AZ-700 Question 28
Select 2You have an on-premises environment with an Active Directory domain named contoso.com and an internal domain named app.internal for application workloads. Your application spans two peered virtual networks in Azure: FrontEndVNet and BackEndVNet. You need all VMs in both VNets to resolve hostnames under app.internal reliably and also allow on-premises clients to resolve these same names for remote management. Which two actions should you perform to meet these requirements?
- A
A. Create an Azure Private DNS zone named app.internal and link both FrontEndVNet and BackEndVNet to it.
- B
B. Enable only the default Azure-provided DNS on each VNet so that name resolution is automatically synchronized across VNets.
- C
C. Configure a conditional forwarder on the on-premises DNS server for app.internal, pointing to a DNS forwarder or resolver in Azure.
- D
D. Assign the DNS server IP of your on-premises domain controller directly to the VNet DNS settings, relying on VNet peering to forward all DNS queries for app.internal.
- E
E. Deploy separate Azure Private DNS zones for app.internal in each VNet for independent resolution domains.
Show answer and explanation
Correct answers: A, C
Explanation
When designing name resolution for internal domains in Azure, creating a single Azure Private DNS zone and linking each VNet to that zone is considered a best practice (refer to Microsoft documentation: https://learn.microsoft.com/azure/dns/private-dns-overview). This setup provides consistent name resolution across peered VNets. For on-premises DNS, a conditional forwarder allows local clients to resolve addresses in the Azure private DNS zone. This combination ensures reliable name resolution within and across on-premises and Azure environments.
- A. Correct.
A. Correct. An Azure Private DNS zone for the app.internal name can be linked to both VNets, ensuring that all VMs within those VNets resolve app.internal consistently without relying on external DNS infrastructure.
- B. Incorrect.
B. Incorrect. Azure-provided DNS alone does not synchronize custom internal zones like app.internal across peered VNets or on-premises environments. You typically need a Private DNS zone or a custom DNS solution.
- C. Correct.
C. Correct. Configuring a conditional forwarder for app.internal on the on-premises DNS server to point to an Azure-based DNS forwarder or the Azure Private DNS zone ensures that on-premises clients can also resolve these hostnames correctly.
- D. Incorrect.
D. Incorrect. Simply pointing VNet DNS settings to the on-premises DNS server may result in resolution issues or added network latency. Additionally, the on-prem DNS server may not be aware of all Azure internal records unless properly integrated or forwarded to the Azure Private DNS zone.
- E. Incorrect.
E. Incorrect. Maintaining separate Azure Private DNS zones for the same domain name in each VNet leads to inconsistent name resolution and additional management overhead. A single private zone linked to both VNets is the recommended approach.