A Prisma Cloud Administrator has been asked to create a custom policy which notifies the InfoSec team each time a configuration mange is made to a Security group. Which type of Resource Query…

Question

Options

• Aaudit from
• Bnetwork from
• Cevent from
• Dconfig from

• A
  89% (41)
• B
  2% (1)
• C
  2% (1)
• D
  7% (3)

Explanation

Important caveat: The marked answer (A) appears to be incorrect. "audit from" is not a valid Prisma Cloud RQL query type - this looks like an error in the answer key.

The actual correct answer is C: event from.

event from queries cloud audit logs, which capture API calls and configuration changes - exactly what's needed to detect when someone modifies a security group. It records who made the change, when, and what was altered, making it the right choice for an alert-on-change policy. config from queries the current state of a resource (e.g., "show me all security groups open to 0.0.0.0/0") rather than detecting changes, so it would miss the notification requirement. network from is used for VPC flow log analysis - network traffic, not configuration events. "audit from" simply does not exist as an RQL keyword.

Memory tip: Think of the three real RQL prefixes by what they watch - config = what is, event = what happened, network = what flowed. Any question about detecting a change or action (someone modifying, creating, or deleting a resource) → event from.

If this is from a practice exam or study guide, I'd flag it as a likely typo where A and C were swapped.

No community discussion yet for this question.