An administrator needs to detect and alert on any activities performed by a root account. Which policy type should be used?

To detect and alert on specific user activities, such as actions performed by a root account, the audit event policy type is the correct choice. This policy type analyzes cloud provider audit logs (e.g., AWS CloudTrail, Azure Activity Logs, GCP Audit Logs) for specific API calls and user actions. An administrator can create a policy using Resource Query Language (RQL) to filter for events where the user identity is 'root'. This allows for real-time detection and alerting on high-privilege activities, which is a critical security monitoring function.

A. config-run policies scan the configuration state of deployed cloud resources for misconfigurations, not user activity events.
B. config-build policies scan Infrastructure-as-Code (IaC) templates pre-deployment and do not monitor runtime activities.
C. network policies analyze network flow logs to detect anomalous traffic patterns, not user API calls or account activities.

1. Palo Alto Networks, Prisma Cloud Docs. "Prisma Cloud Policy Types." The documentation describes Audit Event policies as tools to "Create a policy that generates an alert when an anomalous API call is invoked or a user performs an unusual activity." This directly aligns with monitoring root account activity.

2. Palo Alto Networks, Prisma Cloud Docs. "Create an Audit Event Policy." This section details how to build RQL queries against audit log data, providing examples such as api.name = 'aws-iam-delete-user' and json.rule = 'userIdentity.type = "Root"'.