Configuring Replicated Conditional Forwarders in AD DS

AZ-802 By islever Editorial Last updated

Implement on-premises and hybrid name resolution

Short answer

B Create an Active Directory-integrated conditional forwarder for fabrikam.com that uses 172.16.10.10 and 172.16.10.11.

Question

Your network contains an on-premises Active Directory Domain Services (AD DS) forest named contoso.com.
The forest contains three domain controllers that have the DNS Server role installed and host an Active Directory-integrated zone for contoso.com. The DNS servers use existing forwarders for internet name resolution.
You have a partner company that owns a DNS namespace named fabrikam.com and provides DNS servers at IP addresses 172.16.10.10 and 172.16.10.11 over a Site-to-Site (S2S) VPN.
You need to configure the DNS servers in the contoso.com forest. The solution must meet the following requirements:
Send queries for fabrikam.com to the partner company’s DNS servers.
Continue to use the existing forwarders for other external namespaces.
Apply the configuration to all the current and future DNS servers on the domain controllers in contoso.com.
What should you do?
  1. Configure forwarders that use 172.16.10.10 and 172.16.10.11.
  2. Create an Active Directory-integrated conditional forwarder for fabrikam.com that uses 172.16.10.10 and 172.16.10.11. Correct Answer
  3. Create a locally stored conditional forwarder for fabrikam.com that uses 172.16.10.10 and 172.16.10.11.
  4. Configure root hints that use 172.16.10.10 and 172.16.10.11.

Key Takeaways

The main trap is confusing local vs. AD-integrated storage; only AD-integrated conditional forwarders replicate to future servers in the domain.

Learn how to configure DNS resolution for partner namespaces in a hybrid network using Active Directory-integrated conditional forwarders to ensure automatic replication to all domain controllers.

Common mistake: Choosing Option C (locally stored) is common, but it fails because local configurations do not replicate to new domain controllers, requiring manual setup on each server.

Expert Analysis

The scenario requires configuring DNS resolution for the fabrikam.com namespace within a Windows Server domain environment. The key constraint is that the configuration must apply to all current and future DNS servers in the forest.

Option B is correct because creating an Active Directory-integrated conditional forwarder stores the zone data in Active Directory Domain Services (AD DS). Since the DNS servers are domain controllers hosting AD-integrated zones, any changes to this conditional forwarder are replicated automatically to all other domain controllers running the DNS role. This ensures that new servers added to the forest inherit the configuration without manual intervention.

Option A is incorrect because standard forwarders apply to the entire server and would handle all non-local queries, violating the requirement to continue using existing forwarders for other external namespaces. Additionally, they do not replicate across servers.

Option C is incorrect because locally stored conditional forwarders exist only on the specific server where they are configured. They do not replicate via AD DS, failing the requirement for future servers.

Option D is incorrect because root hints are used for resolving names outside of any known internal or forwarder zones by querying the internet's root servers. Replacing or adding to root hints with partner IPs would break general internet resolution and does not target fabrikam.com specifically.

The comment noting that AD integration replicates the configuration confirms the mechanism: AD replication propagates the conditional forwarder settings to all participating DNS servers.

Exam Strategy

When a question specifies 'current and future' servers in a domain environment, look for solutions that leverage Active Directory replication mechanisms. For DNS, this means choosing AD-integrated zones or forwarders over local files. Always verify if the scope is server-specific (local) or domain-wide (AD-integrated).

Frequently Asked Questions

Why can't I use standard forwarders for the partner namespace?

Standard forwarders apply to all external queries. Using them would bypass your existing internet forwarders for all domains, not just fabrikam.com, breaking the requirement to keep existing forwarders for other namespaces.

What happens if I add a new domain controller later?

If you use an Active Directory-integrated conditional forwarder, the configuration is stored in AD DS. When you promote a new server to a domain controller and install the DNS role, it will receive the replicated forwarder configuration automatically.

More AZ-802 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. Ryan1002 👍 1 Answered B
    Replicates the conditional forwarder configuration through Active Directory, making it available to current and future domain controllers that host DNS and receive the replicated configuration.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

AD DS Domain Controller Promotion and Replication

S-grade

Who Can Install and Authorize a DHCP Server in a Multi-Domain Forest?

S-grade

Handling Enforced GPOs with Block Inheritance in AD DS

A-grade

Group Policy Preferences: Filtering and Application Logic

A-grade

Practice All AZ-802 Questions

Access 125 questions with complete answers and detailed explanations.

View Full AZ-802 Practice Test →

← Back to AZ-802 Study Guide