Question
You have an on-premises DNS server named Server1 that runs Windows Server. Server1 hosts a DNS zone named fabrikam.com.
You have an Azure subscription that contains the resources shown in the following table.
| Name | Type | Description |
| --- | --- | --- |
| Vnet1 | Virtual network | Connects to the on-premises network by using a Site-to-Site VPN |
| VM1 | Virtual machine | Runs Windows Server and has the DNS Server role installed |
| contoso.com | Private DNS zone | Linked to Vnet1 |
| contoso.com | Public DNS zone | Contains the DNS records of all the platform as a service (PaaS) resources |
You need to design a solution that will automatically resolve the names of any PaaS resources for which you configure private endpoints in Vnet1.
How should you configure the name resolution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
On Vnet1: Configure VM1 to forward requests for the contoso.com zone to the Azure-provided DNS at 168.63.129.16. The private endpoint A records are written to the private contoso.com zone, which is linked to Vnet1. Only Azure DNS (168.63.129.16) can resolve a private DNS zone, and only for queries that come from a virtual network linked to it. VM1 runs in Vnet1, so it acts as the DNS forwarder and sends contoso.com queries to 168.63.129.16. Forwarding to the public zone would return the public IP addresses of the PaaS resources instead of the private endpoint addresses.
On the on-premises network: Configure forwarding for the contoso.com zone to VM1. Server1 cannot query the private zone directly. 168.63.129.16 is reachable only from inside an Azure virtual network, never from on-premises, even over a VPN. Server1 therefore needs a conditional forwarder for contoso.com that points to VM1, and VM1 proxies the query to Azure DNS from inside Vnet1. New private endpoints then resolve automatically from both networks.
