A hub DNS Private Resolver has an inbound endpoint at 10.10.0.4. A ruleset forwards corp.example.net queries to that address, so spoke VNets can use the hub. Which of these VNets must be left unlinked from this ruleset?
Show answer and explanation
Answer: A
Linking a forwarding ruleset to the VNet that hosts the inbound endpoint can create a resolution loop. The ruleset sends queries to that inbound address, which sits inside the same VNet, so a lookup can cycle back through the ruleset. Other VNets that need the rule can be linked without this risk, including ones in other subscriptions.
Why the other options are wrong
- B. A spoke that runs business applications is the intended target of the rule. Linking it lets those workloads use the hub's forwarding policy, so this link is fine.
- C. A VNet in a sister subscription can be linked to the same ruleset, which is a common way to share one forwarding policy across an estate. This link is not the problem.
- D. A VNet reaching branches over VPN can be linked to the ruleset so its resources use the hub resolver. Its connectivity method does not create a loop, so this link is fine.