Your network contains the Active Directory Domain Services (AD DS) forests shown in the following table.
You need to configure trust relationships as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
A forest trust is a transitive trust between the root domains of two forests that, once established, automatically extends to every domain within both forests, so a single two-way forest trust between contoso.com and fabrikam.com allows users in any of contoso.com, europe.contoso.com, and asia.contoso.com to authenticate to (and be authorized for) resources in fabrikam.com or research.fabrikam.com, and vice versa — fully satisfying a requirement that users from any domain in either forest reach authorized resources in any domain of the other forest. Trust relationships do not chain across separate, independently-configured trust boundaries: a forest trust between contoso.com and fabrikam.com and a separate external trust between research.fabrikam.com and adatum.com are two unrelated, non-transitive relationships, so no trust path exists directly between the contoso.com and adatum.com forests. For the narrower requirement that only adatum.com users need access to research.fabrikam.com specifically, a one-way external trust is the correct minimally-scoped tool: external trusts are non-transitive and must be created with the resource domain trusting the account domain, so configuring research.fabrikam.com to trust adatum.com lets adatum.com's users be authorized for resources in research.fabrikam.com without granting access to the rest of either forest.
Community Discussion