Which Azure Policy for Kubernetes effect prevents pods that request privileged escalation from being admitted?

1. A Audit
2. ✓ B Deny (correct answer)
3. C Disabled
4. D AuditIfNotExists

Shortcut: The Deny effect rejects non-compliant resources at admission through the Gatekeeper webhook. Audit only records violations after the fact.