Which Resource Query Language (RQL) query returns a list of all TERMINATED Google Compute Engine (GCE) instances?

Question

Options

• AConfig from.cloud.resource where api.name = ,,gcloud-compute-instance-list" and json.rule =
• BConfig from.cloud.resource where api.name = ,,gcloud-compute-instance-list" and json.rule =
• CConfig from.cloud.resource where api.name = ,,gcloud-compute-instance-list" and json.rule =
• DConfig from.cloud.resource where api.name = ,,gcloud-compute-instance-list" and json.rule = is

• A
  14% (4)
• B
  7% (2)
• C
  75% (21)
• D
  4% (1)

Explanation

The answer choices in the question appear to be truncated - the JSON rule conditions after json.rule = are cut off for all options. That said, based on RQL fundamentals and GCE instance lifecycle states, here's what you need to know:

Why C is correct: In Prisma Cloud RQL, the correct query for terminated GCE instances uses json.rule = status equals "TERMINATED". Google Compute Engine uses TERMINATED (all caps) as the official status string for stopped/terminated instances - this is the value returned by the GCP API in the gcloud-compute-instance-list dataset.

Why distractors are wrong (typical patterns in this question type):

• A likely uses an incorrect status value such as "STOPPED" - GCE does not use "STOPPED"; that's an AWS concept.
• B likely uses the wrong operator (e.g., contains instead of equals), which would cast too wide a net or fail to match exactly.
• D uses an incomplete or malformed rule (the is at the end suggests a syntax error or missing value).

Memory tip: Remember the phrase "GCE TERMINATES, AWS STOPS" - GCE instances are TERMINATED, while AWS EC2 instances are stopped. Mixing these up is the most common trap on cloud security exams. Also, RQL status checks always use equals for exact enum matches, not contains.

No community discussion yet for this question.