Palo Alto Networks System Engineer – Prisma Cloud — Question 25

Which RQL query returns a list of all Azure virtual machines that are not currently running?

Answer options

• A. config from cloud.resource where api.name = 'azure-vm-list' AND json.rule = powerState contains "running"
• B. config from cloud.resource where api.name = 'azure-vm-list' AND json.rule = powerState = "running"
• C. config from cloud.resource where api.name = 'azure-vm-list* AND json.rule = powerState = "off"
• D. config from cloud.resource where api.name = 'azure-vm-list' AND json.rule = powerState does not contain "running"

Correct answer: D

Explanation

The correct answer is D because it specifically checks for virtual machines where the powerState does not include 'running', indicating they are not active. Option A incorrectly looks for machines that are running, while B checks for machines that are currently in the running state. Option C is also incorrect as it only checks for machines that are 'off', missing other non-running states.