Microsoft Certified Azure Solutions Architect Expert · Free Practice Question Hard
Question 16
A retail company has decided to implement a new cloud-native application in Azure Kubernetes Service, using Azure Container Registry and Docker Images. They plan to implement all the infrastructure using ARM templates, Azure DevOps Pipelines, and Helm Charts.
The primary business and security requirements for moving forward with Kubernetes implementation are as follows:
The solution must be cost-effective.
Pods should receive an IP address from a logically different address space than the node pool's subnet.
The solution should avoid IPv4 exhaustion due to planned growing traffic and new users.
For security reasons, the security consultants have requested NAT (Network Address Translation) between the workloads deployed in pods and other Azure components such as databases, key vaults, service buses, and Redis Cache.
Which Azure Kubernetes Networking Plugin would you recommend to meet these business and security requirements?
-
A
Kubenet
-
B
Application Gateway Ingress Controller
-
C
NGINX
-
D
CNI
Reveal correct answer
Correct answer: A
A. Kubenet is a simple and cost-effective networking plugin for Azure Kubernetes Service. It allows pods to receive IP addresses from a different address space than the node pool's subnet, helping to avoid IPv4 exhaustion. Additionally, Kubenet supports NAT (Network Address Translation) between workloads deployed in pods and other Azure components, meeting the security consultants' requirements.
B. Application Gateway Ingress Controller is primarily used for routing external traffic to Kubernetes services. While it can provide some networking capabilities, it is not specifically designed to meet the requirements of assigning IP addresses from a different address space, avoiding IPv4 exhaustion, and implementing NAT for security reasons in Azure Kubernetes Service.
C. NGINX is a popular web server and reverse proxy solution, but it is not a networking plugin specifically designed for Azure Kubernetes Service. It does not offer the necessary features to assign IP addresses from a different address space, avoid IPv4 exhaustion, or implement NAT between workloads and other Azure components in a Kubernetes environment.
D. CNI (Container Networking Interface) is a standard for networking in containerized environments, including Kubernetes. While CNI plugins can provide advanced networking capabilities, not all CNI plugins may meet the specific requirements of assigning IP addresses from a different address space, avoiding IPv4 exhaustion, and implementing NAT for security reasons in Azure Kubernetes Service. It is essential to choose a CNI plugin that supports these requirements.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
