Which type of Resource Query Language (RQL) query is used to create a custom policy that looks for untagged resources?

Question

Options

• Aconfig
• Balert
• Cevent
• Ddata

• A
  93% (27)
• B
  3% (1)
• C
  3% (1)

Explanation

Config RQL queries interrogate the current configuration state of cloud resources, making them the correct tool for finding untagged resources - since "missing a tag" is a configuration attribute, not an event or alert. Config queries let you write policy logic like config from cloud.resource where tags not exist, targeting resource metadata directly.

Alert (B) is not a standalone RQL query type - alerts are generated by policies, not a query mode you write in RQL. Event (C) queries are used for audit logs and user activity (e.g., API calls, login events), not resource configuration states. Data (D) queries are used for data security and classification findings, such as identifying sensitive files in storage buckets.

Memory tip: Think "Configuration = Config query." Any policy that asks "what does this resource look like right now?" (tags, open ports, encryption settings) uses config. If it asks "what happened?", that's event.

No community discussion yet for this question.