When ordering these tests in an event rule, which of them is the best test to place at the top of the list for rule performance?

exams C1000-018 C1000-018 exam 0 Comments

When ordering these tests in an event rule, which of them is the best test to place at the top of the list for rule performance?
A . When the source is [local or remote]
B . When the destination is [local or remote]
C . When the event(s) were detected by one or more of [these log sources]
D . When an event matches all of the following [Rules or Building Blocks]

Answer: A