AZ-700 Question 25
Single answerYou have an Azure environment with two virtual networks, VNetA and VNetB, which are peered. A domain controller (DC) in VNetA provides DNS services for your internal Active Directory environment. VNetB hosts application servers that need to resolve hostnames from VNetA. Currently, VNetB is using the Azure-provided DNS server (168.63.129.16) for name resolution. After configuring network peering, you notice that VNetB cannot resolve any internal hostnames in VNetA. Which action should you take to enable name resolution for the application servers in VNetB?
- A
A. Configure VNetB to use an Azure Private DNS zone and add CNAME records pointing to the DC in VNetA.
- B
B. Update VNetB� DNS server settings to specify the DC� private IP as its custom DNS server.
- C
C. Enable forwarding from the Azure-provided DNS server (168.63.129.16) to VNetA� DC IP address.
- D
D. Create a service endpoint for DNS on both VNetA and VNetB subnets.
Show answer and explanation
Correct answer: B
Explanation
When multiple virtual networks are peered in Azure, DNS server settings do not automatically propagate between them. If you rely on a domain controller for DNS, you must configure the VNet to use that DC� IP as the custom DNS server. In this scenario, modifying VNetB� DNS server setting to point to the DC in VNetA is the correct solution. Refer to Microsoft's documentation on 'Name resolution for resources in Azure virtual networks' (https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances) for detailed guidance on configuring custom DNS in peered VNets.
- A. Incorrect.
A. Configuring an Azure Private DNS zone with CNAME records does not automatically forward DNS queries to the DC. Private DNS zones manage name resolution for hostnames but do not forward requests to custom DNS servers like a domain controller. This alone would not resolve the issue unless the application servers explicitly used the Private DNS zone for their domain queries, which is not the scenario described.
- B. Correct.
B. Correct. Since VNetB needs to resolve hostnames that the DC in VNetA manages, you must configure the custom DNS server setting in VNetB to point to the DC� private IP. Peering does not automatically share DNS server settings, so you must explicitly configure VNetB to use the DC for DNS resolution. Also ensure the peering is configured to allow forwarded traffic, if necessary.
- C. Incorrect.
C. Azure-provided DNS (168.63.129.16) does not allow you to configure custom forwarders that point to on-premises or even another virtual machine� IP. You cannot enable custom forwarding rules on the Azure-provided DNS service. This option is not viable.
- D. Incorrect.
D. DNS does not support Azure service endpoints. Service endpoints are used for directing VNet traffic to specific Azure services like storage or SQL Database. They are not a mechanism for name resolution to a domain controller.