70-296 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Environment for a W2K MCSE Certification Exam

Demo Question 11.

You work as the network administrator at EliteCertify.com. The EliteCertify.com network consists of a single Active Directory forest that contains several domains each of which further contain child domains. The functional level of the forest is set at Windows Server 2003. You are currently busy creating a shared folder on a file server named EliteCertify -FS03. This shared folder is intended for use in one of the child domains in the forest. EliteCertify.com has a partner company and in this company there is a group of employees who will also require access to this shared folder. This group of users all belong to n Active Directory child domain in another forest. You received instruction from the CIO to grant that group of employees in the partner company access to the shared folder. You now need to comply with the instruction, but you do not want these users to be able to access any other resources on the EliteCertify.com forest. What should you do?

A. An external trust with domain-wide authentication should be created.
B. A forest trust with domain-wide authentication should be created.
C. An external trust with selective authentication should be created.
D. A forest trust with selective authentication should be created.


Display Answer

Answer: C

Explanation: An external trust is a one-way or two-way non-transitive trust between a local domain and a domain in another forest, or between a local domain and a Windows NT domain. An external trust from the domain where EliteCertify -FS03 resides to the partner company domain where users require access to a resource in your forest will allow those users to authenticate directly to your resource domain. Selective authentication allows users from a trusted domain only to those resources to which they are explicitly allowed to authenticate Incorrect answers: A. Domain-wide authentication means that users from a trusted domain will have the same level of access to local resources that it provides users from the local forest. Though an external trust creation would be correct, the domain-wide authentication will cause problems. B. A forest trust is a one-way or two-way transitive trust between two forests that operates on the same functional level. You cannot create a forest trust with domain-wide authentication in this case: it would expose the EliteCertify.com resources to the partner company and it is also not mentioned that the functional level of the partner forest is set at Windows Server 2003. Domain-wide authentication means that users from a trusted domain will have the same level of access to local resources that it provides users from the local forest. D. A forest trust is a one-way or two-way transitive trust between two forests that operates on the same functional level. You cannot create a forest trust with selective authentication in this case: it is not mentioned that the functional level of the partner forest is set at Windows Server 2003.