AZ-700 Question 240
Select 2You are a network engineer for Contoso. You have an Azure Storage account configured with a private endpoint in a dedicated VNet. On-premises clients connect to that VNet via ExpressRoute, and you need to ensure that all on-premises traffic to the Storage account is routed through the private endpoint without exposing a public IP. Which two actions should you take to configure DNS name resolution for the private endpoint?
- A
Create a private DNS zone named 'privatelink.blob.core.windows.net' and link it to the VNet hosting the private endpoint.
- B
Configure conditional forwarding on your on-premises DNS servers so that DNS queries for 'privatelink.blob.core.windows.net' are sent to a DNS solution in Azure that hosts the private DNS zone.
- C
Disable the public DNS resolution for the Storage account from the Azure portal to force name resolution through the private zone only.
- D
Create a private DNS zone named 'contoso.local' in Azure and assign an A record pointing the Storage account� domain to the private endpoint IP.
- E
Create an A record in a public DNS zone mapping your Storage account� host name to the private IP address assigned in your Azure VNet.
Show answer and explanation
Correct answers: A, B
Explanation
To integrate Private Link with DNS, Microsoft recommends creating a private DNS zone matching the Azure service domain and linking it to the VNet that hosts the private endpoint. For on-premises clients to resolve private endpoints correctly, configure conditional forwarding or a similar mechanism so that queries for the service domain are directed to the private DNS zone. See Microsoft Docs (https://learn.microsoft.com/azure/private-link/private-endpoint-dns) for detailed guidance on private endpoint DNS integration.
- A. Correct.
Option 1 is correct. You need an Azure private DNS zone that matches the service� DNS domain (e.g., 'privatelink.blob.core.windows.net') to properly resolve the Storage account's name to the private endpoint IP. Linking this zone to the VNet ensures Azure resources within that VNet can automatically resolve the private endpoint.
- B. Correct.
Option 2 is correct. On-premises DNS servers must forward queries for the private endpoint domain (e.g., 'privatelink.blob.core.windows.net') to a DNS resolver (Azure or custom DNS) that knows about the private DNS zone. This lets on-premises clients resolve the Storage account name to its private IP in Azure.
- C. Incorrect.
Option 3 is incorrect. You cannot simply disable public DNS resolution in the Azure portal. While private endpoints restrict public network access, the public DNS entries for *.blob.core.windows.net still exist. You must override them at your own DNS servers or use private DNS zones to redirect requests to the private IP.
- D. Incorrect.
Option 4 is incorrect. Using 'contoso.local' does not align with the actual storage service domain name. You must use the correct private DNS zone for Azure services (e.g., 'privatelink.blob.core.windows.net') to ensure proper resolution.
- E. Incorrect.
Option 5 is incorrect. Publishing private IP addresses in a public DNS zone is not a Microsoft best practice. It can lead to potential routing and security issues, and does not provide the correct DNS integration for private endpoints.