Question
You have an on-premises datacenter named DC1.
You have an Azure subscription that contains the resources shown in the following table.
| Name | Type | Description |
|---|---|---|
| VNet1 | Virtual network | None |
| contoso.com | Azure Private DNS zone | Linked to VNet1 |
| Server1 | Virtual machine | • Runs Windows Server<br>• Connects to VNet1<br>• Has the DNS Server role installed<br>• Resolves names for contoso.com by using a conditional forwarder. |
| ER1 | ExpressRoute circuit | Connects DC1 and VNet1 |
You plan to perform the following actions:
• Provision an Azure DNS Private Resolver named PR1 on VNet1.
• Migrate Server1 to the on-premises datacenter.
You need to ensure that once Server1 is migrated to the datacenter, the server can resolve names for entries created in contoso.com.
What should you do?
- A. On Server1, create a secondary zone.
- B. On PR1, create an outbound endpoint.
- C. Create a DNS forwarding ruleset and associate the ruleset with PR1.
- D. On Server1, modify the conditional forwarder for contoso.com. Correct
Explanation
While Server1 runs in VNet1, its conditional forwarder for contoso.com can send queries to Azure-provided DNS (168.63.129.16), which resolves the private zone linked to VNet1. That address cannot be reached from on-premises. After the migration, on-premises DNS servers resolve an Azure Private DNS zone by forwarding queries to the inbound endpoint of an Azure DNS Private Resolver over ExpressRoute. You therefore modify the conditional forwarder for contoso.com on Server1 to point to the inbound endpoint IP address of PR1. An outbound endpoint and a DNS forwarding ruleset handle the opposite direction: queries from Azure to on-premises or other custom DNS servers. A secondary zone cannot be created from an Azure Private DNS zone, because Azure Private DNS does not support zone transfers.
