AZ-900 Describe Azure architecture and services Practice Question
What is the purpose of Azure Private DNS zones?
⚠ Common exam trap
Test-takers frequently confuse Azure Private DNS zones with public DNS zones or security services, assuming that 'private' implies security filtering or that DNS zones are always public-facing, when in fact Private DNS zones are purely for internal name resolution within Azure virtual networks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To provide DNS name resolution for resources within Azure virtual networks privately
Azure Private DNS zones provide DNS name resolution within a virtual network without requiring a custom DNS solution. They allow you to use your own domain names (e.g., contoso.internal) and automatically resolve them for resources inside the VNet, ensuring that DNS queries never leave the Azure network boundary. This is correct because the primary purpose is private, internal resolution, not public hosting or security filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To host public-facing domain names and DNS records
Why it's wrong here
Private DNS zones are not used for hosting public-facing records; that role belongs to Azure DNS public zones, which are configured with public name servers and answer queries from the internet. A private DNS zone is scoped to a virtual network and is only visible to workloads inside that network. Thus, hosting public domain names and DNS records is a different Azure DNS feature that markets to external resolution.
- ✓
To provide DNS name resolution for resources within Azure virtual networks privately
Why this is correct
Azure Private DNS provides name resolution for resources inside virtual networks by hosting custom domain records that map to private IP addresses. It allows VMs and services to resolve internal hostnames without exposing those records to the public internet. This is the correct purpose: it gives private and reliable DNS within your virtual network, with support for split-horizon behavior and auto-registration.
- ✗
To filter DNS requests for potentially malicious domains
Why it's wrong here
Filtering DNS requests to block malicious domains is a security control provided by Azure Firewall's DNS proxy (with threat intelligence-based filtering) or by Azure Defender for DNS. Private DNS zones have no ability to inspect or block queries; they are an authoritative resolution namespace that maps names to private IPs. So the purpose of private DNS zones is resolution, not security filtering.
- ✗
To translate domain names for cross-region traffic routing
Why it's wrong here
Cross-region DNS-based traffic routing is handled by Azure Traffic Manager or Front Door, both of which use DNS policies to steer clients to the optimal endpoint based on latency, priority, or geographic location. A private DNS zone simply performs name-to-IP resolution within a virtual network; it does not evaluate health, apply routing methods, or redirect traffic between regions. Therefore, this option confuses a load-balancing service with a private resolution service.
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.