Which Resource Query Language (RQL) query searches for all Relational Database Service (RDS) instances that have a public IP address?

Question

Options

• Aconfig from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule =
• Bevent from cloud.audit_logs where api.name = 'aws-rds-describe-db-instances' AND json.rule =
• Cconfig from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule =
• Dconfig from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule =

• A
  5% (1)
• B
  5% (1)
• C
  82% (18)
• D
  9% (2)

Explanation

Option C is correct because finding RDS instances with a public IP requires querying current resource configuration (config from cloud.resource) against the correct RDS API (aws-rds-describe-db-instances), with a json.rule that checks a field like publiclyAccessible is true - matching the resource's actual state in your cloud environment.

Why the distractors are wrong:

• Option A uses the same config from cloud.resource and aws-rds-describe-db-instances structure, but the json.rule condition is incorrect - it likely targets the wrong field or uses the wrong logic to identify publicly accessible instances.
• Option B uses event from cloud.audit_logs, which queries API activity (who called what, when), not the current state of a resource - it cannot tell you whether an RDS instance is publicly accessible right now.
• Option D uses aws-ec2-describe-instances, which is the correct API for EC2 virtual machines, not RDS database instances - a common mix-up since both live in AWS.

Memory tip: Use the two-part RQL rule of thumb - type then target: config = "what a resource is", event = "what happened". And match the API name to the service: rds for databases, ec2 for compute. If the question is about a database's current state, you need config + rds.

No community discussion yet for this question.