The correct answer is ClusterRole.

A ClusterRole is a cluster scoped RBAC object that defines a reusable set of permissions which can be applied across namespaces. You create the ClusterRole once to capture the permission set and then bind it to users or ServiceAccounts in each target namespace with namespaced bindings. This avoids duplicating the same Role in every namespace.

You can pair a ClusterRole with an ClusterRoleBinding to grant those permissions across the entire cluster, but that grants access to all namespaces and to cluster scoped resources which may be broader than you intend.

Role is namespaced and only holds permissions for a single namespace. To use a Role across several namespaces you would need to create one per namespace, so it does not satisfy the requirement to define the permissions once for multiple namespaces.

ClusterRoleBinding is a binding and not a permission definition. It associates subjects with a role at the cluster level and can grant access cluster wide, so it is not the object you create when you want to define a reusable permission set.

RoleBinding is a namespaced binding that associates a Role or a ClusterRole with subjects in a single namespace. You must create a separate RoleBinding in each namespace to apply the permissions there, so the binding itself is not the single object that defines the permissions.

Full AWS Practitioner Certification Question