Which AKS network model minimizes VNet IPs and supports Windows?
Short answer
B Recommend Azure CNI Overlay, which assigns pods from a separate pod CIDR so only nodes consume the 172.16.0.0/16 VNet space while supporting Windows node pools and outbound ExpressRoute connectivity to on-premises.
Question
You have multiple Azure subscriptions. Each subscription contains a virtual network that is assigned an IP address space of 172.16.0.0/16. Each virtual network is connected to the on-premises networks by using ExpressRoute.
You plan to deploy a container orchestration solution that will use multiple Azure Kubernetes Service (AKS) clusters. The clusters will be deployed to the existing virtual networks.
You need to recommend a network configuration for the AKS clusters. The solution must meet the following requirements:
• Minimize the number of IP addresses required on each virtual network.
• Support outbound connectivity to on-premises datacenters.
• Support Windows node pools.
Which AKS network model should you recommend?
Key Takeaways
The question tests the boundary between Azure CNI pod IPs taken from the VNet subnet and Azure CNI Overlay pod IPs taken from a separate pod CIDR; the trap is choosing an IP-saving option such as kubenet without checking Windows node pool support.
Azure CNI Overlay is the AKS network model that minimizes virtual network IP consumption by assigning pods addresses from a separate pod CIDR. This page confirms option B and explains why kubenet and traditional Azure CNI fail the stated requirements.
Common mistake: The most plausible wrong answer is C, kubenet, because it also conserves VNet IP addresses; however, kubenet is the legacy AKS networking option and is not supported for Windows node pools, so it fails a hard requirement.
Expert Analysis
Boundary to decide first: VNet-routable pod IPs vs a separate pod CIDR
Traditional Azure CNI (D) allocates every pod an IP address from the node subnet inside the 172.16.0.0/16 VNet. That makes pods directly addressable, but with multiple AKS clusters in existing VNets it consumes VNet addresses rapidly and strains the shared address plan. Azure CNI Overlay (B) is on the other side of that boundary: nodes still take VNet IPs, while pods are assigned from a separate pod CIDR that is not routable on the VNet. The supplied comment makes the right distinction—overlay avoids giving each pod a VNet IP.
Why outbound ExpressRoute still works
The requirement is outbound connectivity to on-premises datacenters, not direct on-premises-to-pod initiation. With Azure CNI Overlay, pod egress to on-premises is SNATed through the node's VNet IP, so ExpressRoute can carry the traffic. The separate pod CIDR therefore does not disqualify option B; if direct inbound pod reachability were required, traditional Azure CNI or an ingress/load-balancer path would be needed.
Windows and the remaining options
Windows node pools rule out kubenet (C), even though kubenet also conserves VNet IPs. Azure CNI Powered by Cilium (A) is a dataplane and network-policy choice rather than the model that minimizes VNet IP consumption here, and it is not the intended fit for Windows pools in this scenario. D fails the minimize-IP requirement. Therefore B is the answer.
Official Reference
- https://learn.microsoft.com/en-us/azure/aks/azure-cni-overlay
- https://learn.microsoft.com/en-us/azure/aks/concepts-network
- https://learn.microsoft.com/en-us/azure/aks/configure-kubenet
These links open the official vendor documentation in a new tab.
Exam Strategy
For AKS networking questions, first separate direct pod routability from outbound-only connectivity. If the stem stresses VNet IP conservation and only outbound access to on-premises, eliminate traditional Azure CNI immediately. Then use a hard platform constraint—here Windows node pools—to eliminate IP-saving options that do not support it, leaving Azure CNI Overlay. Reserve Azure CNI when pods must be directly reachable from the VNet or on-premises without SNAT or an ingress tier.
Frequently Asked Questions
Does Azure CNI Overlay support direct inbound connections from on-premises to pod IPs?
Why is kubenet not the answer if it also reduces VNet IP usage?
Does Azure CNI Powered by Cilium solve the VNet IP consumption requirement?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
gpais 👍 1 Answered BAzure CNI Overlay. Unlike traditional Azure CNI—which allocates a dedicated IP address directly from your VNet subnet to every single Pod—Azure CNI Overlay hosts Pods on a completely separate private internal address space (pod-cidr). This saves thousands of VNet IP addresses since only the cluster nodes consume actual IPs from your VNet subnet.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →