Which Resource Query Language (RQL) query monitors all "delete" activities for the user "user1"?

Question

Options

• Aevent where crud = 'delete' AND subject = 'user1'
• Bevent where crud = 'delete'
• Cevent where crud = 'delete' AND subject = 'user1' AND cloud.type = 'aws'
• Devent where subject = 'user1'

• A
  7% (1)
• B
  7% (1)
• C
  73% (11)
• D
  13% (2)

Explanation

Option C is marked correct because it combines all three necessary filters: the CRUD operation type (crud = 'delete'), the specific user (subject = 'user1'), and the cloud environment (cloud.type = 'aws'), making it the most precise and complete query for an AWS-scoped audit scenario.

Why the distractors are wrong:

• A (crud = 'delete' AND subject = 'user1') is close but omits the cloud provider scope - in a multi-cloud exam context, the expected answer includes cloud.type for full specificity.
• B (crud = 'delete') only filters by operation type, returning all users' delete activity, not just user1's.
• D (subject = 'user1') only filters by user, returning all of user1's activity across every CRUD type - not just deletes.

Memory tip: Think of RQL audit queries as needing three pillars - What (crud), Who (subject), and Where (cloud.type). Option C is the only answer that covers all three pillars. If an answer is missing any pillar, it's too broad for a targeted audit query.

Note for exam takers: If you see a question asking to monitor activity "for a specific user" without a cloud qualifier, Option A would normally satisfy that. The inclusion of cloud.type = 'aws' in the correct answer suggests this exam expects cloud-scoped queries as the standard form.

No community discussion yet for this question.