When ordering these tests in an event rule, which of them is the best test to place at the top of the list for rule performance?

When ordering these tests in an event rule, which of them is the best test to place at the top of the list for rule performance?
A . When the source is [local or remote]
B . When the destination is [local or remote]
C . When the event(s) were detected by one or more of [these log sources]
D . When an event matches all of the following [Rules or Building Blocks]

View Answer

Answer: A