Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Question 41 of 109
Free Preview · 109 of 363 · questions 1–109 of 363 are free. Sign up free to sync your progress across devices.
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
Final Answer: On VNet1, configure: A DNS proxy for FW1 On VNet2, set DNS to: The private IP address of FW1 Why: VNet2 cannot reach the on-prem network directly, so its VMs can’t query Server1 themselves. Enabling DNS proxy on Azure Firewall (FW1) makes the firewall listen on port 53 and forward DNS queries to an upstream server—here, Server1 over ExpressRoute. Pointing VNet2’s DNS to FW1’s private IP sends queries across the VNet peering to FW1, which resolves them through Server1 and returns the answers. This minimizes admin effort and avoids DNAT (public inbound only) or configuring VNet1’s custom DNS (which wouldn’t make FW1 a DNS listener).
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
On VNet1: enable DNS Proxy for FW1 On VNet2: set DNS to the private IP address of FW1 👉 This way, VMs in VNet2 send DNS queries to FW1, and FW1 forwards them to Server1 (on-premises). Minimal effort, no extra DNAT rules needed.
Final Answer: On VNet1, configure: A DNS proxy for FW1 On VNet2, set DNS to: The private IP address of FW1 Why: VNet2 cannot reach the on-prem network directly, so its VMs can’t query Server1 themselves. Enabling DNS proxy on Azure Firewall (FW1) makes the firewall listen on port 53 and forward DNS queries to an upstream server—here, Server1 over ExpressRoute. Pointing VNet2’s DNS to FW1’s private IP sends queries across the VNet peering to FW1, which resolves them through Server1 and returns the answers. This minimizes admin effort and avoids DNAT (public inbound only) or configuring VNet1’s custom DNS (which wouldn’t make FW1 a DNS listener).
why second question is not ip address of server1? this server is the dns