Which two attributes are required for a custom config RQL? (Choose two.)

In a custom configuration Resource Query Language (RQL) statement, Prisma Cloud requires you to specify the exact CSPM API to interrogate (api.name) and the logical test to run against its returned JSON payload (json.rule). These two keys are mandatory and the query will not parse without them; all other selectors (for example cloud.account or tag) are optional filters that may be appended but are not syntactically required.

B. cloud.account – Optional filter that limits scope to one account; query compiles without it.
D. tag – Optional metadata filter; not part of the required RQL core syntax.

1. Palo Alto Networks, Prisma Cloud Administrator’s Guide, “Build a Custom Policy → Configuration RQL Syntax”, p. 213–214 (Jan 2024).

2. Palo Alto Networks, Prisma Cloud RQL Cheat Sheet, section “Required Keys”, rev 23.1.