Contoso runs an on-premises data center connected to an Azure hub VNet via ExpressRoute. On-premises servers must resolve records hosted in an Azure private DNS zone (contoso-internal.com) that is linked to the hub VNet. Contoso does not want to deploy and manage DNS server VMs in Azure. Which Azure DNS Private Resolver component must you deploy and reference so that on-premises DNS servers can forward queries into Azure and receive answers from the linked private DNS zone?