Exam SC-200 topic 4 question 22 discussion

LOG_DEAMON LOG_ERR The requirement to "collect only messages that have a priority level of critical" suggests an exact match for severity 2, but Syslog typically doesn’t support filtering to a single severity level—it collects a specified level and above (more severe). Given the options, none allow isolating only critical messages: LOG_EMERG misses critical entirely. LOG_ERR includes critical but also emergency, alert, and error. LOG_WARN and LOG_DEBUG include critical plus even more levels, increasing data volume. However, the second requirement, "minimize the volume of data collected," suggests selecting the option that reduces unnecessary messages while still capturing critical ones. Since LOG_CRIT isn’t available, LOG_ERR is the closest option that includes critical (severity 2) as part of its range (0–3). While it collects extra levels (emergency, alert, error), it excludes less severe levels (warning, notice, info, debug) compared to LOG_WARN or LOG_DEBUG, thus reducing data volume relative to those options.

DAEMON and EMERG are correct per GPT4

I would say LOG_DAEMON & LOG_EMERG. The question is stating that App1 runs as a background process. Therefore LOG_DAEMON would make sense.