Enforce custom admission and governance policies for Kubernetes resources is correct. Open Policy Agent is used inside clusters to evaluate admission requests and to enforce governance rules before resources are admitted into the API server.

OPA provides policy as code with the Rego language and it integrates with Kubernetes through admission webhooks or through projects like Gatekeeper. This lets platform teams codify rules about allowed images, required labels, resource limits, and other constraints so that noncompliant resources are blocked at admission time.

Cloud Monitoring is incorrect because monitoring systems collect metrics and logs and they do not act as a policy engine that evaluates and enforces admission or governance rules.

Directly modify Kubernetes resources and configurations is incorrect because OPA is primarily a decision point that evaluates requests and returns allow or deny outcomes. It is not a general configuration management tool that performs arbitrary changes across cluster resources.

Build container images for deployment is incorrect because creating container images is the responsibility of build and CI tools and not a policy engine. Image building is handled by tools like Docker, Kaniko, or CI pipelines and not by OPA.

Full AWS Practitioner Certification Question