Workloads in several spoke VNets need answers for names kept on DNS servers in the corporate datacenter, and a central Azure resolver should enforce one policy. What should be deployed and configured?
Show answer and explanation
Answer: D
An outbound endpoint lets Azure send DNS queries to external DNS servers. A forwarding ruleset defines which domain names go to which target servers. Linking that ruleset to the spoke VNets makes their queries follow the central policy. An inbound endpoint alone only accepts queries arriving from outside Azure.
Why the other options are wrong
- A. An inbound endpoint receives queries arriving from outside Azure. Spokes would still have no way to send names to the datacenter servers without an outbound endpoint and ruleset.
- B. A public zone is hosted on the internet and does not forward private corporate names to datacenter servers. Conditional forwarding configured there does not reach the spoke VNets.
- C. A NAT gateway provides outbound SNAT for internet-bound traffic. It has no role in DNS name resolution or forwarding.