AZ-700 · Question #118
You have an Azure virtual network named Vnet1 that hosts an Azure firewall named FW1 and 150 virtual machines. Vnet1 is linked to a private DNS zone named contoso.com. All the virtual machines have…
The correct answer is C. For FW1, enable DNS proxy. D. On the on-premises DNS servers, configure forwarders that point to the frontend IP address of. The challenge is enabling on-premises DNS servers to resolve names in the Azure private DNS zone (contoso.com). Azure private DNS zones only respond to queries from within Azure's DNS resolver (168.63.129.16), which is not directly reachable from on-premises. The solution is…
Question
You have an Azure virtual network named Vnet1 that hosts an Azure firewall named FW1 and 150 virtual machines. Vnet1 is linked to a private DNS zone named contoso.com. All the virtual machines have their name registered in the contoso.com zone. Vnet1 connects to an on-premises datacenter by using ExpressRoute. You need to ensure that on-premises DNS servers can resolve the names in the contoso.com zone. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Options
- AModify the DNS server settings of Vnet1.
- BFor FW1, configure custom DNS server.
- CFor FW1, enable DNS proxy.
- DOn the on-premises DNS servers, configure forwarders that point to the frontend IP address of
- EOn the on-premises DNS servers, configure forwarders that point to the Azure provided DNS
How the community answered
(46 responses)- A4% (2)
- B11% (5)
- C78% (36)
- E7% (3)
Explanation
The challenge is enabling on-premises DNS servers to resolve names in the Azure private DNS zone (contoso.com). Azure private DNS zones only respond to queries from within Azure's DNS resolver (168.63.129.16), which is not directly reachable from on-premises. The solution is: (C) Enable DNS proxy on FW1 - this configures Azure Firewall to act as a DNS proxy, forwarding DNS queries it receives to Azure's recursive resolver (168.63.129.16), which can resolve private DNS zone records; and (D) Configure on-premises DNS forwarders to point to the frontend IP of FW1 - on-premises DNS servers forward contoso.com queries to the firewall's IP, which then proxies them to Azure DNS. Option A (modifying VNet DNS settings) alone won't help on-premises servers. Option E (pointing to Azure's 168.63.129.16) is incorrect because that IP is not reachable from on-premises networks.
Community Discussion
No community discussion yet for this question.