You need to implement a name resolution solution that meets the networking requirements. Which two actions should you perform? Each correct answer…

In a hybrid environment where an on-premises Active Directory domain is extended to Azure, the recommended practice for name resolution is to use Active Directory-integrated DNS servers running on domain controller virtual machines (VMs) in Azure.

First, a server (DC3) intended to act as a domain controller and DNS server in the Azure virtual network must have the DNS Server role installed (F). This is a prerequisite for it to handle DNS queries for the corp.fabrikam.com domain.

Second, the Azure virtual network (Vnet1) must be configured to use this new DNS server. By changing the VNet's DNS server settings to the private IP address of DC3 (D), all VMs within that VNet will automatically use DC3 for name resolution, enabling them to resolve on-premises resources and locate domain controllers for domain-join operations.

A. Creating an Azure private DNS zone with the same name as an on-premises AD domain creates a "split-brain" DNS scenario, which is more complex to manage and not the recommended primary solution for AD integration.

B. This action is dependent on creating an Azure private DNS zone (Option A). Since A is not the best practice for this scenario, this subsequent step is also incorrect.

C. An Azure DNS zone is for public, internet-facing name resolution, which is not suitable for resolving internal, private hostnames in a hybrid Active Directory environment.

E. This action is also dependent on creating an Azure private DNS zone (Option A) and is therefore part of a less-recommended solution for this specific scenario.

G. Configuring a conditional forwarder is a secondary step, typically performed after the primary DNS infrastructure is established, to resolve names in other specific domains (e.g., forwarding Azure-specific queries).

1. Microsoft Learn

Azure Architecture Center. Extend an on-premises Active Directory domain to Azure. Under the "Networking recommendations" section

it states

"Deploy at least two domain controllers as Azure VMs... These VMs must run the DNS Server role." This supports option F. It also recommends

"Configure the DNS server settings for the virtual network... to reference the private IP addresses of the domain controller VMs." This supports option D.

2. Microsoft Learn. Name resolution for resources in Azure virtual networks. In the section "Name resolution that uses your own DNS server

" the documentation outlines the process for using custom DNS servers (like a domain controller) in a VNet. It specifies

"When you use your own DNS servers

you can specify multiple DNS servers per virtual network

" which directly corresponds to performing action D. The entire scenario presumes the existence of a configured DNS server

which requires the role to be installed (action F).

3. Microsoft Learn. Deploy AD DS in an Azure virtual network. In the "Configure the virtual network" section

step 4 states: "Change the DNS server for the virtual network... to use the static IP address assigned to the first domain controller." This validates action D. The preceding steps involve creating the domain controller VM

which includes installing the AD DS and DNS Server roles

validating action F.