AZ-700 Question 36
Select 2You are a network engineer at Contoso, Inc. The company hosts a public-facing website at contoso.com and also uses contoso.com internally for a line-of-business application deployed on Azure VMs in a virtual network (10.0.0.0/16). You want to configure Azure DNS so that external users resolve the public website via the public zone, while internal Azure VMs use a private zone for the line-of-business application. Which two steps should you take? (Choose two.)
- A
Create a public DNS zone named contoso.com in Azure DNS and delegate the domain to Azure DNS name servers at your registrar.
- B
Create a private DNS zone named contoso.com in Azure DNS and link it to the 10.0.0.0/16 virtual network.
- C
Add a single A record in the public DNS zone pointing to both the external IP address and the private IP address of the application.
- D
Configure zone transfers from the public zone to the private zone so that both zones share identical records.
Show answer and explanation
Correct answers: A, B
Explanation
To configure Azure DNS for a domain that serves both public and internal Azure environments, create two distinct zones: one public, delegating from the domain registrar to Azure DNS name servers, and a separate private DNS zone linked to the relevant virtual network(s). In this way, external queries are resolved by the public zone without exposing internal IP addresses, while VMs in the virtual network use the private zone for internal name resolution. Refer to Microsoft documentation on Azure DNS (https://learn.microsoft.com/azure/dns/) for further details.
- A. Correct.
Correct. You must register a public zone in Azure DNS for contoso.com and have your domain registrar delegate contoso.com to Azure's name servers. This ensures external queries are handled by Azure DNS.
- B. Correct.
Correct. You must create a private DNS zone in Azure DNS and link it to the virtual network hosting your internal VMs so those VMs can resolve names within contoso.com privately.
- C. Incorrect.
Incorrect. You should separate the records for public- and private-facing resources into their respective DNS zones. Placing internal IP addresses in the public zone can reveal private details and create confusion for external users.
- D. Incorrect.
Incorrect. Azure DNS does not rely on traditional zone transfers between public and private zones. Instead, you host them as separate zones, each with its own set of records and usage scope.