AZ-104 Practice Question 58: Private DNS Zone Link Spoke
Microsoft Azure Administrator Associate (AZ-104) · Test 6 · question 8 of 10
A hub VNet contains a private DNS zone named privatelink.blob.core.windows.net. It has an A record for a storage account's private endpoint, and the zone is linked only to the hub VNet. A spoke VNet is peered with the hub, and all VNets use the default Azure-provided DNS. VMs in the spoke resolve the storage account name to its public IP address instead of the private endpoint's address.
What should the administrator do?
Show answer and explanation
Answer:
A private DNS zone is made available to a VNet by a virtual network link: once linked, VMs in that VNet can resolve the records in the zone. The zone here is linked only to the hub, and peering provides IP connectivity between the VNets rather than a link to the zone, so the spoke does not use the zone and gets the public address. Adding a virtual network link from the zone to the spoke VNet lets the spoke's Azure-provided DNS resolve the private endpoint record.
Option B controls whether VMs in the hub VNet register their own names in the zone. It has no effect on which VNets can resolve the zone.
Option C affects traffic forwarding through the peering, such as traffic that did not originate in the peered VNet. It is unrelated to how names are resolved.
Option D changes nothing. 168.63.129.16 is the address of the Azure-provided DNS resolver that the spoke already uses, so pointing to it explicitly does not add the zone to the spoke.
Reference: What is a virtual network link?