AZ-700 Question 40
Single answerYour company has deployed Azure DNS Private Resolver with both inbound and outbound endpoints to enable DNS resolution between on-premises and Azure private endpoints. You have verified that your on-premises DNS server is forwarding queries for your private domain to the inbound endpoint� private IP address. However, on-premises clients still cannot resolve Azure private endpoint names. Which additional configuration step must be performed to ensure successful DNS resolution for on-premises clients?
- A
Configure a DNS forwarding rule in Azure DNS Private Resolver to send queries for the private domain to the Azure Private DNS zone.
- B
Enable the built-in DNS server in each Azure virtual network to forward requests to the on-premises DNS server.
- C
Add an additional public IP address to the inbound endpoint so on-premises DNS traffic can reach it via the internet.
- D
Create a CNAME record in each on-premises DNS zone pointing all private endpoint queries to the outbound endpoint.
Show answer and explanation
Correct answer: A
Explanation
To enable on-premises DNS servers to resolve private endpoints in Azure, you must configure both the inbound endpoint for receiving queries and a DNS forwarding rule within Azure DNS Private Resolver. The forwarding rule tells Azure DNS Private Resolver where to route queries for the specified domain (for example, your private DNS zone). Without the forwarding rule, queries arriving at the inbound endpoint will not be correctly directed to the Azure Private DNS zone. For more details, refer to the official Azure DNS Private Resolver documentation: https://learn.microsoft.com/azure/dns/private-resolver.
- A. Correct.
Correct. After creating the inbound endpoint, you must configure a DNS forwarding (or ruleset) in the Azure DNS Private Resolver so that queries for your private domain are directed to the correct Azure Private DNS zone. This ensures that on-premises DNS requests forwarded to the inbound endpoint are resolvable within Azure.
- B. Incorrect.
Incorrect. Enabling built-in DNS forwarding in each virtual network does not replace the need for a specific forwarding rule in Azure DNS Private Resolver. The Private Resolver needs explicit rules to know where to route queries for the private domain.
- C. Incorrect.
Incorrect. The inbound endpoint is designed for private access; assigning it a public IP address is neither recommended nor required for on-premises to Azure private DNS resolution. Communication occurs over secure, private connections (e.g., VPN or ExpressRoute).
- D. Incorrect.
Incorrect. A CNAME record in on-premises DNS alone does not solve the forwarding mechanism issue within Azure. You still need a forwarding rule in Azure DNS Private Resolver to direct the query to the private zone. Simply pointing to the outbound endpoint will not route traffic correctly for resolution.