Question
Your network contains two Active Directory Domain Services (AD DS) forests as shown in the following table.
| Name | Domain |
|---|---|
| Contoso.com | South.contoso.com |
| Contoso.com | North.contoso.com |
| Fabrikam.com | West.fabrikam.com |
| Fabrikam.com | East.fabrikam.com |
West.fabrikam.com contains a file server named Fileserver01. South.contoso.com contains a global group named Group1.
You need to ensure that the members of Group1 can access a share on Fileserver01. The solution must ensure that the users in the fabrikam.com forest cannot access the resources in south.contoso.com.
Which type of trust should you implement?
- A. realm
- B. external Correct
- C. shortcut
- D. forest
Explanation
Create a one-way external trust in which West.fabrikam.com (the resource domain) trusts South.contoso.com (the account domain). An external trust is a non-transitive trust between two domains in different forests, so it links only these two domains instead of the whole forests. Because it is one-way, members of Group1 in South.contoso.com can be granted access to the share on Fileserver01, while users in the fabrikam.com forest gain no access to resources in south.contoso.com. A forest trust would join every domain of both forests, a shortcut trust works only between domains in the same forest, and a realm trust is for non-Windows Kerberos realms.
