Question
Your network contains three Active Directory Domain Services (AD DS) forests as shown in the following exhibit.
The network contains the users shown in the following table.
The network contains the security groups shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise. select No.
NOTE: Each correct selection is worth one point.
Hot Area:
| Name | Domain |
| --- | --- |
| User1 | east.contoso.com |
| User2 | fabrikam.com |
| Name | Type | Domain |
| --- | --- | --- |
| Group1 | Domain local | west.adatum.com |
| Group2 | Universal | contoso.com |
| Group3 | Universal | east.contoso.com |
Explanation
Statement 1 (Yes): Group1 is a domain local group in west.adatum.com. A domain local group can contain accounts from any trusted domain. The two-way forest trust between contoso.com and adatum.com covers every domain in both forests, so User1 from east.contoso.com can be added to Group1.
Statement 2 (No): Group3 is a universal group in east.contoso.com. A universal group can contain accounts only from domains in its own forest. User2 belongs to fabrikam.com, a separate forest, so User2 cannot be added to Group3.
Statement 3 (No): fabrikam.com has a forest trust with adatum.com only. A forest trust cannot be extended to a third forest, so the trusts contoso.com-adatum.com and adatum.com-fabrikam.com do not create a trust between contoso.com and fabrikam.com. With no trust path, fabrikam.com cannot resolve Group2 from contoso.com, and Group2 cannot be granted permissions on resources in fabrikam.com.
