ExamGecko
Question list
Search
Search

List of questions

Search

Question 93 - PCCSE discussion

Report
Export

Given the following RQL:

event from cloud.audit_logs where operation IN ('CreateCryptoKey', 'DestroyCryptoKeyVersion', 'v1.compute.disks.createSnapshot')

Which audit event snippet is identified?

A)

B)

C)

D)

A.
Option A
Answers
A.
Option A
B.
Option B
Answers
B.
Option B
C.
Option C
Answers
C.
Option C
D.
Option D
Answers
D.
Option D
Suggested answer: C

Explanation:

The given RQL (Resource Query Language) query is looking for specific audit events related to cryptographic key actions and snapshot creation. The snippet that matches this query is Option C, which contains the statement indicating permissions that allow any action ('Action': '*') and the reference to the version date '2012-10-17' that corresponds to the policy within the audit log.

This can be cross-referenced with cloud provider documentation, such as AWS CloudTrail or Google Cloud Audit Logs, which record user activities and API usage. The RQL provided would be used in a CSPM tool to query these audit logs for the specified events.

asked 23/09/2024
Laura Reyero
38 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first