An admin jump tool Pod should accept SSH-like traffic on TCP 2222 only from the trusted CIDR 203.0.113.0/24. Which NetworkPolicy peer fits that ingress allow?
Select an answer to reveal the explanation.
Short Explanation
You want a velvet rope that only the trusted street range can pass—and only on the jump port. That’s an ingress ipBlock for 203.0.113.0/24 on TCP 2222 aimed at the jump Pod. Opening the world and excepting the trusted range would do the opposite.
Full Explanation
Ingress peers may use ipBlock to allow traffic from specific CIDRs. Selecting the jump Pods and allowing ingress from 203.0.113.0/24 on TCP/2222 matches the requirement. An egress rule does not admit inbound clients; kube-system-only allows are unrelated; and excepting the trusted CIDR from 0.0.0.0/0 excludes that range rather than permitting it.