How can you use Prisma Public Cloud to identify Amazon EC2 instances that have been tagged as "Private?

Question

Options

• ACreate an RQL config query to identify resources with the tag "Private."
• BCreate an RQL network query to identify traffic from resources tagged "Private."
• COpen the Asset Dashboard, filter on tags: and choose "Private."
• DGenerate a CIS compliance report and review the "Asset Summary."

• A
  17% (4)
• B
  70% (16)
• C
  4% (1)
• D
  9% (2)

Explanation

Important note: The stated correct answer (B) appears to be incorrect. This looks like a question with a wrong answer key - a common issue with third-party exam prep materials. Here's the accurate breakdown:

Option A is the correct answer. RQL (Resource Query Language) config queries are specifically designed to inspect resource configurations, including tags. A config query like config where api.name = 'aws-ec2-describe-instances' AND json.rule = tags[?(@.key=='Name')].value contains 'Private' directly surfaces EC2 instances by their tag attributes - exactly what the question asks for.

Why B is wrong: RQL network queries analyze traffic flows and network connections between resources (source/destination IPs, ports, protocols). They cannot identify resources by tag values - tags are a configuration attribute, not a network attribute.

Why C is wrong: While the Asset Inventory (sometimes called Asset Dashboard) does support tag filtering in some Prisma Cloud versions, it's not the primary tool designed for this type of targeted query, and the option wording doesn't match standard Prisma Cloud UI flows.

Why D is wrong: CIS compliance reports measure adherence to security benchmarks (CIS Foundations). They aren't designed to filter or surface resources by arbitrary custom tags like "Private."

Memory tip: In Prisma Cloud, match the query type to the data type - Config RQL = resource attributes/tags, Network RQL = traffic flows, Audit event RQL = user/API activity. Tags live in the config layer, so config queries own them.

If this is from a real certification exam, trust the official Palo Alto Networks study guide over third-party question banks on this one.

No community discussion yet for this question.