AZ-700 Question 39
Select 2Your company hosts a private DNS zone named contoso.internal in Azure, which is linked to a virtual network. This virtual network is connected to your on-premises environment via a site-to-site VPN. You deploy an inbound endpoint for Azure DNS Private Resolver in the same virtual network and want to allow on-premises DNS servers to resolve contoso.internal through this inbound endpoint. Which two additional steps are required to ensure successful name resolution from on-premises DNS servers? (Choose two.)
- A
Configure forwarders on the on-premises DNS servers to send queries for contoso.internal to the inbound endpoint� private IP address.
- B
Create an outbound endpoint in the same virtual network that hosts the inbound endpoint.
- C
Create a DNS forwarding ruleset that forwards contoso.internal to localhost (127.0.0.1) and link it to the inbound endpoint.
- D
Open UDP and TCP port 53 inbound from on-premises networks to the inbound endpoint� IP addresses.
Show answer and explanation
Correct answers: A, D
Explanation
To enable on-premises name resolution of an Azure private DNS zone via Azure DNS Private Resolver, you must create an inbound endpoint in the relevant virtual network and configure your on-premises DNS servers to forward queries to the endpoint� IP address. In addition, ensure both UDP and TCP port 53 are permitted from on-premises to the inbound endpoint so that DNS queries reach Azure. An outbound endpoint is only required when you want resources in Azure to resolve names via external DNS servers. For more details, refer to Microsoft� documentation on Azure DNS Private Resolver at https://learn.microsoft.com/azure/dns/private-resolver-overview.
- A. Correct.
Correct. On-premises DNS servers must forward queries for the private zone to the Azure DNS Private Resolver inbound endpoint� IP address so those queries are handled by the resolver in Azure.
- B. Incorrect.
Incorrect. An outbound endpoint is required if you need to forward Azure-based DNS queries to third-party or on-premises DNS servers. In this scenario, you only need inbound resolution from on-premises into Azure, so an outbound endpoint is not necessary.
- C. Incorrect.
Incorrect. Forwarding queries to 127.0.0.1 inside the DNS forwarding ruleset would not route them to Azure DNS. If a separate ruleset were needed, you would forward to the Azure DNS IP 168.63.129.16, but in this scenario the zone is already linked to the same virtual network, so no custom ruleset is required for basic resolution.
- D. Correct.
Correct. DNS can use both UDP and TCP on port 53. Ensuring your on-premises firewalls and network configurations allow inbound UDP and TCP connections on port 53 to the inbound endpoint is essential for successful name resolution.