AZ-802 Practice Question: Implement and Manage On-Prem and Hybrid Networking
An organization uses an on-premises Active Directory Domain Services (AD DS) environment and an Azure subscription. The IT team needs to ensure that on-premises clients can resolve names for resources hosted in an Azure Private DNS zone. Which component should be implemented to facilitate this specific name resolution path without deploying custom DNS servers in Azure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure DNS Private Resolver Inbound Endpoint
Hybrid name resolution requires a bridge between on-premises DNS servers and Azure Private DNS zones. The Azure DNS Private Resolver provides a managed service that allows on-premises DNS queries to be forwarded to an inbound endpoint. This architecture eliminates the need for maintaining custom-built DNS forwarders on virtual machines, improving reliability and simplifying the administrative overhead for hybrid connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Private Link
Why it's wrong here
Azure Private Link provides private access to services but does not inherently handle DNS resolution for entire zones from on-premises environments. It maps specific IP addresses to services, which is insufficient for broad name resolution across a complex hybrid network infrastructure that requires recursive lookups or conditional forwarding.
- ✓
Azure DNS Private Resolver Inbound Endpoint
Why this is correct
The Inbound Endpoint acts as a local entry point within an Azure Virtual Network for DNS queries originating from on-premises. By configuring on-premises DNS servers to use this endpoint as a conditional forwarder, clients can seamlessly resolve records stored in Azure Private DNS zones while maintaining centralized management.
- ✗
A standard Azure Public DNS Zone
Why it's wrong here
Public DNS zones are designed for internet-facing records and are visible to any client globally. Using a public zone for internal infrastructure resolution introduces significant security risks and does not provide the necessary integration with Azure Virtual Networks required for resolving private IP addresses of internal cloud resources.
- ✗
Azure Application Gateway
Why it's wrong here
Application Gateway is a Layer 7 load balancer that handles web traffic and SSL termination rather than DNS name resolution services. While it can assist with routing traffic to back-end pools, it lacks the specialized functionality required to process and respond to DNS queries from on-premises DNS servers.
Visual reference
About these practice questions
This AZ-802 question is part of Courseiva's 116-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.