AZ-700 Question 38
Single answerYou are the network engineer for an organization that uses Azure. The organization has deployed a private DNS zone named contoso.internal in the same subscription where a virtual network (VNet1) is hosted. Several Windows VMs in VNet1 need to resolve hostnames in the contoso.internal zone. Which action should you perform to ensure VNet1 can resolve names in the contoso.internal zone?
- A
Create a DNS zone delegation record in your public DNS zone that points to the Azure-provided DNS servers for VNet1.
- B
From the contoso.internal private DNS zone page, create a virtual network link to VNet1 and enable auto-registration if required.
- C
Enable split-horizon DNS on VNet1 by adding the contoso.internal zone to VNet1's DNS server settings.
- D
Manually add A records for each VM in VNet1 to the Azure-provided DNS zone.
Show answer and explanation
Correct answer: B
Explanation
To allow VMs in an Azure virtual network to resolve hostnames in a private DNS zone, you must create a virtual network link from the private DNS zone to the desired virtual network. This is done by navigating to the Private DNS zone in the Azure portal, selecting 'Virtual network links,' and then adding the VNet with or without auto-registration, according to your needs. For detailed guidance, refer to the Microsoft documentation on 'Use Azure DNS for private domains' (https://learn.microsoft.com/azure/dns/private-dns-overview).
- A. Incorrect.
Option 1 is incorrect because creating a delegation record in a public DNS zone does not link VNet1 to the private DNS zone contoso.internal. Delegations in public DNS zones are for external resolutions, not private VNet resolutions in Azure.
- B. Correct.
Option 2 is correct. In the Azure portal, you must create a virtual network link from the private DNS zone (contoso.internal) to VNet1, which allows VNet1 to resolve hostnames in that private zone. Auto-registration can be enabled to automatically register VM hostnames if desired.
- C. Incorrect.
Option 3 is incorrect because Azure does not provide a configuration called 'split-horizon DNS' on a VNet. Linking a virtual network directly to the private DNS zone is the supported approach for private name resolution.
- D. Incorrect.
Option 4 is incorrect because manually adding A records to the Azure-provided DNS services is not how private DNS resolution is achieved. Azure-provided DNS for a private zone requires a virtual network link to function as intended.