D) Kubernetes Admission Controller To block privileged containers before they are executed, CrowdStrike recommends deploying the Kubernetes Admission Controller. This component operates at admission time, intercepting Kubernetes API requests and enforcing security policies before workloads are allowed to run. Privileged containers represent a significant security risk because they can bypass isolation boundaries and access host resources. The Kubernetes Admission Controller can enforce policies that explicitly deny deployments using privileged flags, hostPath mounts, or other high-risk configurations. Other options do not provide enforcement. Runtime sensors and agents can detect or alert on risky behavior after execution, but they cannot prevent the workload from starting. Image assessment evaluates image content but does not enforce Kubernetes runtime constraints. Therefore, to proactively block privileged containers, the correct and CrowdStrike-recommended solution is the Kubernetes Admission Controller.

A) Kubernetes Protection Agent

B) Kubernetes Sensor

C) Kubernetes Image Assessment at Runtime