Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Private DNS Resolution Inside Azure Virtual Networks
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is deploying multiple virtual machines across several Azure Virtual Networks (VNets). The engineering team requires internal domain name resolution so that workloads can communicate using private domain names (such as app.corp.internal) without exposing internal records to the public internet or deploying and managing dedicated DNS virtual machines.
Which Azure service should the organization implement to meet these requirements?
Explanations
Azure Route Server
Azure Route Server
What Azure Route Server Is
Azure Route Server is a networking service that simplifies dynamic routing between Network Virtual Appliances (NVAs) and the Azure Virtual Network (VNet) software-defined routing infrastructure.
Why It Doesn't Meet the Requirement
Azure Route Server operates at the IP routing level using the Border Gateway Protocol (BGP). It exchanges dynamic route tables between virtual appliances and the Azure network fabric. It does not provide domain name resolution (DNS), manage DNS zones, or translate hostnames to IP addresses.
Key Characteristics and Limitations
- BGP Peering: Facilitates dynamic routing updates between third-party NVAs and Azure VNets without manual user-defined route (UDR) maintenance.
- No DNS Functionality: Cannot host DNS records, manage namespaces, or resolve domain names for internal resources.
- Control Plane Service: Manages routing paths rather than hosting data plane DNS queries.
This Answer Would Be Correct If
This option would be correct if the organization needed to dynamically exchange routing table information between a third-party firewall appliance or router and an Azure virtual network using BGP.
Azure NAT Gateway
Azure NAT Gateway
What Azure NAT Gateway Is
Azure NAT Gateway is a managed networking service that provides outbound-only internet connectivity for virtual machine subnets inside an Azure Virtual Network (VNet).
Why It Doesn't Meet the Requirement
Azure NAT Gateway is designed to handle outbound Network Address Translation, allowing private resources to initiate outbound connections to the internet using predictable static public IP addresses. It does not provide domain name hosting, DNS server capabilities, or internal name resolution.
Key Characteristics and Limitations
- Outbound Connectivity Only: Translates private IP addresses to static public IPs for outbound internet flows.
- Subnet-Level Association: Configured on a subnet level to handle outbound internet routing.
- No Internal Name Resolution: Does not manage internal domain spaces or answer DNS queries.
This Answer Would Be Correct If
This option would be correct if the organization required virtual machines in a private subnet to securely initiate outbound connections to software repositories on the internet using dedicated static public IP addresses.
Azure Private DNS
Azure Private DNS
What Azure Private DNS Is
Azure Private DNS is a fully managed DNS hosting and name resolution service designed specifically for Azure Virtual Networks (VNets). It provides reliable and secure domain name resolution within and between VNets without requiring administrators to build, configure, or maintain custom DNS virtual machines.
How It Meets the Requirements
- Internal Name Resolution: Azure Private DNS enables virtual machines and workloads within a virtual network to resolve custom domain names securely, keeping records private and isolated from the public internet.
- Zero Infrastructure Management: By using a native, platform-managed service, the organization eliminates the administrative overhead of deploying, patching, and scaling dedicated DNS server VMs.
- VNet Integration: Private DNS zones link directly to VNets, allowing automatic VM record registration and seamless internal traffic routing.
Key Advantages and Capabilities
- Platform-Managed Reliability: Built on Azure's resilient global infrastructure, providing high availability for name resolution.
- Automatic Registration: Can automatically register virtual machine hostnames in the designated private DNS zone upon deployment.
- Split-Horizon Support: Facilitates split-horizon DNS setups where identical domain names resolve differently for private internal queries versus public external queries.
- Cross-VNet Resolution: Supports name resolution across multiple virtual networks linked to the same private zone.
- Native Security: Integrates with Azure role-based access control (RBAC) and keeps internal network topologies hidden from the internet.
Why This Is Optimal
Azure Private DNS is the ideal solution because it fulfills all internal domain resolution and privacy requirements natively. Alternative approaches, such as deploying custom IaaS DNS servers, introduce unnecessary management complexity, cost, and maintenance overhead.
Azure Bastion
Azure Bastion
What Azure Bastion Is
Azure Bastion is a fully managed Platform-as-a-Service (PaaS) offering deployed within a virtual network to provide secure and seamless RDP (Remote Desktop Protocol) and SSH (Secure Shell) connectivity to virtual machines directly via the Azure portal over TLS.
Why It Doesn't Meet the Requirement
Azure Bastion is an administrative management access tool designed to eliminate the need for public IP addresses on VMs during remote management sessions. It has no role in DNS hosting, domain name registration, or internal hostname resolution across virtual networks.
Key Characteristics and Limitations
- Browser-Based Access: Connects administrators securely to VMs using HTML5 browsers and TLS.
- Public IP Protection: Protects virtual machines from internet port scanning by eliminating public IP requirements for management.
- No Name Resolution Role: Does not store or resolve DNS resource records (
A,CNAME,PTR, etc.) for network workloads.
This Answer Would Be Correct If
This option would be correct if the scenario required system administrators to securely connect to private Linux and Windows VMs via SSH and RDP through a web browser without assigning public IPs to those VMs.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Virtual Network
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure VPN Gateway vs ExpressRoute
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Virtual Network Peering
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Virtual Network Subnets
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Service Trust Portal
Identify appropriate use cases for each cloud model
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated