Which RQL string monitors all traffic from the Internet and Suspicious IPs destined for your Amazon Web Services databases''

This RQL query correctly identifies the required network traffic. network where specifies the data source as network flow logs. The source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') clause filters for traffic originating from both known suspicious IP addresses and the general internet. The dest.resource IN (resource where role IN ('AWS RDS', 'Database')) clause filters for traffic destined to resources that Prisma Cloud has identified as AWS Relational Database Service (RDS) instances or other resources classified with the generic 'Database' role. This combination precisely matches all components of the monitoring requirement.

A: This query is incomplete because it only includes 'Suspicious IPs' as a source and omits the required 'Internet IPs'. B: This query has the correct source but an incorrect destination, as it targets resources with the 'LDAP' role instead of databases. C: This query is missing the source filter entirely; it would show all traffic to databases from any source, not just the Internet and Suspicious IPs.

1. Palo Alto Networks. (2023). Prisma Cloud RQL (Resource Query Language) Reference. "Network Query". This documentation details the syntax for querying network events.

2. Palo Alto Networks. (2023). Prisma Cloud RQL (Resource Query Language) Reference. "Search for Network Traffic from Public IP Addresses". This section shows the usage of source.publicnetwork with values like 'Internet IPs' and 'Suspicious IPs'.

3. Palo Alto Networks. (2023). Prisma Cloud RQL (Resource Query Language) Reference. "Resource JSON Attributes". The documentation lists role as a key attribute for identifying the function of a resource, with examples like 'AWS RDS' and 'Database'.