Your network contains two forestsnamed contoso.comand fabrikam.com.
The functional levelof all the domainsis Windows Server 2003.
The functional levelof both forestsis Windows 2000.
You need to create a trust between contoso.com and fabrikam.com.
The solution must ensure that users from contoso.com can only access the servers in fabrikam.com
that have the Allowed to Authenticate permission set.
What should you do?
To answer, move the appropriate actions from the Possible Actions list to the Necessary Actions area and
arrange them in the correct order.
Answer: 
Explanation:
Still not really sure whether an external trust or forest trust is needed here. Just left it as it is.
Reference:
http://technet.microsoft.com/en-us/library/cc787623.aspx
Selective authenticationover an external trust restricts access to only those users in a trusted domain who
have been explicitly given authentication permissions to computer objects (resource computers) that reside in
the trusting domain. To explicitly give authentication permissions to computer objects in the trustingdomain to
certain users, administrators must grant those users the Allowed to Authenticate permission in Active Directory.
Although your solution would work, I’d perhaps suggest forest trust, otherwise raising functional levels is also a mute point…
0
0
+1
raising forest functional levels is understandable for “forest trusts”.
external trusts are Non-transitive, and the problem probably talking about a trust between two forests (not the two roots domains)
0
0