Palo Alto Networks System Engineer – Prisma Cloud — Question 37

Which Resource Query Language (RQL) string searches for all Elastic Block Store (EBS) volumes that do not have a "DataClassification" tag?

Answer options

• A. config cloud.resource from api.name = 'aws-ec2-describe-volumes' AND json.rule = tags[*].key exists
• B. config cloud.resource from api.name = 'aws-ec2-describe-volumes' AND json.rule = tags[*].key = 1
• C. config cloud.resource from api.name = 'aws-ec2-describe-volumes' AND json.rule = tags[*].key contains DataClassification
• D. config cloud.resource from api.name = 'aws-ec2-describe-volumes' AND json.rule = tags[*].key does not contain DataClassification

Correct answer: D

Explanation

The correct answer, D, correctly specifies that it is looking for EBS volumes where the 'DataClassification' tag is absent. Option A incorrectly checks for the existence of any tag key, while option B looks for a tag key equating to 1, which does not address the required condition. Option C incorrectly seeks volumes that contain the 'DataClassification' tag instead of those that do not.