Question
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com.
You have a partner company named ADatum Corporation that has an AD DS forest named adatum.com.
You configure the trust relationship shown in the following exhibit.
The forests contain the groups shown in the following table.
The ADatum domains contain the member servers shown in the following table.
For each of the following statements, select Yes if the statement is true Otherwise, select No.
NOTE: Each correct selection is worth one point.
| Name | Type | In domain |
| --- | --- | --- |
| Group1 | Domain local | contoso.com |
| Group2 | Domain local | adatum.com |
| Group3 | Global | west.adatum.com |
| Group4 | Universal | contoso.com |
| Name | In domain |
| --- | --- |
| Server1 | adatum.com |
| Server2 | west.adatum.com |
Explanation
The exhibit shows a one-way forest trust with the arrow pointing from contoso.com to adatum.com: contoso.com is the trusting forest and adatum.com is the trusted forest, so principals from the adatum.com forest (including west.adatum.com, a child domain in that forest) can be granted access to contoso.com resources, but not the other way round. Statement 1 (No): Group2 is a domain local group, and a domain local group can be assigned permissions only within its own domain (adatum.com). Server2 is in west.adatum.com. Statement 2 (Yes): A domain local group can contain global groups from any trusted domain. Group3 is a global group in west.adatum.com, which is trusted by contoso.com through the transitive forest trust, so Group3 can be added to Group1 in contoso.com. Statement 3 (No): A universal group can be assigned permissions in its own forest or in trusting forests. Group4 is in contoso.com, and adatum.com does not trust contoso.com (the trust is one-way), so Group4 cannot be assigned permissions on Server1 in adatum.com.
