AZ-700 Question 33
Single answerYou are designing name resolution for two Azure virtual networks (EastVNet and WestVNet) that each host several Windows and Linux VMs. You have created a private DNS zone named contoso.internal, and you want all VMs in both VNets to automatically register their assigned private IP addresses in the same zone. Which design approach should you implement to meet these requirements?
- A
Link both EastVNet and WestVNet to the same private DNS zone and enable auto registration on each virtual network link.
- B
Create two separate private DNS zones�one assigned to EastVNet and another to WestVNet�and configure DNS forwarding between them.
- C
Set up an on-premises DNS server and create conditional forwarders to the private DNS zone in Azure for both VNets.
- D
Use Azure Firewall as a DNS proxy so that each VNet� DNS queries are routed to the private DNS zone without linking the VNets.
Show answer and explanation
Correct answer: A
Explanation
The recommended design pattern for multi-VNet name resolution in Azure is to create a single Private DNS zone and link each VNet to that zone with auto registration enabled. This setup ensures that when new VMs are deployed within the VNets, their private IP addresses are automatically added to the zone, enabling seamless name resolution. For more information, see Microsoft documentation on 'Azure Private DNS zone configurations and auto registration best practices.'
- A. Correct.
Correct. Linking both VNets to the same private DNS zone and enabling auto registration on each link ensures that VMs in both EastVNet and WestVNet register their DNS records automatically in contoso.internal. This provides unified name resolution across the VNets without extra forwarding or complex configuration.
- B. Incorrect.
Incorrect. Creating two separate private DNS zones increases complexity and does not automatically provide cross-VNet name resolution in a single namespace. While DNS forwarding could be configured, it is not necessary when you can directly link both VNets to the same zone.
- C. Incorrect.
Incorrect. While on-premises DNS servers can forward DNS queries to Azure� private DNS zone, this is not the simplest or best approach when both VNets are entirely in Azure. It introduces unnecessary dependencies and does not inherently enable automatic registration of Azure resources in the private zone.
- D. Incorrect.
Incorrect. Azure Firewall� DNS proxy can centralize DNS traffic, but it does not replace the fundamental need to link each VNet to the private DNS zone for auto registration. You would still have to create private DNS zone links for name resolution records to register automatically.