Question
Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and adatum.com. A two-way external trust exists between contoso.com and adatum.com. The forests contain the servers shown in the following table.
You need to ensure that users from contoso.com can access only shared resources hosted on SRV1. The solution must meet the following requirements:
• Ensure that users from adatum.com can access the resources hosted in contoso.com.
• Prevent the contoso.com users from accessing any other resources in adatum.com.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
| Name | In domain | Description |
| --- | --- | --- |
| DC1 | contoso.com | Hosts all FSMO roles |
| DC2 | adatum.com | Hosts all FSMO roles |
| SRV1 | adatum.com | File server |
| SRV2 | adatum.com | File server |
Explanation
Modify the trust on: DC2. Selective authentication restricts users from the trusted domain (contoso.com) when they access computers in the trusting domain (adatum.com), so it is set on adatum.com's outgoing trust to contoso.com. Active Directory Domains and Trusts shows authentication settings only for the outgoing side of a trust, so you make the change on a domain controller in adatum.com, which is DC2. Changing the trust on DC1 would restrict adatum.com users instead, and they must keep their access to contoso.com, so neither DC1 nor DC1 and DC2 is right.
Modify the permissions for the: Computer object of SRV1. Once selective authentication is on, contoso.com users can authenticate only to computers on which they have been granted the Allowed to Authenticate permission. You grant that permission on SRV1's computer object in adatum.com, so they can reach SRV1 and no other server. Share and NTFS permissions on the file shares still apply afterwards, but on their own they do not let the users authenticate to SRV1. The DC1 computer object belongs to contoso.com and does not control access to adatum.com resources.
