AZ-104 practice question 5 of 35

You have an Azure subscription. You plan to deploy an Azure Kubernetes Service (AKS) cluster to support an app named App1. On-premises clients…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Implement and manage virtual networking

You have an Azure subscription. You plan to deploy an Azure Kubernetes Service (AKS) cluster to support an app named App1. On-premises clients connect to App1 by using the IP address of the pod. For the AKS cluster, you need to choose a network type that will support App1. What should you choose?

Answer options

Correct Answer:

Explanation

The core requirement is that on-premises clients must be able to connect directly to a pod's

IP address. This is only possible if the pods receive IP addresses that are routable within

the larger network, including the on-premises environment connected via VPN or

ExpressRoute. The Azure Container Networking Interface (CNI) network plugin achieves

this by assigning each pod an IP address directly from the virtual network's subnet. These

IPs are unique and directly addressable, fulﬁlling the requirement.

Why Incorrect

A. kubenet: With kubenet, pods receive IPs from a logically separate address space and

use Network Address Translation (NAT) to communicate, hiding the pod's actual IP behind

the node's IP. This prevents direct connectivity.

C. Hybrid Connection endpoints: This is a feature of Azure App Service and Functions used

for connecting from Azure to on-premises resources. It is not a network model for an AKS

cluster.

D. Azure Private Link: This service provides private connectivity to an endpoint representing

a service (like an internal load balancer), not to individual pod IPs. It is a method to expose

a service, not a fundamental cluster network type.

References

1. Microsoft Azure Documentation: "Concepts - Networking in Azure Kubernetes Services

(AKS)". This document explicitly compares kubenet and Azure CNI. It states, "With Azure

CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP

addresses must be unique across your network space... This network model allows for

more separation of control and management of resources."

URL: https://learn.microsoft.com/en-us/azure/aks/concepts-network#compare-networkmodels

2. Microsoft Azure Documentation: "Conﬁgure Azure CNI networking in Azure Kubernetes

Service (AKS)". This source details the functionality of Azure CNI. It conﬁrms, "Each pod

receives an IP address in the virtual network subnet. Pods can communicate with other

pods in the virtual network and on-premises networks."

URL: https://learn.microsoft.com/en-us/azure/aks/conﬁgure-azure-cni

Question 5 of 35

Question breakdown

Tests: Configure AKS networking
Difficulty: Easy

Key idea: Azure CNI gives each pod an IP address from the VNet subnet, so the pod is directly routable from connected networks such as on-premises.

How to reach the answer

Clue: on-premises clients connect using the pod's IP address, so pod IPs must be routable outside the cluster.
kubenet places pods on a separate overlay range and NATs their traffic behind the node IP, so pods are not directly reachable.
Azure CNI assigns pods real VNet addresses that can be reached over VPN or ExpressRoute.
Hybrid Connections and Private Link are not AKS network plugins, which eliminates them.

Each option

AIncorrect. kubenet hides pod IPs behind NAT on the node, so on-premises clients cannot reach pods directly.
BCorrect. Azure CNI gives pods VNet-routable IPs that on-premises clients can reach directly.
CIncorrect. Hybrid Connections is an App Service/Functions feature for reaching on-premises endpoints, not an AKS network model.
DIncorrect. Private Link exposes a service through a private endpoint; it does not provide direct pod IP addressing or act as a cluster network type.

Common trap: kubenet is the simpler default and saves IP space, so candidates pick it without noticing it NATs pod traffic.

In practice: Choosing between kubenet, Azure CNI, and CNI Overlay is a design-time decision that affects IP planning. It matters most when legacy clients or firewalls need to reach pod IPs directly.

Remember: If anything outside the cluster must reach pod IPs directly, choose Azure CNI (VNet-assigned pod IPs).

Official documentation: Network concepts for applications in AKS · Configure Azure CNI networking in AKS

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free AZ-104 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test