The correct answer is Pod security policy and Security context.

Security context is configured on pods and containers and it controls Linux capabilities and user settings. You can explicitly drop capabilities such as NET_ADMIN and NET_RAW or prevent containers from running as root to stop root level network operations at the runtime level.

Pod security policy is a cluster admission control that enforces pod level security constraints and it can require that containers do not request or add forbidden capabilities. This makes it useful to prevent any pod from obtaining network related capabilities across the cluster. Note that Pod security policy has been deprecated in upstream Kubernetes and removed in recent releases so newer clusters and exams often prefer Pod Security Admission or policy controllers like OPA Gatekeeper for the same purpose.

NetworkPolicy controls network traffic flow between pods and namespaces and it does not control Linux capabilities or whether a container can gain NET_ADMIN or NET_RAW. It cannot prevent a container from adding kernel capabilities.

GKE Workload Identity maps Kubernetes service accounts to Google service accounts to manage cloud permissions and it does not manage container runtime capabilities or kernel level network privileges.

Role Based Access Control governs API access and who can create or modify Kubernetes objects and it does not enforce runtime constraints inside containers such as dropping capabilities.

Full AWS Practitioner Certification Question