Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Security Posture Management (CSPM)Medium
A cloud security engineer needs to create a custom policy in Prisma Cloud to identify all EC2 instances across their AWS, Azure, and GCP environments that have been running for more than 90 days AND have no 'Owner' tag defined. Which RQL logical operator is essential for combining these two conditions to accurately filter the desired resources?
- ANOT
- BAND
- COR
- DLIKE
Show answer & explanationAnswer & explanation
Correct answer: B. AND
The requirement specifies finding instances that meet *both* conditions: running for more than 90 days *and* lacking an 'Owner' tag. The 'AND' logical operator is used to combine multiple conditions where all must be true for a resource to be included in the results.
Why the other options are wrong
- A. 'NOT' negates a condition, it doesn't combine two positive conditions.
- C. 'OR' would return instances that meet either one condition or the other, not necessarily both.
- D. 'LIKE' is a comparison operator for pattern matching, not a logical operator for combining conditions.
RQL Logical Operator: AND
The 'AND' logical operator in Resource Query Language (RQL) is used to combine multiple conditions, requiring all specified conditions to be true for a resource to be included in the query results.
- Requires all combined conditions to be met.
- Used for narrowing down results based on multiple criteria.
- Essential for precise filtering in custom policies.
Memory trick: For 'both' conditions, use 'AND'.