Microsoft Certified: Azure Administrator AssociateImplement and manage virtual networkingMedium
A company is expanding its Azure environment and needs to ensure that virtual machines (VMs) in a newly created virtual network (VNet) can resolve DNS queries for both public internet resources and private Azure DNS zones. The VNet is named 'VNetProd' and has a subnet 'SubnetProd'. Which DNS configuration is required for 'VNetProd'?
- AManually add DNS records for all private Azure resources into a public DNS zone hosted by Azure DNS.
- BDeploy an Azure DNS Private Resolver within 'VNetProd' and configure it as the VNet's DNS server.
- CConfigure a custom DNS server IP address within the VNet settings to point to a public DNS server like 8.8.8.8.
- DEnsure the default Azure-provided DNS is used, and link the private DNS zones to 'VNetProd'.
Show answer & explanationAnswer & explanation
Correct answer: D. Ensure the default Azure-provided DNS is used, and link the private DNS zones to 'VNetProd'.
By default, Azure provides DNS resolution for public resources. To resolve private Azure DNS zones, you must link the private DNS zone to the virtual network. This allows VMs in the VNet to use the Azure-provided DNS to resolve both public and private names.
Why the other options are wrong
- A. Public DNS zones cannot contain records for private Azure resources, as they would be publicly accessible and insecure.
- B. An Azure DNS Private Resolver is used for hybrid scenarios where on-premises resources need to resolve Azure private DNS zones, or vice-versa, not primarily for VNet-internal resolution of private zones.
- C. Using a public DNS server for the VNet would prevent resolution of private Azure DNS zones unless complex forwarding is configured.
Azure DNS Resolution
Azure provides default DNS resolution for public names. For private names within Azure, private DNS zones must be linked to virtual networks.
- Azure-provided DNS handles public names by default.
- Private DNS zones are used for internal Azure resource names.
- Virtual networks must be linked to private DNS zones for resolution.
Memory trick: Link private zones to VNet for internal, Azure default for external.