CKS Monitoring, Logging and Runtime Security Practice Question
Which of the following is NOT a valid priority level in a Falco rule?
⚠ Common exam trap
The CNCF CKS exam often tests the exact set of Falco priority levels, and the trap here is that candidates confuse 'HIGH' with the valid 'ERROR' or 'CRITICAL' levels, as 'HIGH' is a common severity label in other security tools but is not part of Falco's syslog-based priority list.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HIGH
Falco rules support priority levels as defined in the syslog severity standard. The valid priorities are: EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFORMATIONAL, and DEBUG. 'HIGH' is not a valid priority in Falco; the correct equivalent is 'ERROR' or 'CRITICAL' depending on severity. Therefore, option B is not a valid priority level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NOTICE
Why it's wrong here
NOTICE is a valid priority level in Falco's severity ladder, which is derived from syslog severity levels. It sits below WARNING and above INFO, and it is commonly used for rules that indicate notable activity that is not yet an error condition. For example, shell access or configuration changes might be flagged as NOTICE.
- ✓
HIGH
Why this is correct
HIGH is not a valid priority level in this context. Falco's predefined priority levels are EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, and DEBUG; there is no HIGH level. A rule that needs to indicate a serious threat above WARNING must use CRITICAL (or ALERT/EMERGENCY), not HIGH.
- ✗
CRITICAL
Why it's wrong here
CRITICAL is a valid priority level for the most severe security events, sitting just below ALERT and above ERROR in Falco's syslog-derived scale. It is appropriate for incidents like active privilege escalation or known exploit attempts. Because HIGH does not exist, CRITICAL is the correct way to express very high severity.
- ✗
WARNING
Why it's wrong here
WARNING is a valid priority level, positioned between NOTICE and ERROR in Falco's severity scale. It is used for suspicious but not yet confirmed malicious activity, such as unexpected file reads or bind shell attempts. Since WARNING is a standard syslog/Falco level, it is correctly accepted as a priority value.
About these practice questions
One of 845 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.