Implement On-Premises and Hybrid Name Resolution AZ-800 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   You need to configure DNS so that queries for the domain 'adventureworks.com' are sent to a specific DNS server at 10.0.0.10, while all other queries are forwarded to the ISP's DNS server. What should you configure?

   • AA stub zone for adventureworks.com
   • BA standard forwarder for all queries
   • CA conditional forwarder for adventureworks.com
   • DA secondary zone for adventureworks.com
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   Your company has a DNS server that is authoritative for contoso.com. You want to block resolution of a specific hostname (bad.contoso.com) for all clients except the security team's subnet. What should you configure?

   • AA firewall rule on the DNS server to block queries for bad.contoso.com.
   • BA host record for bad.contoso.com pointing to 0.0.0.0.
   • CA DNS policy that returns NXDOMAIN for bad.contoso.com for all clients, and a separate policy that allows resolution for the security team's subnet.
   • DA conditional forwarder for bad.contoso.com to a non-existent server.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A company has a DNS zone 'contoso.com' that is Active Directory-integrated. They want to enable DNSSEC, but they are concerned about the impact on legacy clients that do not support DNSSEC validation. They also want to ensure that the zone remains available during key rollovers. What should you do?

   • AEnable DNSSEC only on a secondary zone.
   • BEnable DNSSEC signing on the zone and configure the DNS server to serve unsigned responses to clients that do not support DNSSEC.
   • CEnable DNSSEC signing and require all clients to validate.
   • DDisable DNSSEC to avoid compatibility issues.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company runs a Windows Server DNS server for 'contoso.com'. They want to block resolution of 'blocked.contoso.com' for clients in the 192.168.10.0/24 subnet, but allow it for other clients. What should you configure?

   • AA firewall rule on the DNS server blocking that subnet.
   • BRemove the A record for 'blocked.contoso.com' and add it to a different zone.
   • CA DNS policy with a subnet condition and a deny action for that record.
   • DCreate a separate zone for that subnet and configure it to return NXDOMAIN.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   You have an Azure VNet with VMs that need to resolve each other using custom DNS names. You have created an Azure Private DNS zone and linked it to the VNet. You have also configured the VNet to use a custom DNS server (a Windows Server VM). You need to ensure that the VMs can resolve names in the private zone. What should you configure on the custom DNS server?

   • AA conditional forwarder for the private zone to Azure DNS (168.63.129.16).
   • BA forwarder for all queries to Azure DNS.
   • CA secondary zone for the private zone.
   • DA stub zone for the private zone.
   Reveal Solution Discussion Select an answer first