フリー問題

問題文

A team assumes that because the platform is built on eBPF, every layer of enforcement runs in the kernel. Which correction applies?

選択肢

1. Application protocols are parsed by a proxy in user space, so the top layer does not run in the kernel.
2. The identity lookup is performed in user-space, so the layer that resolves labels to a number sits outside the kernel.
3. Everything does run in the kernel.
4. Connection tracking is performed in user-space, because the state that has to be kept for each connection exceeds what a program in the kernel is permitted to allocate and therefore has to be held by a component outside it.