Membership Rules-Query Vs direct-based

Query based versus Direct membership:

Direct membership rules should be created when you want to target a very specific user or SMS client. Direct membership rules are not automatically updatable; therefore, any change of targeted resources is a manual process. If a targeted resource(workstation) is removed from the site database, the associated direct membership rules will be deleted from all collections. For example, if the workstation ESKON00 is a resource, and ESKON00 ages out of the site database(removed) for any reason, all direct membership rules referring to ESKON00 will also be Deleted. If ESKON00 is later rediscovered or inventoried, the direct membership rules must be recreated. For this reason, static membership rules should be used for focused, short-term distribution efforts only.
Query-based rules use a proprietary language known as WQL to pull information from the SMS Administrator console’s site database connection into a readable format. WQL is a subset of the SQL database language that allows for basic operations only through the SMS Administrator console. It supports select statements with the where and from clauses, as well as basic joins. Please note that WQL is used for queries from the SMS Administrators console only. Reports are written in the native SQL language. The SMS Administrator console handles conversion of WQL to SQL when contacting the site database, and returns formatted results.

 Queries should dynamically update to take full advantage of their capabilities. A component Called Collection Evaluator runs as part of the SMS service on site servers. This component updates collection membership on a schedule specified by administrators (daily by default). Because collections with only direct membership rules do not require dynamic updates, they should not be scheduled for reevaluation. Collections with query-based rules should be scheduled to update on an interval appropriate for their purpose. For example, it might be desirable to have a collection responsible for deploying security patches to newly created machines updated on a very frequent basis. Alternatively, a one-time distribution of an advertisement might require only manual updates.

More information can be found here