Your network contains an Active Directory forest named contoso.com.
A partner company has a forest named fabrikam.com. Each forest contains one domain.
You need to provide access for a group named Research in fabrikam.com to resources in contoso.com. The
solution must use the principle of least privilege.What should you do?
A.
Create an external trust from fabrikam.com to contoso.com. Enable Active Directory split permissions in
fabrikam.com.
B.
Create an external trust from contoso.com to fabrikam.com. Enable Active Directory split permissions in
contoso.com.
C.
Create a one-way forest trust from contoso.com to fabrikam.com that uses selective authentication.
D.
Create a one-way forest trust from fabrikam.com to contoso.com that uses selective authentication.
I guess the ans is D
0
12
We have resources in contoso.com and a group in fabrikam.com.
The domain/forest that holds the resources needs to trust the domain that holds the users/groups. The TRUSTING forest creates the trust towards the TRUSTED forest.
So in this case, contoso needs to trust fabrikam. We create a trust from contoso to fabrikam, stating that specific users (selective authentication) in fabrikam are trusted to resources in contoso. You then use ACL’s in contoso to determine which resources those are.
15
0