The correct answer is Authenticate and authorize workloads inside pods to access the Kubernetes API.

A service account is a Kubernetes identity that represents processes running in pods. It provides credentials such as tokens that pods use to authenticate to the Kubernetes API and it works with Role Based Access Control to determine what the workload is authorized to do.

Define network traffic rules for pods and services is incorrect because network policies and service resources control traffic and not service accounts. Service accounts do not configure network rules.

Use Google Cloud IAM to manage external user access is incorrect because that describes cloud provider IAM and external user management. Kubernetes service accounts are cluster identities and are separate from Google Cloud IAM service accounts even though they can be integrated.

Encrypt communication between the control plane and worker nodes is incorrect because encryption and TLS between components are handled by certificates and API server and kubelet configuration. Service accounts do not perform that encryption.

Full AWS Practitioner Certification Question