An organization is securing an Azure PaaS service by disabling public network access and configuring a private endpoint within an Azure Virtual Network (VNet). Virtual machines inside the virtual network must be able to resolve the service's fully qualified domain name (FQDN) to its private IP address. Which DNS configuration should the organization implement to meet this requirement?

Link an Azure Private DNS zone containing the appropriate DNS record to the virtual network: ### What Azure Private DNS Is **Azure Private DNS** provides a reliable and secure domain name resolution service for resources inside an **Azure Virtual Network (VNet)**. It enables administrators to manage and resolve custom domain names and service hostnames within private networks without needing to deploy, configure, or maintain custom virtual machine-based DNS servers. ### How It Meets the Requirement When connecting to an Azure service via a **private endpoint**, the service receives a private IP address within the customer's virtual network. To ensure client virtual machines can resolve the service's **fully qualified domain name (FQDN)** directly to this private IP address, an **Azure Private DNS zone** is created and populated with the appropriate address (`A`) record. By establishing a **virtual network link** between the Private DNS zone and the VNet, any virtual machine located in that VNet will automatically resolve the service hostname to its internal private IP address rather than a public IP address. ### Key Advantages and Capabilities - **Native Azure Integration**: Eliminates the operational overhead of deploying and patching dedicated IaaS DNS servers. - **Virtual Network Linking**: Allows one or more VNets to resolve private domain names seamlessly through configured **virtual network links**. - **Automated Name Resolution**: Resolves private FQDNs for private endpoints directly within the boundary of Microsoft's private network backbone. - **Simplified Security Governance**: Ensures that internal network traffic never traverses the public internet or relies on external public DNS resolvers. - **High Availability and Resilience**: Built on Azure's global infrastructure with native redundancy and automatic fault tolerance. ### Why This Is Optimal Using an **Azure Private DNS zone** linked directly to the target virtual network is the Microsoft-recommended best practice for private endpoint name resolution. It provides automatic, maintenance-free DNS translation for internal workloads while ensuring complete isolation from public internet routing.