Explanation:
You can add User1 to Group1: Yes. You can add User2 to Group3: No. You can grant Group2 permissions to the resources in the fabrikam.com domain: Yes.
A domain local group can accept members from any domain within its own forest, and, when a forest trust exists, from any domain in the entire trusted forest, because a forest trust extends to every domain in both forests, not just their root domains. Group1 is a domain local group in west.adatum.com (adatum.com forest), and User1 belongs to east.contoso.com, a child domain of contoso.com, which has a direct two-way forest trust with adatum.com covering both forests entirely; so User1 can be added to Group1. Group3, however, is a universal group, and universal group membership is restricted to principals from within the same single forest only, regardless of any trust - unlike domain local groups. User2 belongs to fabrikam.com, a separate forest from Group3 ' s forest (contoso.com), so User2 cannot be added to Group3 for that reason alone; there is also no trust path between contoso.com and fabrikam.com at all, since a forest trust is not transitive through an intermediate forest - adatum.com ' s separate trusts with each outer forest create no trust between them.
Granting permissions directly on a resource ' s ACL is different from group nesting, though: a universal group can be placed on an ACL in any domain that trusts its own forest, without the same-forest restriction that applies to membership. Because adatum.com (Group2 ' s forest) has a direct forest trust with fabrikam.com, Group2 can be granted permissions to resources in fabrikam.com.

Explanation:

Preparation: Shut down VM1. Memory configuration on VM1: Disable Dynamic Memory. PCIe NVMe configuration on HV1: Dismount Device1.
Discrete Device Assignment can only be attached to a virtual machine while that VM is completely powered off, not merely saved or paused, since the assignment operation reconfigures the VM ' s underlying hardware resource list at the virtualization stack level, an operation that requires the VM to be in the Off state; saving or pausing VM1 would leave its running state (and its currently assigned resources) intact rather than allowing the new device to be added, so shutting down VM1 is the necessary preparation step. Dynamic Memory must be disabled on any VM that will use DDA because DDA-assigned devices, being passed through directly to the VM with minimal hypervisor mediation, are incompatible with the memory ballooning and hot-add
/remove behavior Dynamic Memory performs, and Hyper-V will not permit DDA assignment to a VM with Dynamic Memory still enabled; increasing the memory buffer or setting memory weight to High only adjusts Dynamic Memory ' s own behavior and does not resolve the incompatibility. On the host side, a device slated for DDA use must first be dismounted from the host ' s own device tree, using Dismount- VMHostAssignableDevice, which detaches it from HV1 ' s host operating system (which cannot use it while it is assigned) without physically removing it, making it available to be mounted into the VM afterward with Add-VMAssignableDevice; simply enabling the device (it is already disabled and DDA-capable, not needing re-enabling for this step) or removing it entirely goes beyond what this specific assignment preparation requires.

Explanation:
Sync groups: 3. Storage Sync Services: 1.
In Azure File Sync, a sync group defines a single sync topology and can contain exactly one cloud endpoint (one Azure file share) but can contain multiple server endpoints (on-premises server locations) that all sync to that same file share. Fabrikam needs newyorkfiles to sync only to FS1, seattlefiles to sync only to FS2, and companyfiles to sync to both FS1 and FS2. Because each Azure file share can only belong to one sync group, newyorkfiles requires its own sync group with a single server endpoint on FS1, seattlefiles requires its own sync group with a single server endpoint on FS2, and companyfiles requires a third sync group whose one cloud endpoint (companyfiles) has two server endpoints, one on FS1 and one on FS2, which Azure File Sync fully supports within a single sync group. That gives a minimum of three sync groups. A Storage Sync Service is the top-level Azure resource that contains and manages sync groups, and there is no requirement here that forces the shares into separate Storage Sync Service instances (such as differing regions or subscriptions); a single Storage Sync Service can hold all three sync groups. Therefore only one Storage Sync Service is required.

Explanation:
Modify the trust on: DC2. Modify the permissions for the: Computer object of SRV1.
By default, an external trust grants every authenticated user in the trusted domain (contoso.com, from adatum.
com ' s perspective) the implicit right to attempt authentication against any computer in the trusting domain (adatum.com), with actual access then governed only by each resource ' s own ACLs -- there is no built-in restriction limiting which specific computers users can even attempt to authenticate against. Selective Authentication is the trust setting that changes this: once enabled on the trust from the perspective of the domain being accessed, authenticating users from the other side must be explicitly granted the " Allowed to Authenticate " permission on the specific computer object(s) they should be allowed to reach; without that permission, authentication is denied outright, regardless of any file/share-level permissions. Because the goal is to restrict contoso.com users specifically -- without restricting the reverse direction (adatum.com users accessing contoso.com resources, which must remain unrestricted) -- Selective Authentication must be enabled only on the adatum.com side of the trust, which is configured on DC2, the domain controller hosting the FSMO roles (and by extension the trust configuration) for adatum.com; enabling it on DC1 or on both would risk also restricting the other direction. Once Selective Authentication is enabled on that side, the " Allowed to Authenticate " permission must then be granted specifically on SRV1 ' s own computer object (not on DC1 ' s, and not merely on SRV1 ' s file shares, since Selective Authentication is enforced at the computer- object authentication level, before any share-level permission is even evaluated) for the relevant contoso.com users or groups.

When a standalone (workgroup) server is promoted to become the FIRST domain controller of a brand-new domain, its existing local SAM accounts are not simply discarded as they would be if the server instead joined an already-existing domain; with no pre-existing domain database to join, the local SAM becomes the seed for the new domain ' s Active Directory database, and local user accounts are converted into domain accounts, carrying forward their prior local group memberships in equivalent form. Because User3 was a member of the local Administrators group before promotion, User3 becomes administrator-equivalent in the new east.
contoso.com domain, granting the default " Allow log on locally " right on that domain ' s own domain controllers. User4, previously only in the local Users group, becomes an ordinary domain user with no special local-logon right on a DC. Domain controllers, by default, grant " Allow log on locally " only to privileged groups such as Administrators, Account Operators, Backup Operators, Print Operators, and Server Operators
-- not to ordinary Domain Users. User1, a member of the forest-wide Enterprise Admins group, is administrator-equivalent everywhere in the forest, including the new DC, so User1 can log on locally. User2, a plain Domain Users member, has no such right. Therefore, only User1 and User3 can sign in to Server1 locally.