Divide pods services and other resources into distinct virtual clusters inside a single physical cluster is correct.

namespaces partition the Kubernetes API space so that pods services and other objects can live in separate logical groups inside the same physical cluster. This creates isolated virtual clusters that prevent name collisions and provide a clear scope for resources.

namespaces are the mechanism on which per namespace resource quotas and network policies are applied, but their primary role is the logical division of the cluster into virtual clusters rather than being those policies themselves.

Segment resources to apply per team resource quotas and network policies is misleading because it describes useful capabilities that run inside namespaces but it frames those capabilities as the primary purpose. The core purpose is creating distinct virtual clusters and quotas and policies are applied within that scope.

Keep individual nodes isolated so they do not share underlying resources is incorrect because namespaces are a logical construct and do not isolate or partition nodes. Node level isolation and resource boundaries are handled by node configuration scheduling taints and similar features.

Enforce cluster wide authentication and authorization at the top level is wrong because authentication and authorization are handled by the API server and systems like RBAC. Namespaces help scope permissions but they do not implement cluster wide auth mechanisms themselves.

Full AWS Practitioner Certification Question