dig asks a single DNS server a question and prints its whole answer. That shows whether the server knows the name — without the resolver and /etc/resolv.conf.
A DNS server takes questions on port 53, mostly over UDP. ss finds it on the machine like any other service: -u is UDP, -p is the program. The output also has systemd-resolve lines: that is an Ubuntu service, covered two steps later.
dig @address name asks the server at that address. Two parts of the answer matter. The status: line is the outcome: NOERROR means the server answered without an error. ANSWER SECTION holds the records it found. The line web.lab.test. 0 IN A 127.0.0.10 is an A record: it ties the name to an IPv4 address.
Find the DNS server and ask it
Find which program accepts DNS queries on this machine, and ask the practice server 127.0.0.2 about the name web.lab.test.
First, predict
What will the server 127.0.0.2 answer about web.lab.test?
Now start the exercise, run the command and compare your prediction with the output.
Now the picture is complete: the site works, the DNS server 127.0.0.2 knows the name, and the resolver asks 127.0.0.9, where nobody listens.