Exam 70-744 topic 2 question 6 discussion

Actual exam question from Microsoft's 70-744

Question #: 6
Topic #: 2

Your network contains an Active Directory forest named contoso.com. The forest functional level is Windows Server 2012. The forest contains 20 member servers that are configured as file servers. All domain controllers run Windows Server 2016.
You create a new forest named contosoadmin.com.
You need to use the Enhanced Security Administrative Environment (ESAE) approach for the administration of the resources in contoso.com.
Which two actions should you perform? Each correct answer presents part of the solution.

A. Configure contoso.com to trust contosoadmin.com.
B. From the properties of the trust, enable selective authentication.
C. Configure contosoadmin.com to trust contoso.com.
D. From the properties of the trust, enable forest-wide authentication.
E. Configure a two-way trust between both forests.

Show Suggested Answer

Suggested Answer: AB 🗳️
References:
https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#esae-administrative-forest- design-approach

by Flacky_Penguin32 at Dec. 3, 2020, 4:55 a.m.

Comments

Submit Cancel

Yebubbleman

4 years, 5 months ago

Answer Choice D. kind of defeats most of the philosophy in 70-744. Given answer is definitely correct.

upvoted 1 times

Yebubbleman

4 years, 5 months ago

Incidentally, you're not going to have the bastion forest trust the production forest. Nor would you have a two-way trust. Both of those things would defeat the entire point of the exercise!

upvoted 1 times

...

SamsOtro

4 years, 6 months ago

Agree with A & B. Selective one way trust from production to admin forest.

upvoted 1 times

...

Flacky_Penguin32

4 years, 6 months ago

Given answer is correct.

upvoted 1 times

...