Question
Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. Contoso.com contains three child domains named amer.contoso.com, apac.contoso.com, and emea.contoso.com. Fabrikam.com contains a child domain named apac.fabrikam.com. A bidirectional forest trust exists between contoso.com and fabrikam.com.
You need to provide users in the contoso.com forest with access to the resources in the fabrikam.com forest. The solution must meet the following requirements:
• Users in contoso.com must only be added directly to groups in the contoso.com forest.
• Permissions to access the resources in fabrikam.com must only be granted directly to groups in the fabrikam.com forest.
• The number of groups must be minimized.
Which type of groups should you use to organize the users and to assign permissions? To answer, drag the appropriate group types to the correct requirements. Each group may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation
Organize users: Universal. A universal group can contain user accounts from any domain in the same forest, so one universal group in contoso.com can hold users from contoso.com, amer.contoso.com, apac.contoso.com and emea.contoso.com. Global groups can contain accounts only from their own domain, so you would need four of them. A universal group can be a member of domain local groups in a trusting forest.
Assign permissions: Domain local. A domain local group can contain accounts and groups from trusted forests, and it is used to grant permissions to resources in its own domain. Create domain local groups in fabrikam.com, add the contoso.com universal group to them and grant them the permissions, so users are only added to contoso.com groups and permissions are only granted to fabrikam.com groups.
