Your company has an Azure subscription containing a virtual network named VNet1 (10.150.0.… — Microsoft Azure Administrator (AZ-104)

Your company has an Azure subscription containing a virtual network named VNet1 ( $10.150.0.0/16$ ). VNet1 contains a subnet named Subnet1 ( $10.150.1.0/24$ ). You need to deploy a new Azure Kubernetes Service (AKS) cluster named AKS1 to run a microservices application. The deployment must meet the following requirements:
- The cluster must support a system node pool that can scale up to a maximum of 10 nodes.
- Each node in the system node pool must support up to 30 pods.
- The IP addresses for the pods must be routable directly within VNet1 without using Network Address Translation (NAT).
- The cluster API server must not be exposed to the public internet, and must be accessible only from VNet1 and peered networks.
- You must minimize administrative effort for DNS resolution of the API server.

Which two configurations should you perform? (Select two.)

A
Deploy AKS1 to Subnet1 and configure it to use the Kubenet network plugin.
Create a new subnet in VNet1 with an address prefix of 10.150.2.0/23 and deploy AKS1 using the Azure CNI network plugin.Answer
Enable the private cluster feature and configure the cluster to use a system-assigned private DNS zone.Answer
D
Enable the private cluster feature and deploy a custom Azure Private DNS zone named privatelink.eastus.azmk8s.io.
E
Deploy AKS1 to Subnet1 and configure it to use the Azure CNI network plugin.

Answer

Create a new subnet in VNet1 with at least a /23 address prefix, configure it with the Azure CNI network plugin, enable the private cluster feature, and configure the cluster to use a system-assigned private DNS zone.

The correct configurations are to create a new subnet in the virtual network with at least a /23 address prefix using the Azure CNI plugin, and to enable the private cluster feature with a system-assigned private DNS zone. Azure CNI assigns IP addresses to pods directly from the VNet subnet, which requires a minimum of

(10 \text{ nodes} + 1 \text{ upgrade node}) \times (30 \text{ pods} + 1) + 5 \text{ reserved IPs} = 346

IPs. Since a /24 subnet only offers 251 usable IPs, a /23 subnet (507 usable IPs) is required. Enabling a private cluster secures the API server, and a system-assigned private DNS zone minimizes administration compared to manual DNS zone creation.

Step-by-Step Solution

Calculate the required number of IP addresses for the Azure CNI network plugin.

The minimum number of IP addresses required is calculated as

(N + S) \times (P + 1) + 5

, where

N

is the maximum number of nodes (

10

S

is the max surge nodes (

1

for rolling upgrades), and

P

is the maximum number of pods per node (

30

). This equals

(10 + 1) \times (30 + 1) + 5 = 346

IP addresses.

Azure CNI pre-allocates an IP address for each node and each pod from the subnet, plus 5 reserved IPs for Azure services.

Select the appropriate subnet size.

A /24 subnet provides 256 IP addresses (251 usable), which is insufficient. A /23 subnet provides 512 IP addresses (507 usable), which accommodates the 346 required IP addresses.

To avoid IP address exhaustion during operations and upgrades, the subnet prefix must be at least /23.

Evaluate the routing requirement.

Azure CNI must be used because it assigns VNet-routable IP addresses directly to pods without requiring NAT. Kubenet uses NAT for pod-to-pod communication outside the node.

Direct routability within VNet1 without NAT is a strict requirement.

Select the private cluster and DNS configuration.

Enable the private cluster feature to secure the API server behind a Private Endpoint, and configure it to use a system-assigned private DNS zone.

This isolates the API server from the public internet and minimizes administrative effort by letting Azure automatically manage the private DNS zone life cycle.

Key Concept

Azure CNI IP addressing requirements and private AKS cluster DNS configuration.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic