Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Security Posture Management (CSPM)Medium
A security engineer is reviewing the asset inventory in Prisma Cloud for their GCP environment. They notice several Compute Engine instances that are not tagged according to organizational standards and are missing required metadata. Which Prisma Cloud capability allows the engineer to query and identify these specific instances based on their missing or incorrect tags and metadata?
- AAutomated Remediation
- BCompliance Policies
- CResource Query Language (RQL)
- DAttack Path Analysis
Show answer & explanationAnswer & explanation
Correct answer: C. Resource Query Language (RQL)
Resource Query Language (RQL) is Prisma Cloud's powerful query engine that allows users to write highly specific queries to find resources based on various attributes, including tags, metadata, configurations, and relationships. This is ideal for identifying resources that don't meet specific tagging standards.
Why the other options are wrong
- A. Automated Remediation is an action taken *after* a non-compliant resource is identified; it's not the identification mechanism itself.
- B. Compliance Policies are built *using* RQL to define rules, but RQL itself is the capability for direct querying.
- D. Attack Path Analysis focuses on potential attack vectors, not on resource tagging or metadata.
Prisma Cloud Resource Query Language (RQL)
A powerful query language used in Prisma Cloud to search, filter, and identify cloud resources based on their configurations, attributes, and relationships.
- Enables precise resource identification.
- Supports complex queries for tags, metadata, and configurations.
- Used to build custom policies and investigate alerts.
Memory trick: RQL is your cloud search engine.