Your company named Contoso and another company named Fabrikam establish a partnership. The
Contoso network consists of one Active Directory domain named contoso.com. File servers are
installed on the contoso.com domain. All file servers run Windows Server 2008. The Fabrikam
network consists of one Active Directory forest named fabrikam.com. You need to plan a solution to
enable Fabrikam users to access resources on the file servers. The solution must meet the following
requirements:
Ensure that Fabrikam users can access resources only on the file servers.
Ensure that Contoso users are denied access to Fabrikam resources.

What should you do first?

A.
Create a one-way forest trust so that Contoso trusts Fabrikam. Set selective authentication on the
trust.

B.
Create a one-way forest trust so that Fabrikam trusts Contoso. Set selective authentication on the
trust.

C.
Create a one-way forest trust so that Contoso trusts Fabrikam. Set forest-wide authentication on
the trust.

D.
Create a one-way forest trust so that Fabrikam trusts Contoso. Set forest-wide authentication on
the trust.

Explanation:
To ensure that that the users of TechMasters.com can access resources only on the file servers of
Contoso.com and the users of Contoso.com cannot access any resource on fabrikam.com, you need
to create a one-way forest trust so that Contoso can trust fabrikam and allow the users of Contoso
to access its resources. Choosing Selective Authentication will allow you to specify which users in the
remote domain have access to which of the local resources. You need to select this option so that
you can restrict the access to only file server resources. Domain-Wide Authentication cannot be used
because it will authenticate all users in the remote forest for all resources in the local forest.
Choosing Selective Authentication will allow you to specify which users in the remote
domain have access to local resources
http://blogs.techrepublic.com.com/window-on-windows/?p=500