Question
You have an on-premises server named DNS1 that runs Windows Server and has the DNS Server role.
You have an Azure subscription that contains an Azure Private DNS zone named contoso.com.
You implement an Azure DNS Private Resolver named Resolver1.
You need to ensure that DNS1 can resolve names from contoso.com by using Resolver1. The solution must minimize administrative effort.
What should you configure?
- A. DNS policy Correct
- B. a Site-to-Site (S2S) VPN connection
- C. root hints
- D. a secondary DNS zone
Explanation
On-premises DNS servers resolve names in an Azure Private DNS zone by forwarding those queries to the inbound endpoint of the Azure DNS Private Resolver. On DNS1, a DNS policy can do this per domain: create a recursion scope whose forwarder is Resolver1's inbound endpoint IP address, then add a query resolution policy that applies that recursion scope to queries matching *.contoso.com. A secondary DNS zone would need a zone transfer from the Azure Private DNS zone, which Azure Private DNS does not support. Root hints point to the public internet root servers and cannot reach a private zone. A Site-to-Site VPN only provides network connectivity; it does not make DNS1 send contoso.com queries to Resolver1.
