You have an Azure virtual network named Vnet1 that hosts an Azure firewall named FW1 and 150 virtual machines. Vnet1 is linked to a private DNS zone named conto...

You have an Azure virtual network named Vnet1 that hosts an Azure firewall named FW1 and 150 virtual machines. Vnet1 is linked to a private DNS zone named contoso.com. All the virtual machines have their name registered in the contoso.com zone.
Vnet1 connects to an on-premises datacenter by using ExpressRoute.
You need to ensure that on-premises DNS servers can resolve the names in the contoso.com zone.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Modify the DNS server settings of Vnet1. B. For FW1, configure custom DNS server. C. For FW1, enable DNS proxy. D. On the on-premises DNS servers, configure forwarders that point to the frontend IP address of FW1. E. On the on-premises DNS servers, configure forwarders that point to the Azure provided DNS service at 168.63.129.16.