Examkin

Question

Difficulty: HardConfigure Azure DNS Private and Public Zones

Your company implements a split-horizon DNS infrastructure in Azure. You configure the following resources:
- A public Azure DNS zone named contoso.com that contains an A record for www.contoso.com pointing to a public IP address.
- An Azure Private DNS zone named contoso.com that is linked to a virtual network named VNet1. The private zone contains an A record for db.contoso.com pointing to an internal IP address.
- A virtual machine named VM1 deployed in VNet1 that uses default Azure-provided DNS.

VM1 can successfully resolve db.contoso.com. However, when attempting to resolve www.contoso.com, VM1 receives a name resolution error (NXDOMAIN).

What should you do to ensure that VM1 can successfully resolve www.contoso.com?

  1. Add an A record for www.contoso.com pointing to the public IP address in the private DNS zone.Answer
  2. B
    Enable auto-registration on the virtual network link between VNet1 and the private DNS zone.
  3. C
    Configure a custom DNS server in VNet1 and set a forwarder to the Azure recursive resolver at 168.63.129.16168.63.129.16.
  4. D
    Create a virtual network link between VNet1 and the public Azure DNS zone.

Answer

Add an A record for www.contoso.com pointing to the public IP address in the private DNS zone.
The correct answer is to manually add the A record for the public endpoint in the private DNS zone. In a split-horizon setup, when a virtual network is linked to an Azure Private DNS zone, Azure DNS acts as the authoritative resolver for the entire zone namespace. If a record is queried and not found in the private zone, Azure DNS returns NXDOMAIN rather than forwarding the query to public DNS servers. Therefore, to resolve the public endpoint internally, its record must be replicated in the private DNS zone.

Step-by-Step Solution

1
Analyze how Azure DNS resolves queries in linked virtual networks.
Azure DNS treats a linked private zone as authoritative for the entire domain namespace (e.g., contoso.com) within that VNet.
This determines the scope and authority of the DNS resolution engine.
2
Identify the cause of the NXDOMAIN error for the public record.
Because the private zone is authoritative and does not contain a record for www.contoso.com, Azure DNS returns NXDOMAIN instead of falling back to public DNS query resolution.
This explains why VM1 fails to resolve the public record despite it existing in the public DNS zone.
3
Select the appropriate split-horizon configuration modification.
Manually create the missing record (www.contoso.com) in the private DNS zone and point it to the public IP address.
This allows internal clients in VNet1 to resolve the external web app via the authoritative private zone.

Key Concept

Azure Private DNS Zone Authority and Split-Horizon DNS Resolution
Estimated Time:2m 0s
Rate this question

Topics

Configure Azure DNS Private and Public Zones

More questions from this topic