フリー問題

問題文

A tracing policy for a runtime security agent attaches to a kernel function through the type format of the kernel rather than through a probe, which lets the program run from a trampoline and makes the call faster. What does the documentation say this choice costs the policy?

選択肢

1. The policy widens the actions able to change the outcome of a call, so it gains a third choice beside the two of the probe and keeps the older pair while the newer one settles.
2. The policy forfeits the actions able to change the outcome of a call, so it watches the function and reports on it while leaving the flow of the program untouched.
3. The policy delays the actions able to change the outcome of a call, so it queues them for the exit hook and records the arguments while the entry hook is running.
4. The policy retains the actions able to change the outcome of a call, so it pays for them with a longer path and copies the arguments while the trampoline runs.