AZ-500 Secure networking Practice Question
You have an Azure application that uses a private endpoint for Azure SQL Database. Users report intermittent connectivity failures. You need to diagnose whether the private endpoint DNS resolution is working correctly. Which tool should you use?
⚠ Common exam trap
A common mix-up: candidates choose `ping` or `tracert` because they think connectivity tests diagnose DNS, but DNS resolution must be verified separately with a DNS-specific tool like `nslookup` or `dig`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
nslookup
When using a private endpoint for Azure SQL Database, connectivity relies on DNS resolution returning the private IP address of the endpoint rather than the public IP. `nslookup` queries the DNS server directly and shows the resolved IP address, allowing you to verify that the private endpoint's private IP is being returned. If it returns the public IP or fails, DNS configuration is incorrect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
tracert
Why it's wrong here
tracert (or traceroute) maps the network path to a destination by sending ICMP echo requests with incrementally increasing Time-to-Live values, displaying each intermediate router's IP and round-trip latency. It does not perform a forward DNS query for the target's name to verify which IP the application will use; any reverse-DNS hostnames shown for intermediate hops are unrelated to the private endpoint's resolution. Thus, tracert cannot confirm whether the private endpoint FQDN resolves to the expected private IP.
- ✗
netstat
Why it's wrong here
netstat displays the local host's active TCP/UDP connections, listening ports, and routing table based on existing sockets in the system. It does not query the configured DNS servers and provides no information about how a hostname was resolved to an IP address, so you cannot use it to validate the DNS mapping of a private endpoint. At best, it shows an established connection to an arbitrary IP, but that IP could have come from a hardcoded config or an incorrect DNS response.
- ✗
ping
Why it's wrong here
ping sends ICMP echo request packets to a destination IP and measures reachability and RTT, which is a basic transport-level check. Although ping leverages the system default resolver to resolve the hostname before sending, it does not expose the DNS answer records nor allow you to query a specific DNS server, and an unreachable target may be caused by ICMP blocked by NSGs or firewalls rather than a DNS issue. Therefore, ping is not a valid tool for confirming private endpoint DNS resolution to the private IP.
- ✓
nslookup
Why this is correct
nslookup is a dedicated DNS client utility that queries a specified DNS server (or the system default) and prints the resource records in the response, such as A, CNAME, and PTR. For an Azure private endpoint, you can run nslookup <private-endpoint-FQDN> to confirm it returns the private IP address from the attached Private DNS Zone, optionally targeting Azure's internal DNS (168.63.129.16) or your own forwarder to isolate resolution failures. This direct visibility into DNS answers makes nslookup the correct tool for verifying private endpoint name resolution.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.