You need to block all ingress traffic to pods in a namespace except from pods labelled app=frontend. Which resource do you use?

1. A Azure Firewall rule
2. ✓ B Kubernetes NetworkPolicy with a podSelector-based ingress rule (correct answer)
3. C Network Security Group on the node subnet
4. D Ingress controller annotation

Shortcut: NetworkPolicy operates on pod labels inside the cluster and requires a supporting network plugin such as Azure NPM or Calico. NSGs work at subnet level and cannot express pod-to-pod identity.