Your network contains two Active Directory forests named contoso.com and adatum.com.
Both forests contain multiple domains. All domain controllers run Windows Server 2012 R2.
Contoso.com has a one-way forest trust to adatum.com.
A domain named paris.eu.contoso.com hosts several legacy applications that use NTLM authentication.
Users in a domain named london.europe.adatum.com report that it takes a long time to be authenticated when they attempt to access the legacy applications
hosted in paris.eu.contoso.com.
You need to reduce how long it takes for the london.europe.adatum.com users to be authenticated in paris.eu.contoso.com.
What should you do?
A.
Create a shortcut trust.
B.
Create an external trust between the forest root domains.
C.
Disable SID filtering on the existing trust.
D.
Create an external trust.
Explanation:
A)
Shortcut trusts are one-way or two-way, transitive trusts that can be used when administrators need to optimize the authentication process.
Authentication requests must first travel a trust path between domain trees, and in a complex forest this can take time, which can be reduced with shortcut trusts.
B)
Use external trusts to provide access to resources located on a Windows NT 4.0 domain or a domain located in a separate forest that is not joined by a forest
trust.
C)
Filters users or SIDs from one domain
D)
Use external trusts to provide access to resources located on a Windows NT 4.0 domain or a domain located in a separate forest that is not joined by a forest
trust
http://technet.microsoft.com/en-us/library/cc737939(v=ws.10).aspx
http://technet.microsoft.com/en-us/library/cc775736(v=ws.10).aspx
http://technet.microsoft.com/en-us/library/cc772633(v=ws.10).aspx
The correct answer would be D. A shortcut trust cannot be created between domains in two different forests. They can only be created between domains in the same forest.
Answer is D
0
0
I think A is correct, it would shorted the time between the sub domain and the root, the other two trusts are for when you do not have a forest trust, which is stated in the question.
B,C and D won’t work, so…..
“Once you eliminate the impossible, whatever remains, no matter how improbable, must be the truth.”
1
0
A is the quickest route.
“Use shortcut trusts to improve user logon times between two domains within An Active Directory forest. This is useful when two domains are separated by two domain trees.”
https://technet.microsoft.com/en-us/library/cc730798(v=ws.11).aspx
0
0
bob is correct. The external trust between the child domains in SEPARATE FORESTS will improve performance of the resource access. A side note, the NTLM resource domain (as described in the scenario) is equivalent to an NT 4.0 resource domain (as specified for external trust in the “show answer”).
0
1
D
“2 separate forests” hence external
0
0
Answer: A
Create external trust between london.europe.adatum.com and paris.eu.contoso.com. This would be a SHORTCUT TRUST, as there is already a trust setup for the parent domains. A shortcut trust in this case is just an external trust under a different name.
https://technet.microsoft.com/en-us/library/cc754538(v=ws.11).aspx
3
0
Exam Ref 70-412 – Microsoft press:
You configure shortcut trust when you want to speed up authentication between two domains in the same forest.
Answer is D – external trust – because of different forests, even when they are trusted.
0
0