KCSA Platform Security Practice Question
You are configuring a runtime security agent that uses Falco to detect unexpected shell execution inside containers. The security rule triggers when a process spawns a shell binary (e.g., bash or sh) inside a container namespace. Which underlying Linux kernel mechanism allows Falco to detect this event with minimal overhead?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
eBPF system call tracing and kernel event capture
Falco uses kernel modules or eBPF probe drivers to capture system calls and event streams from the Linux kernel, matching them against a rules engine to detect anomalous behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Periodic polling of container logs using kubectl logs
Why it's wrong here
Polling container logs is slow, inefficient, and does not capture raw system call activity in real time.
- ✓
eBPF system call tracing and kernel event capture
Why this is correct
eBPF allows Falco to monitor system calls efficiently at the kernel level without performance penalties of context switching.
- ✗
Analyzing CoreDNS lookup history
Why it's wrong here
CoreDNS history tracks DNS requests, which is unrelated to container shell executions.
- ✗
Inspecting etcd database keys every second
Why it's wrong here
Etcd stores Kubernetes cluster state, not running container system calls or process executions.
About these practice questions
Courseiva writes every KCSA question from scratch — 320 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.