Examkin

Question

Difficulty: MediumConfigure Azure DNS Private and Public Zones

An administrator is configuring name resolution in Azure. The infrastructure includes a Private DNS zone named `corp.local` and two peered virtual networks named `VNet-Hub` and `VNet-Spoke1`. The virtual network `VNet-Hub` is linked to `corp.local` with auto-registration enabled. A virtual machine named `VM-Spoke1` is deployed in `VNet-Spoke1`. Currently, `VM-Spoke1` is unable to resolve names registered within `corp.local`. Which action should the administrator take to allow `VM-Spoke1` to resolve the DNS records?

  1. A
    Configure gateway transit on the virtual network peering between `VNet-Hub` and `VNet-Spoke1`.
  2. B
    Configure the 'Use remote virtual network gateways' setting in the peering properties of `VNet-Spoke1`.
  3. Add a new virtual network link in `corp.local` that targets `VNet-Spoke1`.Answer
  4. D
    Set the DNS server IP address of `VNet-Spoke1` to point to the IP address of the primary name server for `VNet-Hub`.

Answer

Add a new virtual network link in `corp.local` that targets `VNet-Spoke1`.
The correct action is to link the spoke virtual network directly to the Private DNS zone. In Azure, DNS resolution for Private DNS zones is scoped strictly to linked virtual networks. Even if a virtual network is peered with another network that is linked to the zone, DNS queries from the peered network will fail unless it also has its own virtual network link.

Step-by-Step Solution

1
Analyze the DNS resolution scope of the Private DNS zone.
Confirm that DNS name resolution for `corp.local` is only available to virtual networks that are linked to the zone.
By default, Azure Private DNS zones restrict queries to virtual networks containing an active virtual network link.
2
Evaluate the effect of virtual network peering on name resolution.
Determine that virtual network peering does not transitively extend Private DNS zone query capability from `VNet-Hub` to `VNet-Spoke1`.
Peering enables IP-level connectivity but does not proxy or forward DNS queries to Private DNS zones linked to peered networks.
3
Configure the required link to enable name resolution.
Add a virtual network link from `VNet-Spoke1` to the `corp.local` Private DNS zone.
This establishes the necessary permission and path for VMs in the spoke virtual network to resolve names in the zone using the Azure default DNS service.

Key Concept

Azure Private DNS zones require a dedicated virtual network link for every virtual network from which resolution is needed. Peering two virtual networks does not automatically share or forward Private DNS zone resolution capabilities between them.
Rate this question

Topics

Configure Azure DNS Private and Public Zones

More questions from this topic