Question 64 - PCCSE discussion

The correct RQL query to view users who have sufficient permissions to create security groups within Azure AD and create applications is option D. This query is specifically designed to assess policies within Azure Active Directory (Azure AD) by checking the authorization policy settings related to user default role permissions. The query targets the azure-active-directory-authorization-policy API to fetch configurations (config from cloud.resource) and then filters those configurations based on the JSON rules that dictate whether users are allowed to create security groups (defaultUserRolePermissions.allowedToCreateSecurityGroups is true) and applications (defaultUserRolePermissions.allowedToCreateApps is true). This query provides a comprehensive check by ensuring both conditions are met, which is necessary for users to have the combined capabilities of creating security groups and applications within Azure AD.

In the context of Prisma Cloud and cloud security principles, the RQL (Resource Query Language) is utilized for querying the configuration state of resources within cloud environments to ensure compliance with security policies. The RQL syntax in option D precisely aligns with the requirements for identifying users with specific permissions, leveraging Prisma Cloud's capability to provide visibility and control over cloud resources, as emphasized in various resources like the 'Prisma Cloud Visibility and Control Qualification Guide' and the 'Guide to Cloud Security Posture Management Tools.' These documents highlight the importance of continuous monitoring and validation of cloud resource configurations to maintain a secure and compliant cloud environment, which is effectively achieved through targeted RQL queries like the one in option D.

'Prisma Cloud Visibility and Control Qualification Guide' discusses the importance of visibility and compliance in cloud environments, which is directly applicable to the use of RQL for querying resource configurations.

'Guide to Cloud Security Posture Management Tools' emphasizes the need for comprehensive visibility and governance across cloud environments, further supporting the rationale behind the specific RQL query used to assess user permissions in Azure AD.