A platform team wants deep visibility into process execution, system calls and network connections on its Linux workload hosts, but the operations group refuses to load third-party kernel modules because a faulty module can crash the kernel. Which technology fits this requirement?
Select an answer to reveal the explanation.
Short Explanation
eBPF is like giving a visitor a badge that only opens certain doors, after security has checked their bag. The kernel's verifier checks every eBPF program before it runs, so you get kernel-level visibility without the risk of a rogue module. The trap is the signed module — signing proves who wrote it, not that it can't crash your box.
Full Explanation
eBPF lets small programs run inside the Linux kernel, attached to hooks such as system call entry points, tracepoints, kprobes and networking paths, without changing kernel source or loading kernel modules. Before any program is loaded, the kernel's verifier checks it for safety, for example that it terminates and accesses memory only in permitted ways, and the program runs in a restricted, sandboxed context. Data can be shared with user space through maps, which gives security tools rich, low-overhead visibility into process execution, system calls and network activity, and some can enforce policy as well. A signed loadable kernel module still runs with full kernel privileges and no verifier; signing establishes origin, not safety, so a bug can still crash the host, which is exactly the operations group's concern. A user-space agent that parses logs on a schedule is safe but delayed and incomplete, because many process and network events are never written to logs. Rebuilding the kernel with auditing patches is operationally heavy, ties the fleet to a custom kernel, and still embeds unverified code in kernel space. Exam caveat: eBPF reduces risk but is not risk-free; it requires a reasonably recent kernel and appropriate privileges to load programs. Operational check: confirm the kernel version supports the required program types and that the sensor reports events without any out-of-tree modules loaded.