You are a security administrator for Contoso, Ltd. The network consists of two Active Directory forests named contoso.com and public.contoso.com. All servers run Windows Server 2003. All client computers run Windows XP Professional.

The network consists of an IEEE 802.11b wireless LAN (WLAN). Employees and external users use the WLAN. User accounts for employees are located in the contoso.com forest. User accounts for external users are located in the public.contoso.com forest. External users, computers do not have computer accounts in the public.contoso.com forest. To increase security, you upgrade the network hardware to support IEEE 802.1x. You configure a public key infrastructure (PKI). You issue Client Authentication certificates to employees, to client computers used by employees, and to external users.

You need to configure the WLAN to authenticate employees and external users. What should you do?

A.
Configure each wireless access point to forward RADIUS requests to a server running Internet Authentication Service (IAS). Configure the IAS server to use a connection request policy to forward the requests to the appropriate forest.

B.
Configure each wireless access point to forward requests to an lnternet Authentication Service (IAS) server in the contoso.com forest. Configure the IAS server in the contoso.com forest to use the Tunnel-Server-Endpt attribute.

C.
Use the Connection Manager Administration Kit (CMAK). Configure one connection profile for external users. Configure a second connection profile for employees.

D.
Establish a forest trust relationship between the contoso.com forest and the public.contoso.com forest.