An organization's security architecture team is designing a secure AI inference infrastructure where the AI model inference API must only be accessible to a specific set of microservices within a Kubernetes cluster, and not to any other workloads. Which Zero Trust network control pattern achieves this microsegmentation?

B is correct because Kubernetes Network Policies provide pod-level microsegmentation within a cluster. By defining an egress policy that allows only pods with specific labels (the authorized microservice pods) to reach the AI inference endpoint IP/FQDN, all other pods in the cluster are blocked from accessing the AI service—even on the same node or namespace. This implements Zero Trust at the workload level. D is also partially correct (private endpoint restricts access to the subnet), but within the subnet all pods can still reach the private endpoint unless Kubernetes Network Policies are also applied. A is wrong because Azure Firewall with FQDN rules applies to traffic leaving the VNet, not to intra-cluster pod-to-pod or pod-to-endpoint restrictions. C is wrong because an NSG on the subnet restricts access to that subnet broadly but cannot differentiate between individual pods within the same subnet.