Examkin

Question

Difficulty: HardConfigure Azure Application Gateway

An administrator is configuring a single Azure Application Gateway v2 in a hub virtual network named VNet-Hub. The backend pool of the Application Gateway is configured to use the fully qualified domain names (FQDNs) web1.private.contoso.com and web2.private.contoso.com of two web servers.

The web servers are deployed in a spoke virtual network named VNet-Spoke1, which is peered with VNet-Hub using default peering settings. A private DNS zone named private.contoso.com contains the host records for the web servers and is linked to VNet-Spoke1.

The administrator notices that the backend health status for the servers is reported as Unhealthy due to a DNS resolution error.

What should the administrator do to ensure the Application Gateway can successfully resolve the FQDNs of the backend servers?

  1. A
    Enable gateway transit on the virtual network peering from the hub virtual network to the spoke virtual network.
  2. B
    Add an inbound security rule to the Network Security Group of the Application Gateway subnet to allow traffic on UDP port 5353 with a priority of 100100.
  3. Link the private DNS zone to the hub virtual network.Answer
  4. D
    Associate a route table to the Application Gateway subnet with a user-defined route for the DNS service IP address directing traffic to a Virtual Network Gateway.

Answer

Link the private DNS zone to the hub virtual network.
The correct answer is correct because Azure Private DNS zones require a Virtual Network Link to each virtual network that needs to resolve records within that zone. Since the private DNS zone is only linked to the spoke virtual network, the Application Gateway in the hub virtual network cannot resolve the fully qualified domain names (FQDNs) of the backend servers. Linking the private DNS zone to the hub virtual network resolves this name resolution issue.

Step-by-Step Solution

1
Identify the cause of the failure as a DNS resolution error on the Application Gateway backend pool.
The Application Gateway resides in the hub virtual network, which by default cannot resolve records in private DNS zones unless linked.
Azure Application Gateway v2 uses the DNS settings of its virtual network to resolve backend FQDNs.
2
Link the private DNS zone to the hub virtual network where the Application Gateway is deployed.
The hub virtual network becomes associated with the private DNS zone.
This allows the Azure-provided DNS service inside the hub virtual network to resolve records in that private DNS zone.
3
Verify that backend health probes succeed and the status changes to Healthy.
The Application Gateway successfully routes traffic to the backend servers.
Name resolution succeeds, allowing the gateway to reach the backend servers via their FQDNs.

Key Concept

Azure Private DNS Zone Virtual Network Links
Estimated Time:2m 0s
Rate this question

Topics

Configure Azure Application Gateway

More questions from this topic