You want a namespace to reject Pods that break the restricted profile, while also recording near-misses without blocking them. Which two Pod Security modes do you configure? Choose two.

Answer: A. enforce
B. audit

The three modes are enforce, which rejects, audit, which annotates the audit log, and warn, which warns the user. A namespace can set several at once, at different levels.

Source: Pod Security Admission (Kubernetes) — Pod Security Admission labels for namespaces