Active Directory Trust Relationships Quiz

1.What are the two questions that distinguish Active Directory's five named trust types from one another?

• Whether the trust is transitive, and whether it is SID-filtered
• Whether it is created automatically as a side effect of forest structure or deliberately by an administrator, and whether it connects two individual domains or operates at the level of the entire forest
• Whether the trust is one-way or two-way, and whether it was created before or after the forest existed
• Whether the domains involved are in the same country, and whether they use the same DNS provider

2.Which two trust types are created automatically, without a deliberate administrative decision?

• External and forest trust
• Parent-child and tree-root trust
• Cross-link and external trust
• Tree-root and forest trust

3.What distinguishes a tree-root trust from a parent-child trust?

• A tree-root trust connects the forest root to the root of a newly added tree with a different namespace; a parent-child trust connects a domain to its immediate parent in the same tree
• A tree-root trust is created deliberately by an administrator, while a parent-child trust is created automatically
• A tree-root trust only exists in single-domain forests, while a parent-child trust requires at least two trees
• A tree-root trust extends transitively to every domain in the forest by default, while a parent-child trust is scoped to just the two domains involved

4.Why would an administrator add a cross-link (shortcut) trust?

• To shorten the authentication path between two domains that would otherwise route through a common ancestor
• To disable SID filtering between two domains in different forests
• To satisfy a requirement that every domain have at least one manually configured trust
• Because the parent-child trust between two domains failed to create itself automatically

5.What is the key structural difference between an external trust and a forest trust?

• An external trust extends to every domain in both organizations, while a forest trust is scoped to exactly one domain on each side
• An external trust is scoped to exactly one domain on each side; a forest trust, by default, extends transitively to every domain in both forests
• An external trust operates at the forest level, while a forest trust operates at the domain level
• They are functionally identical; the names just reflect whether the connection followed a merger or an acquisition

6.A colleague reports, 'there's a trust to the partner organization,' without naming the type. What is missing, and why does it matter?

• Nothing is missing; every inter-forest connection behaves identically regardless of type
• The specific type is missing; it determines the default scope and warrants a different response, a forest trust calls for a conversation with the partner's whole security team, while an external trust might only need a review of one account's access
• Only the trust's creation date is missing; type does not affect how a client should respond
• Only the direction (one-way or two-way) is missing; the type of trust is not relevant to a client conversation

7.During an assessment you find a cross-link trust between two domains in the same forest. What should that observation tell you?

• It is an automatic, common trust that requires no further investigation
• Someone made a deliberate performance decision to shorten a long authentication path in a large, deep forest, and it is worth asking who and why
• It indicates the forest has already been compromised
• It is identical in nature to a parent-child trust, just given a different name for documentation purposes