicnetwork IN (...) correctly specifies the destination network attribute and uses the IN operator to match multiple values in a list, while bytes > 1000000000 accurately represents 1GB in bytes.

Option A is wrong because it omits dest and uses = instead of IN - the equals operator cannot match a list of values, and the direction (destination) must be explicitly specified with dest publicnetwork.

Option C is wrong because show traffic and destination.network are not valid RQL syntax; the correct keyword is network where and the attribute uses dot-notation only in some contexts, not here.

Option D is wrong on multiple counts: 1GB is not valid syntax (bytes must be a raw integer), destination is not the correct attribute name (dest publicnetwork is), and the lack of parentheses around the OR clause would make the logic evaluate incorrectly.

Memory tip: Think of RQL network queries as "network where [direction] [attribute] IN ([list])" - remember the direction prefix (dest), the IN keyword for lists, and that bytes are always raw numbers (1GB = 1,000,000,000).

No community discussion yet for this question.