Which RQL string returns a list of all Azure virtual machines that are not currently running?

Question

Options

• Aconfig where api.name = 'azure-vm-list' AND json.rule = powerState = "off'
• Bconfig where api.name = 'azure-vm-list' AND json.rule = powerState does not contain "running"
• Cconfig where api.name = 'azure-vm-list' AND json.rule = powerState = "running"
• Dconfig where api.name = 'azure-vm-list' AND json.rule = powerState contains "running"

• A
  4% (1)
• B
  71% (17)
• C
  8% (2)
• D
  17% (4)

Explanation

Option B is correct because Azure VM power states use values like "PowerState/running", "PowerState/stopped", and "PowerState/deallocated" - so using does not contain "running" correctly captures all non-running states regardless of their specific value, making it the most inclusive and accurate filter.

Why the distractors fail:

• A is wrong on two counts: "off" is not a valid Azure VM power state (Azure doesn't use that value), and = requires an exact match, which wouldn't work against the "PowerState/..." format anyway.
• C is the logical inverse of what's needed - it returns VMs that are running, not those that aren't.
• D also returns currently running VMs (contains "running"), which is again the opposite of the goal.

Memory tip: Map the plain-English question directly to the RQL operator - "not currently running" → does not contain "running". Whenever the exam asks for the absence of a state, reach for does not contain rather than = or contains.

No community discussion yet for this question.