AZ-700 Question 35
Select 2You have deployed an internal application on a private AKS cluster in Azure. The application is accessible within the same virtual network using the FQDN 'api.internal.example.com'. You also need to make the application publicly accessible at 'api.example.com' using a public IP address associated with a NAT gateway. Which two actions should you take to properly configure both public and private DNS zones for this scenario?
- A
Create a public DNS zone for 'example.com' in Azure DNS and add an A record for 'api.example.com' pointing to the NAT gateway public IP address.
- B
Create a private DNS zone for 'internal.example.com' in Azure DNS and link it to the virtual network that hosts the AKS cluster.
- C
Enable split-horizon DNS by deploying an Azure Firewall to resolve 'api.example.com' within the same virtual network using the cluster� private IP address.
- D
Populate the private DNS zone records under 'example.com' with the NAT gateway's public IP address so both internal and external requests resolve to the same address.
Show answer and explanation
Correct answers: A, B
Explanation
In this scenario, you must maintain separate zones for private and public name resolution. A private DNS zone (internal.example.com) linked to the AKS cluster� virtual network is needed for internal name resolution, while a public DNS zone (example.com) must point to the external public IP address that fronts the service. This aligns with Azure DNS best practices (see Microsoft Documentation: https://learn.microsoft.com/azure/dns/dns-overview) for splitting DNS between public and private zones.
- A. Correct.
Correct. To make 'api.example.com' resolvable from the internet, you must create a public DNS zone and map the desired subdomain to the NAT gateway� public IP address. This ensures external clients can resolve the application� public endpoint.
- B. Correct.
Correct. Creating a private DNS zone with the subdomain 'internal.example.com' and linking it to the virtual network hosting the AKS cluster enables internal name resolution for 'api.internal.example.com'. This is a standard approach for private DNS in Azure.
- C. Incorrect.
Incorrect. Azure Firewall is not required for simply resolving 'api.example.com' within the network. Split-horizon DNS typically involves maintaining separate external and internal DNS configurations, but for private DNS scenarios in Azure, linking the private DNS zone to the VNet is sufficient.
- D. Incorrect.
Incorrect. You should not reuse the same zone 'example.com' for internal records that point to a private IP if you need a separate internal subdomain. Placing the NAT gateway� public IP into a private zone would not allow proper splitting between internal and external resolutions, creating potential routing conflicts.