AZ-700 Question 242
Select 2Contoso has deployed a custom application behind a Private Link service in Azure. The on-premises network connects to Azure via ExpressRoute, and you need on-premises clients to resolve and connect privately to this application. However, on-premises users report they cannot reach the application. Which two actions should you take to ensure successful end-to-end connectivity from on-premises clients to the Private Link service?
- A
Create a private DNS zone in Azure and link it to the virtual network hosting the Private Link service, then configure your on-premises DNS server to forward queries to the Azure DNS zone.
- B
Enable a service endpoint for the Azure resource on the same subnet as the Private Link service.
- C
Configure a user-defined route in the appropriate subnet to ensure on-premises traffic destined for the Private Link IP is routed through the ExpressRoute gateway.
- D
Manually add local hosts file entries on each on-premises client to point to the Private Link IP address.
- E
Use a public DNS record that resolves to the private IP address of the Private Link service.
Show answer and explanation
Correct answers: A, C
Explanation
To integrate a Private Link service with on-premises clients, you must ensure that on-premises traffic is routed over the private connection (ExpressRoute or VPN) and that name resolution points to the Private Link IP rather than a public endpoint. Creating a private DNS zone in Azure, linking it to the VNet, and forwarding on-prem DNS queries to that zone is the recommended way to resolve the private domain name. You also need to configure routes so that on-premises traffic is directed to Azure over the private connection. Reference: Microsoft documentation on 'Integrate your private endpoint with on-premises DNS' and 'Network configuration considerations for Private Link.'
- A. Correct.
Correct. Private Endpoint connections require proper DNS resolution. Creating a private DNS zone and linking it to the virtual network allows Azure VMs to resolve the service privately. On-premises DNS servers must forward queries to this private DNS zone or otherwise be configured to resolve the private zone.
- B. Incorrect.
Incorrect. Service endpoints are not required for Private Link. Service endpoints allow traffic from a subnet to specific Azure services without traversing the public Internet, but they are different from Private Link mechanisms.
- C. Correct.
Correct. On-premises traffic must be routed to the private IP in Azure via ExpressRoute. A user-defined route (UDR) ensures the correct next hop (the ExpressRoute gateway) for traffic destined for the private IP subnet.
- D. Incorrect.
Incorrect. While editing hosts files can technically resolve the name, it is not a best practice and does not scale. Proper DNS zone configuration should be used instead.
- E. Incorrect.
Incorrect. Private Link endpoints do not use publicly resolvable IP addresses. Rather, the point is to keep traffic internal over Private Link. A public DNS record would violate the principle of private connectivity.