Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Resolving Private Endpoints with Azure Private DNS
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is securing an Azure PaaS service by disabling public network access and configuring a private endpoint within an Azure Virtual Network (VNet). Virtual machines inside the virtual network must be able to resolve the service's fully qualified domain name (FQDN) to its private IP address.
Which DNS configuration should the organization implement to meet this requirement?
Explanations
Configure an Azure Traffic Manager profile with weighted routing
Configure an Azure Traffic Manager profile with weighted routing
What Azure Traffic Manager Is
Azure Traffic Manager is a DNS-based traffic load balancer that distributes client traffic across globally distributed service endpoints using various routing methods, such as priority, weighted, performance, or geographic routing.
Why It Doesn't Meet the Requirement
- Operates on Public Endpoints: Traffic Manager is engineered for distributing internet-facing traffic across publicly accessible endpoints in multiple Azure regions.
- Not an Internal DNS Resolver: It does not host private DNS records or link with virtual networks to map private IP addresses assigned to private endpoints.
- No Private IP Translation: Traffic Manager cannot serve as a replacement for an internal Private DNS zone to resolve internal PaaS private endpoints.
Key Characteristics and Limitations
- Evaluates DNS queries at the global public level to route users to the best public endpoint.
- Monitors endpoint health using public HTTP/HTTPS or TCP health probes.
- Does not provide private endpoint DNS zone management or internal virtual network name resolution.
This Answer Would Be Correct If
The organization needed to distribute incoming public internet traffic across multiple redundant web application instances located in different Azure regions to improve global availability and performance.
Additional Context
Traffic Manager works at the DNS level for external routing, whereas services requiring private virtual network integration rely on Azure Private DNS and Azure Private Link.
Delegate the domain name to Azure Public DNS name servers
Delegate the domain name to Azure Public DNS name servers
What Azure Public DNS Is
Azure Public DNS is an authoritative DNS hosting service that hosts public domain records and resolves domain names across the global internet. It allows domain owners to manage their external DNS zones using Azure management tools, APIs, and portal interfaces.
Why It Doesn't Meet the Requirement
- Exposed to the Public Internet: Azure Public DNS resolves queries sent over the public internet, whereas private endpoint IP addresses belong to non-routable, private IP spaces within a virtual network.
- Cannot Replace Private Resolution: Hosting records in a public zone does not automatically configure internal virtual network resolution for private resources and risks exposing internal IP topology publicly.
- Lacks Virtual Network Linking: Public DNS zones cannot be linked directly to an Azure Virtual Network to manage private resolution boundaries.
Key Characteristics and Limitations
- Provides authoritative name resolution for internet-facing web applications, public APIs, and mail servers.
- Requires domain delegation from an external domain registrar to Azure name servers.
- Does not integrate with private network resolution mechanisms like Azure Private Link out of the box.
This Answer Would Be Correct If
The organization wanted to host a public domain (such as contoso.com) in Azure to direct external internet users to public-facing websites, web apps, or load balancers.
Additional Context
While public DNS is essential for external clients navigating to publicly hosted web properties, private endpoints require internal name resolution via Azure Private DNS or a custom internal DNS server.
Add client IP address ranges to the IP network rules on the service's public endpoint
Add client IP address ranges to the IP network rules on the service's public endpoint
What IP Network Rules Are
IP network rules (also known as Azure service firewalls) are access control mechanisms applied to the public endpoints of Azure PaaS services. They restrict inbound traffic by allowing connections only from specified public IP addresses or CIDR IP address blocks while denying all other internet-based requests.
Why It Doesn't Meet the Requirement
- Requires an Active Public Endpoint: IP network rules operate exclusively on public endpoints. In this scenario, public network access has been explicitly disabled in favor of a private endpoint.
- Does Not Provide DNS Translation: IP network rules are firewall filtering rules at the transport and network layers; they do not perform domain name resolution or map FQDNs to private IP addresses.
- Inapplicable to Private Link: IP filtering rules applied to public endpoints do not govern traffic flowing across private endpoints or through Azure Private Link.
Key Characteristics and Limitations
- Enforces perimeter access control solely on internet-routable public IP addresses.
- Supports a maximum limit of firewall IP rules per resource endpoint (typically 200 rules).
- Ignored when communication occurs over private endpoints within private address spaces.
This Answer Would Be Correct If
The scenario required restricting access to an Azure resource's public endpoint so that only authorized corporate branch offices or static on-premises public IP ranges could connect across the public internet.
Additional Context
When public network access is set to Disabled, all public IP firewall rules are bypassed and inactive because incoming traffic is entirely restricted to private endpoint connections.
Link an Azure Private DNS zone containing the appropriate DNS record to the virtual network
Link an Azure Private DNS zone containing the appropriate DNS record to the virtual network
What Azure Private DNS Is
Azure Private DNS provides a reliable and secure domain name resolution service for resources inside an Azure Virtual Network (VNet). It enables administrators to manage and resolve custom domain names and service hostnames within private networks without needing to deploy, configure, or maintain custom virtual machine-based DNS servers.
How It Meets the Requirement
When connecting to an Azure service via a private endpoint, the service receives a private IP address within the customer's virtual network. To ensure client virtual machines can resolve the service's fully qualified domain name (FQDN) directly to this private IP address, an Azure Private DNS zone is created and populated with the appropriate address (A) record. By establishing a virtual network link between the Private DNS zone and the VNet, any virtual machine located in that VNet will automatically resolve the service hostname to its internal private IP address rather than a public IP address.
Key Advantages and Capabilities
- Native Azure Integration: Eliminates the operational overhead of deploying and patching dedicated IaaS DNS servers.
- Virtual Network Linking: Allows one or more VNets to resolve private domain names seamlessly through configured virtual network links.
- Automated Name Resolution: Resolves private FQDNs for private endpoints directly within the boundary of Microsoft's private network backbone.
- Simplified Security Governance: Ensures that internal network traffic never traverses the public internet or relies on external public DNS resolvers.
- High Availability and Resilience: Built on Azure's global infrastructure with native redundancy and automatic fault tolerance.
Why This Is Optimal
Using an Azure Private DNS zone linked directly to the target virtual network is the Microsoft-recommended best practice for private endpoint name resolution. It provides automatic, maintenance-free DNS translation for internal workloads while ensuring complete isolation from public internet routing.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Private Endpoint
Define public and private endpoints
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Private Endpoint
Define public and private endpoints
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Reservations
Compare cloud pricing models
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Network Security Group
Describe the resources required for virtual machines
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Tag Enforcement
Describe the purpose of tags
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated