Your network consists of two Active Directory forests. The Active Directory forests are configured as shown in the following table. (Click the Exhibit) The servers in both forests run Windows Server…

Question

Options

• AReplace the existing forest trust with an external trust between the contoso.com domain and
• BReplace the existing forest trust with an external trust between the contoso.com domain and
• CSet the authentication scope of the existing forest trust in the fabrikam.com domain to Allow
• DSet the authentication scope of the existing forest trust in the fabrikam.com domain to Allow

• A
  3% (1)
• B
  10% (3)
• C
  83% (25)
• D
  3% (1)

Explanation

To ensure that the users in the ContosoSales global group are allowed to access server1.Fabrikam.com you need to assign the Access this computer from the network option to the ContosoSales global group in the local security policy of server1.Fabrikam.com to allow remote users to have permission to connect to the remote computer. To ensure that the ContosoSales global group users should not be allowed to access any other server in the Fabrikam.com forest, you need to grant the Allowed to Authenticate permission to the ContosoSales global group on the server1.Fabrikam.com computer object. The Allowed to authenticate on an object allows you to set the selective authentication on an incoming external trust from the external domain. Authentication requests made from one domain to another are successfully routed in order to provide a seamless coexistence of resources across domains. Users can only gain access to resources in other domains after first being authenticated in their own domain. 75f0eacfe94c1033.mspx?mfr=true

No community discussion yet for this question.