How would you answer an interview scenario involving network policies in Container Security?

For an interview scenario involving network policies, I would first clarify the business goal, scale, constraints, and the failure or quality attribute the interviewer wants to explore. Kubernetes NetworkPolicy defines allowed network communication among pods, namespaces, and external destinations when supported by the CNI. In this scenario, only the API should reach the database namespace. Explain the policy model you would apply. For production, verify CNI support, start with default deny, add explicit required flows, test DNS and egress, and observe denied traffic. I would then explain the main alternatives and tradeoffs, identify likely failure modes, and describe how I would validate the solution through testing, observability, security controls, and recovery or rollback planning.