AZ-700 Question 26
Select 2You work for Contoso Pharmaceuticals, which maintains an on-premises Windows-based DNS server authoritative for the contoso.local domain. You have two virtual networks (VNETs) in Azure (WestEurope-VNet and EastUS-VNet) that need to resolve internal hostnames under contoso.local, and on-premises clients must also resolve newly created private endpoints in Azure. Which two name resolution strategies should you implement to meet these requirements while minimizing administrative overhead? (Choose two.)
- A
Use only the default Azure-provided DNS server for all virtual networks
- B
Set up a custom DNS server in Azure, configured with conditional forwarders pointing to the on-premises DNS for contoso.local, and update each VNET� DNS settings to use this server
- C
Use publicly available DNS servers (such as Google Public DNS) and delegate contoso.local to them
- D
Create an Azure Private DNS zone for contoso.local, link it to both VNETs, and configure on-premises DNS to forward contoso.local queries to Azure
- E
Deploy an Azure Public DNS zone named contoso.local and reference it from both the on-premises environment and the VNETs
Show answer and explanation
Correct answers: B, D
Explanation
To integrate on-premises DNS resolution with Azure-based resources, you typically configure conditional forwarders from on-premises DNS to an Azure DNS solution capable of hosting the private zone (such as a custom DNS server in Azure or an Azure Private DNS zone). Relying solely on Azure-provided DNS without further configuration or exposing internal domains via a public DNS zone are both common mistakes. For more details, refer to 'Name Resolution for VMs and Role Instances' and 'Designing and Implementing Azure DNS Private Zones' in Microsoft� Azure documentation.
- A. Incorrect.
Option 1: Incorrect. Relying solely on Azure's auto-allocated DNS (168.63.129.16) does not allow on-premises DNS queries for contoso.local to resolve Azure private endpoints properly. It also won't handle the custom contoso.local domain from your on-premises environment without additional configuration.
- B. Correct.
Option 2: Correct. By deploying a custom DNS server in Azure, you can configure conditional forwarders to on-premises DNS for contoso.local. Then, point the DNS settings of each VNET to this custom DNS server. This ensures that Azure-based resources and on-premises resources can uniformly resolve internal hostnames.
- C. Incorrect.
Option 3: Incorrect. Public DNS providers such as Google Public DNS cannot host or resolve private internal zones (e.g., contoso.local) that are not publicly routable. This approach would fail to resolve private endpoints in Azure and your on-premises environment.
- D. Correct.
Option 4: Correct. An Azure Private DNS zone named contoso.local, linked to both VNETs, provides seamless resolution for internal hostnames. You would configure your on-premises DNS to forward queries for contoso.local to Azure, allowing both Azure VMs and on-premises clients to resolve each other's private IP addresses.
- E. Incorrect.
Option 5: Incorrect. Public DNS zones are not suitable for internal domains and private endpoints. You would expose internal names and IPs publicly, which defeats the purpose of a private domain.