Your network contains three Active Directory Domain Services (AD DS) forests as shown in the following exhibit: contoso.com (with a child domain east.contoso.com) has a two-way forest trust with adatum.com; adatum.com (with a child domain west.adatum.com) also has a two-way forest trust with fabrikam.com; there is no trust relationship directly between contoso.com and fabrikam.com. The network contains the users User1 (east.contoso.com) and User2 (fabrikam.com). The network contains the security groups Group1 (Domain local, west.adatum.com), Group2 (Universal, adatum.com), and Group3 (Universal, east.contoso.
com). For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE:
Each correct selection is worth one point.

contoso.com (child: east.contoso.com) < -forest trust- > adatum.com (child: west.adatum.com) < -forest trust-
> fabrikam.com. No trust between contoso.com and fabrikam.com.

User1: east.contoso.com. User2: fabrikam.com.

Group1: Domain local, west.adatum.com. Group2: Universal, adatum.com. Group3: Universal, east.contoso.
com.

Reveal Solution
Discussion
Correct Answer:

Explanation:
You can add User1 to Group1: Yes. You can add User2 to Group3: No. You can grant Group2 permissions to the resources in the fabrikam.com domain: Yes.
A domain local group can accept members from any domain within its own forest, and, when a forest trust exists, from any domain in the entire trusted forest, because a forest trust extends to every domain in both forests, not just their root domains. Group1 is a domain local group in west.adatum.com (adatum.com forest), and User1 belongs to east.contoso.com, a child domain of contoso.com, which has a direct two-way forest trust with adatum.com covering both forests entirely; so User1 can be added to Group1. Group3, however, is a universal group, and universal group membership is restricted to principals from within the same single forest only, regardless of any trust - unlike domain local groups. User2 belongs to fabrikam.com, a separate forest from Group3 ' s forest (contoso.com), so User2 cannot be added to Group3 for that reason alone; there is also no trust path between contoso.com and fabrikam.com at all, since a forest trust is not transitive through an intermediate forest - adatum.com ' s separate trusts with each outer forest create no trust between them.
Granting permissions directly on a resource ' s ACL is different from group nesting, though: a universal group can be placed on an ACL in any domain that trusts its own forest, without the same-forest restriction that applies to membership. Because adatum.com (Group2 ' s forest) has a direct forest trust with fabrikam.com, Group2 can be granted permissions to resources in fabrikam.com.