CKS Falco Priority Levels Practice Question
Which THREE Falco priority levels sequences are correctly ordered from lowest to highest severity? (Choose three)
⚠ Common exam trap
The question asks to choose three correct sequences; all three (A, B, E) are valid. Some candidates may mistakenly think that only two are correct due to the ordering complexities, but all three follow the correct ascending severity order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WARNING, ERROR, CRITICAL, ALERT, EMERGENCY
Options A, B, and E are correctly ordered from lowest to highest severity according to Falco's priority levels, which follow the standard syslog severity ordering (RFC 5424). Option A: WARNING, ERROR, CRITICAL, ALERT, EMERGENCY is correct. Option B: DEBUG, INFORMATIONAL, NOTICE, WARNING is correct. Option E: NOTICE, WARNING, ERROR, CRITICAL is correct. Options C and D are incorrectly ordered (C has DEBUG after NOTICE, and D starts with ALERT which is higher than ERROR).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
WARNING, ERROR, CRITICAL, ALERT, EMERGENCY
Why this is correct
This sequence starts at WARNING and moves through ERROR, CRITICAL, ALERT, and EMERGENCY, which exactly matches Falco's ascending severity ranking for those levels. Each step denotes a progressively more serious security event, from a notable anomaly to a system-wide emergency requiring immediate response.
- ✓
DEBUG, INFORMATIONAL, NOTICE, WARNING
Why this is correct
Beginning with DEBUG, the lowest possible severity, then stepping up to INFORMATIONAL, NOTICE, and WARNING correctly traces the bottom of Falco's priority ladder. DEBUG is reserved for verbose diagnostic output, while WARNING already flags behavior worth review, so the order respects Falco's intrinsic hierarchy.
- ✗
INFORMATIONAL, NOTICE, DEBUG, WARNING
Why it's wrong here
This sequence is broken because after INFORMATIONAL the next level should NOTICE, not DEBUG; DEBUG sits at the very bottom of Falco's scale, below INFORMATIONAL. Placing DEBUG third implies a severity drop, which violates the ascending progression required by the question.
- ✗
ALERT, CRITICAL, ERROR, WARNING
Why it's wrong here
This is the descending order: ALERT is extremely severe, followed by CRITICAL, then ERROR, then WARNING, which is the least severe of the four. The question asks for ascending order, so listing from higher to lower reverses the required progression entirely.
- ✓
NOTICE, WARNING, ERROR, CRITICAL
Why this is correct
Starting from NOTICE, then WARNING, ERROR, and CRITICAL, this is a valid ascending slice of Falco's priority hierarchy. It omits lower levels like DEBUG and INFORMATIONAL and the higher ALERT/EMERGENCY, but the relative ordering among the listed levels is perfectly correct.
About these practice questions
One of 845 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.