A developer reports that pods in the 'frontend' namespace can no longer reach the 'backend-api' Service in the 'backend' namespace, though it worked yesterday. The Service has healthy endpoints and DNS resolves correctly. You notice a colleague recently applied a default-deny NetworkPolicy in the 'backend' namespace. Running 'kubectl exec' from a frontend pod shows connection timeouts to the backend pod IPs. What is the most likely cause and the correct fix?