Which Amazon Web Services (AWS) service supplies information for Prisma Cloud "event where" Resource Query Language (RQL) queries?

Question

Options

• AGuardDuty
• BCloudTrail Audit Logs
• CActivity Logs
• DInspector

• A
  3% (1)
• B
  86% (32)
• C
  8% (3)
• D
  3% (1)

Explanation

CloudTrail Audit Logs (B) power Prisma Cloud's event where RQL queries because CloudTrail records all API calls and account activity across AWS services - exactly the event-level data Prisma Cloud ingests to let you query "who did what, when, and from where."

Why the distractors are wrong:

• A. GuardDuty is a threat detection service that generates findings, but Prisma Cloud uses it for alert enrichment, not as the source for event where queries.
• C. Activity Logs is an Azure concept (Azure Monitor Activity Logs), not an AWS service - it's a common trap for multi-cloud exam questions.
• D. Inspector performs vulnerability assessments on EC2 instances and container images; it has no role in feeding event/audit data to RQL.

Memory tip: Think of the RQL query type as a hint - event where = something happened = an audit trail = CloudTrail. The word "event" maps directly to CloudTrail's purpose of logging API events.

No community discussion yet for this question.