Specific guidance on DNS and Azure network architecture

Question

Hi MS Support,

Could you please advice us on the following diagram:

Current Implementation:
Currently we have set up Virtual Network to use DNS Server which we have set it to be the private IP address of the Azure Firewall. This means all DNS queries will be forwarded to the Azure Firewall, the Azure Firewall has a DNS proxy set up to Inbound Private DNS Resolver. The Inbound Private DNS Resolver is within a hub extension virtual network that stores all of the current Private DNS Zone (Private DNS Zone linking is to the hub extension virtual network)

Suggested Solution from Internal support:
To prevent unauthorized VNets from resolving googleapis.com, there is another option of creating private DNS zones and attaching them to specific VNet.

Private DNS Zone Scoping

• Restrict the googleapis.com Private DNS Zone attachment to only the selected Databricks VNets.

• Ensure that no other VNets are linked to the Private DNS Zone.

Would the above suggested solution work? Noting that we keep the virtual network to use the DNS Server to resolve other private dns zones such as storage account.

Problem Statement:

1. If other VNET in the future require storage.googleapis.com to resolve different (e.g. Public) endpoints from Google, how will that be resolved if we were to use the current DNS set up in the hub extension virtual network?
2. Where will the entries be placed for resolution to same endpoint storage.googleapis.com?
3. While a firewall can restrict access to resources from unauthorised VNets, does it prevent DNS resolution?
4. If other VNets can resolve googleapis.com, unintended traffic may traverse the associated Private Service Connection, potentially leading to security risks or performance concerns. Is Azure Firewall restriction such as Deny rule suffice to prevent other VNet to resolve googlesapis.com?