AZ-500 Secure networking Practice Question
You are a security engineer for a company that uses Azure Virtual Networks and Azure Private Endpoints. You have a storage account with a private endpoint in VNet1. You need to ensure that all DNS queries for the storage account's private endpoint resolve to the private IP address from any virtual machine in VNet1. The virtual machines use the default Azure-provided DNS servers. What should you do?
⚠ Common exam trap
The trap here is assuming that Azure-provided DNS can be customized with conditional forwarders or custom records, which it cannot.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a private DNS zone named privatelink.blob.core.windows.net and link it to VNet1.
Private Endpoints require DNS resolution to the private IP. Azure Private DNS zones with names like privatelink.blob.core.windows.net are the standard method. Linking the zone to the virtual network enables Azure-provided DNS to resolve the private endpoint FQDN correctly. Other options either misuse features or do not provide the required DNS resolution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a private DNS zone named privatelink.blob.core.windows.net and link it to VNet1.
Why this is correct
Azure Private Endpoints require a private DNS zone to resolve the private IP. The zone name must match the service's privatelink domain, such as privatelink.blob.core.windows.net for Blob storage. Linking the zone to VNet1 ensures that VMs using Azure-provided DNS can resolve the private endpoint FQDN to the private IP, enabling secure, private connectivity.
- ✗
Enable Azure DNS Private Resolver in VNet1 and configure a forwarding rule to the storage account's private IP.
Why it's wrong here
Azure DNS Private Resolver is used for hybrid DNS resolution and conditional forwarding, not for resolving private endpoint names. It does not automatically create the necessary private DNS zone records. While it can forward queries, it does not fulfill the requirement without additional configuration of a private DNS zone.
- ✗
Add a DNS record for the storage account's public FQDN pointing to the private IP address in the VNet's DNS settings.
Why it's wrong here
Azure VNet DNS settings do not allow adding custom DNS records directly. The public FQDN of the storage account resolves to a public IP, and overriding it requires a private DNS zone. Simply adding a record is not possible through VNet settings, so this option does not work.
- ✗
Configure a conditional forwarder on the Azure-provided DNS servers to forward queries for the storage account to an on-premises DNS server.
Why it's wrong here
Azure-provided DNS does not support conditional forwarders. Conditional forwarders are a feature of custom DNS servers like Windows DNS or BIND. Without a private DNS zone, Azure-provided DNS cannot resolve the private endpoint FQDN to the private IP, so this approach fails to meet the requirement.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.