A. Incorrect.
Pods, Services, and Ingresses are Kubernetes resources, but the phrasing mixes resources and components. Ingress behavior is normally implemented by a separate Ingress controller, not by kube-controller-manager itself.

B. Correct.
kube-controller-manager runs core reconciliation loops such as the Replication, Endpoints, Namespace, and ServiceAccount controllers. These controllers continually move cluster state toward the desired state stored in the API server.

C. Incorrect.
ConfigMaps and Secrets are API resources, but they are not usually described as dedicated kube-controller-manager controllers. kube-proxy is a node networking component, not a controller inside kube-controller-manager.

D. Incorrect.
Container runtime, CNI, and CSI node operations are handled by node-level components and plugins rather than kube-controller-manager core controllers.

A. Incorrect.
This reverses the technologies. Firecracker is the microVM virtualization technology; gVisor is the user-space kernel approach.

B. Incorrect.
They both improve isolation, but they use different mechanisms and have different operational and performance tradeoffs.

C. Incorrect.
Admission controllers can enforce image-signature policy, but gVisor and Firecracker are workload isolation technologies, not image-signature validators.

D. Correct.
gVisor adds an application-kernel boundary by handling many syscalls in user space. Firecracker uses hardware virtualization through KVM to run small microVMs, a pattern used for strong multi-tenant isolation.

A. Incorrect.
A validating webhook can accept or reject the request, but it should not mutate the object. Mutation must happen in the mutating admission phase.

B. Incorrect.
kube-apiserver does not provide a simple built-in flag that maps app labels to runtimes. Runtime selection is expressed in the Pod spec and can be automated through admission.

C. Correct.
A mutating admission webhook can modify an object before it is persisted. It can set runtimeClassName when a Pod has the payment application label.

D. Incorrect.
Manual changes are unreliable, slow, and may happen too late. Security controls should be enforced consistently during admission.

A. Correct.
PodSecurity admission is built into modern Kubernetes and enforces Pod Security Standards at the namespace level by using labels for enforce, audit, and warn modes.

B. Incorrect.
PodSecurityPolicy was deprecated and removed from Kubernetes. It is the predecessor to Pod Security Standards, not the current built-in enforcement mechanism.

C. Incorrect.
NetworkPolicy controls network traffic. It does not enforce fields such as privileged containers, hostPath usage, or privilege escalation.

D. Incorrect.
RuntimeClass selects a runtime handler. It can help with isolation, but it does not enforce the complete Pod Security Standards.

A. Incorrect.
Base64 does not use keys at all. It is not a cryptographic protection mechanism.

B. Incorrect.
The issue is not a length limitation; the issue is that base64 provides no confidentiality.

C. Incorrect.
etcd encryption at rest is a separate Kubernetes configuration that can protect stored Secret data. Base64 does not prevent it.

D. Correct.
Base64 only changes the representation of the data. A user or attacker with access to the Secret object can decode it easily, so encryption at rest and strict RBAC are still needed.

A. Incorrect.
PodSecurity admission controls Pod security fields. It does not decide whether a service account may list Secrets through the API.

B. Correct.
RBAC controls which API verbs a user, group, or service account can perform on Kubernetes resources. Least-privilege Roles and RoleBindings reduce the damage from a stolen token.

C. Incorrect.
NetworkPolicy can restrict network traffic, but it does not authorize Kubernetes API actions.

D. Incorrect.
RuntimeClass affects which runtime handler starts a Pod. It does not grant or deny API permissions.

A. Incorrect.
Pod Security Standards restrict risky Pod fields, but they do not verify image signatures.

B. Incorrect.
PodSecurityPolicy is removed and did not provide native image-signature verification.

C. Correct.
Image-signature enforcement is commonly implemented with admission policy, for example through a validating webhook integrated with tools such as Sigstore cosign, Kyverno, or OPA Gatekeeper.

D. Incorrect.
Services route traffic to Pods. They do not validate container image provenance.

A. Correct.
RequestResponse is very verbose because it logs request and response bodies. It can increase storage, add overhead, and expose sensitive content if audit policy is too broad.

B. Incorrect.
Audit logs are designed to include useful request metadata such as user, verb, resource, and stage depending on the policy.

C. Incorrect.
Audit policy affects logging. It does not disable authorization.

D. Incorrect.
Auditing API requests and enforcing Pod network traffic are separate concerns.

A. Incorrect.
The scheduler chooses nodes for Pods; it does not enforce NetworkPolicy traffic rules.

B. Incorrect.
NetworkPolicy applies based on Pod selectors, namespaces, ports, and peers, not whether a process runs as root.

C. Incorrect.
RBAC controls who can create or modify policies. It is not the packet enforcement mechanism.

D. Correct.
Kubernetes defines the NetworkPolicy API, but enforcement depends on the CNI/network plugin. If the plugin does not implement NetworkPolicy, the objects may have no traffic effect.

A. Incorrect.
/etc/kubernetes is commonly found on control plane nodes, not as the default client kubeconfig location.

B. Correct.
kubectl looks for kubeconfig at $HOME/.kube/config by default. That file can contain cluster endpoints, client certificates, tokens, and other sensitive access information.

C. Incorrect.
/opt/kubernetes/secrets is not the standard kubectl credential path.

D. Incorrect.
$HOME/.config/kubernetes is not the default kubeconfig directory used by kubectl.