AZ-700 Question 239
Select 2You have deployed an Azure Storage account with a private endpoint in a virtual network. On-premises clients must download files from this Storage account using its private endpoint. You already created a Private DNS zone called 'privatelink.blob.core.windows.net.' Which two actions do you need to implement to ensure on-premises name resolution to the private endpoint for the Storage account?
- A
Link the Private DNS zone to the virtual network that hosts the private endpoint
- B
Enable a public DNS alias on the Storage account to resolve the private IP address
- C
Configure on-premises DNS or a DNS forwarder to forward queries to Azure DNS for the Private DNS zone
- D
Create a public A record in an internet-facing DNS zone mapping the Storage account� endpoint to the private IP address
Show answer and explanation
Correct answers: A, C
Explanation
When integrating Private Link and a private endpoint with DNS, the recommended practice is to create or use a Private DNS zone for the service FQDN (e.g., privatelink.blob.core.windows.net) and link it to the virtual network hosting the private endpoint. Additionally, on-premises DNS servers must forward queries for that Private DNS zone to the Azure environment (for example, through an Azure Private DNS Resolver or a custom DNS forwarder running in Azure) so that on-premises clients can properly resolve the private IP address. Refer to Microsoft Docs on 'Integrate your private endpoint with a private DNS zone' and 'Set up a private DNS resolver' for further details.
- A. Correct.
Correct. You must link the Private DNS zone (privatelink.blob.core.windows.net) with the virtual network where the private endpoint is deployed. This creates the necessary DNS record and ensures Azure VMs within that VNet can resolve the private endpoint� hostname to its private IP address.
- B. Incorrect.
Incorrect. A public DNS alias would direct traffic to an Azure public endpoint and wouldn�t help with routing traffic to the private IP addresses. Private endpoints are specifically designed to avoid publicly accessible endpoints.
- C. Correct.
Correct. On-premises DNS servers must be configured to forward queries for 'privatelink.blob.core.windows.net' to the Azure DNS zone (either via a custom DNS server in Azure or using Azure DNS Private Resolver). This ensures that the Storage account� private endpoint can be resolved from on-premises clients to the correct private IP address.
- D. Incorrect.
Incorrect. Creating a public A record pointing to the private IP address provides no direct benefit and can pose security risks. Private endpoints are meant for internal resolution only. Public DNS records for internal IP addresses are not a recommended approach.