Your on-premises network has a DNS server named Server1. An S2S VPN connects the on-premises network to VNet1 in your Azure subscription. You need Server1 to resolve the DNS name of storage1 in Azure while keeping cost and administrative overhead to a minimum. Which solution should you use?

Azure DNS Private Resolver is the correct solution because it allows on-premises DNS servers to resolve Azure Private DNS zones without requiring a VPN gateway or complex DNS forwarding rules on virtual machines. It acts as a DNS forwarder within Azure, enabling seamless resolution of Azure private endpoints and other private resources from your on-premises network. An Azure public DNS zone is incorrect because it's for public domain names and cannot resolve private Azure resources. An Azure Private DNS zone is necessary but insufficient on its own, as it doesn't provide a mechanism for on-premises servers to query it directly without additional configuration. An Azure virtual machine running a DNS service would work but introduces higher cost and administrative overhead compared to the managed service offered by Azure DNS Private Resolver.