70-296 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Environment for a W2K MCSE Exam Questions

Demo Question 9.

You work as the network administrator at EliteCertify.com. The EliteCertify.com network consists of a single Active Directory forest and a UNIX-based Kerberos V5 realm. The UNIX-based Kerberos V5 realm consists of the two child domains named EliteCertify.com, us. EliteCertify.com and uk. EliteCertify.com respectively. These three domains are located in one site. The following exhibit illustrates the EliteCertify.com forest structure: Exhibit: You received instruction from the CIO to allow the UNIX users in the child domains access only to the resources that they require. They should NOT have access to the resources in the forest root domain. You thus need to configure the appropriate trust / trusts in Active Directory to carry out this task. What should you do?

A. You should configure one outgoing transitive trust relationship.
B. You should configure two outgoing non-transitive trust relationships.
C. You should configure one incoming transitive trust relationship.
D. You should configure two incoming non-transitive trust relationships.


Display Answer

Answer: B

Explanation: A trust, per definition, is named from the trusting domain to the trusted domain. It is possible to configure an Active Directory domain and a non-Windows Kerberos V5 domain with either one-way or two-way transitive or non-transitive trust relationships. In this scenario the two child domains must trust the security principals in the realm. Thus you should configure an outgoing trust from each of the child domains: one outgoing non-transitive trust from each child domain. Incorrect answers: A. Transitivity means that trusts can be chained; this would not be advisable in this scenario. C. Transitive trusts, outgoing, between any of the domains and the realm would allow UNIX users the ability to access resources, for which they has permissions, in any domain in the forest including the forest root domain. D. Incoming trusts would be required if Windows users were to access resources in the realm.