Palo Alto Networks Exam PCCSE Topic 1 Question 77 Discussion

Actual exam question for Palo Alto Networks's PCCSE exam

Question #: 77
Topic #: 1

Which IAM RQL query would correctly generate an output to view users who enabled console access with both access keys and passwords?

Aconfig from network where api.name = 'aws-iam-get-credential-report' AND json.rule = cert_1_active is true or cert_2_active is true and password_enabled equals 'true'

Bconfig from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = access_key_1_active is true or access_key_2_active is true and password_enabled equals 'true'

Cconfig from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = access_key_1_active is false or access_key_2_active is true and password_enabled equals '*'

Dconfig where api.name = 'aws-iam-get-credential-report' AND json.rule= access_key_1_active is true or access_key_2_active is true and password_enabled equals ''true''

Show Suggested Answer

Suggested Answer: B

View users who enabled console access with both access keys and passwords: config from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = access_key_1_active is true or access_key_2_active is true and password_enabled is true https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/config-query/config-query-examples

by Mammie at May 20, 2024, 10:58 PM

Limited Time Offer

25%

Off

Get Premium PCCSE Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Marlon

12 months ago

Option B for the win! Though I have to say, the exam team really likes to make these IAM queries as complicated as possible, don't they?

upvoted 0 times

...

Glendora

12 months ago

Haha, looks like the exam writers are trying to trick us with all these 'cloud.resource' and 'json.rule' shenanigans. I'd go with the simplest option, which is B.

upvoted 0 times

...

Donte

12 months ago

Hmm, option B looks good, but shouldn't we use 'AND' instead of 'OR' between the access key and password checks? Just to be sure we get users with both.

upvoted 0 times

...

Carmen

12 months ago

Option B it is! But I'm wondering, do we really need to check for both access keys? Wouldn't just one active key be enough?

upvoted 0 times

...

Twana

12 months ago

The query in option B seems a bit convoluted. Shouldn't it be simpler, like just checking for 'access_key_1_active' or 'access_key_2_active' and 'password_enabled'?

upvoted 0 times

Selma

11 months ago

That would make it easier to understand and use.

upvoted 0 times

...

Emmett

11 months ago

Maybe they could simplify it by just checking for 'access_key_1_active' or 'access_key_2_active' and 'password_enabled'.

upvoted 0 times

...

Marylyn

11 months ago

Option B does seem a bit complex.

upvoted 0 times

...

Kiera

12 months ago

I'm not sure about the use of 'cloud.resource' in the query. Shouldn't it be 'network' since we're looking for IAM users?

upvoted 0 times

Nakisha

11 months ago

I'm not sure about the use of 'cloud.resource' in the query. Shouldn't it be 'network' since we're looking for IAM users?

upvoted 0 times

...

Kara

11 months ago

B) config from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = access_key_1_active is true or access_key_2_active is true and password_enabled equals "true"

upvoted 0 times

...

Kanisha

12 months ago

A) config from network where api.name = 'aws-iam-get-credential-report' AND json.rule = cert_1_active is true or cert_2_active is true and password_enabled equals "true"

upvoted 0 times

...