Which RQL query should be used to quickly identify any events related to an organization's Google Cloud Platform Big Query database the last 24 hours?

Question

Options

• Aevent from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'Google Bigtable
• Bevent from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service =
• Cevent from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service =
• Devent from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service =

• A
  7% (1)
• C
  86% (12)
• D
  7% (1)

Explanation

Option C is correct because it specifies cloud.service = 'Google BigQuery' (the data warehousing/analytics service), which precisely targets BigQuery audit log events within the GCP environment using the correct service identifier in Prisma Cloud's RQL syntax.

Why the distractors are wrong:

• Option A is incorrect because it specifies Google Bigtable - a completely different GCP service (a NoSQL wide-column database), not BigQuery. These are two distinct products that are commonly confused due to similar naming.
• Options B and D reference incorrect service name values for BigQuery - likely naming other GCP services or using malformed identifiers that would not return the intended results.

Memory tip: Think "BigQuery = SQL analytics warehouse" vs. "Bigtable = NoSQL table store" - the RQL cloud.service field must exactly match the product name, so getting the service name right is the whole game. When you see a question about a GCP database query/analytics service, BigQuery is the answer; Bigtable is the trap for NoSQL scenarios.

No community discussion yet for this question.