Question
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant. The on-premises network is connected to Azure by using a Site-to-Site VPN.
You have the DNS zones shown in the following table.
| Name | Location | Description |
|---|---|---|
| contoso.com | A domain controller named DC1 on the on-premises network | Provide name resolution on-premises |
| fabrikam.com | An Azure private DNS zone | Provides name resolution for all Azure virtual networks |
You need to ensure that names from fabrikam.com can be resolved from the on-premises network.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. Create a stub zone for fabrikam.com on DC1.
- B. Create a conditional forwarder for fabrikam.com on DC1. Correct
- C. Create a secondary zone for fabrikam.com on DC1.
- D. Deploy an Azure virtual machine that runs Windows Server. Modify the DNS Servers settings for the virtual network.
- E. Deploy an Azure virtual machine that runs Windows Server. Configure the virtual machine as a DNS forwarder. Correct
Explanation
An Azure private DNS zone can be resolved only from inside a linked Azure virtual network, through the Azure-provided DNS address 168.63.129.16, which on-premises clients cannot reach. Deploy a Windows Server VM in Azure and configure it as a DNS forwarder that sends queries to Azure DNS. Then create a conditional forwarder for fabrikam.com on DC1 that points to that VM's private IP address over the Site-to-Site VPN. A stub zone or a secondary zone would need zone transfers, which a private DNS zone does not support. Changing the virtual network's DNS servers affects only Azure resources, not on-premises resolution.
