AZ-700 Question 241
Single answerYour company hosts a web application in Azure and has created a Private Endpoint for this application. You have on-premises clients that must securely connect over a site-to-site VPN without exposing the application publicly. After setting up the Private Endpoint, you need to ensure that on-premises clients resolve the application's DNS name to the private IP address rather than the public endpoint. Which of the following approaches correctly configures name resolution for these on-premises clients?
- A
Configure your on-premises DNS server to forward queries for the application� fully qualified domain name (FQDN) to an Azure Private DNS zone configured for the Private Endpoint.
- B
Enable DDoS Protection Standard on the virtual network where the Private Endpoint resides to automatically direct traffic to the private IP address.
- C
Manually add a DNS A record for the application� FQDN in a public DNS zone that resolves to the private IP address of the Private Endpoint.
- D
Use public DNS resolvers and rely on Azure's default public resolution, expecting the query to route traffic over the private link.
Show answer and explanation
Correct answer: A
Explanation
When integrating a Private Link service with on-premises clients, you must ensure the FQDN resolves to the Private Endpoint IP rather than the public IP. The best practice is to configure on-premises DNS servers with a conditional forwarder or a stub zone pointing to an Azure Private DNS zone or a custom DNS server in Azure that has the correct private DNS records. This ensures traffic remains on the private network path. For more information, refer to Microsoft� documentation on Private Endpoint DNS configuration (https://learn.microsoft.com/azure/private-link/private-endpoint-dns).
- A. Correct.
Option 1 is correct. In an on-premises-to-Azure Private Link scenario, you must configure DNS so that the application� FQDN resolves to the Private Endpoint IP address. A common approach is to use conditional forwarding or a stub zone on your on-premises DNS server pointing to Azure Private DNS or a custom DNS solution in Azure, ensuring secure name resolution over the site-to-site VPN.
- B. Incorrect.
Option 2 is incorrect. Enabling DDoS Protection Standard helps protect resources from distributed denial of service attacks but does not direct DNS queries to the private IP address. It� unrelated to DNS routing.
- C. Incorrect.
Option 3 is incorrect. Public DNS entries do not resolve to private IP addresses, and adding a private IP to a public DNS zone is not supported in a Private Endpoint scenario. This approach would not allow on-premises DNS queries to properly resolve the private IP via a secure tunnel.
- D. Incorrect.
Option 4 is incorrect. Using public DNS resolvers will return the public IP address, not the private endpoint IP. You must specifically configure DNS resolution so that on-premises queries point to the private IP of the endpoint.