 You can add User1 to Group1. Yes

 You can add User2 to Group3. No

 You can grant Group2 permissions to the resources in the fabrikam.com domain. No

The Administering Windows Server Hybrid Core Infrastructure materials describe how group scopes and forest trusts determine where y ou can add members and where you can assign permissions. For Domain Local groups: “Domain local groups are intended to secure resources in the local domain and can include accounts and groups from any trusted domains or forests .” With a two-way forest trus t between contoso.com and adatum.com , a user from east.contoso.com (User1) can therefore be added to Group1 , a domain local group in west.adatum.com → Yes .

For Universal groups, the guide states: “Universal groups are replicated to the global catalog and c an contain users and groups from any domain in the same forest ; they are designed for cross-domain (in-forest) membership.” Because User2 is in fabrikam.com (a different forest), they cannot be added to Group3 (a Universal group in east.contoso.com ) → No .

On assigning permissions across forests , the materials clarify: “A security principal can be granted access only where a trust exists with its account forest. Forest trusts are not transitive to other forests .” Since fabrikam.com trusts adatum.com but has no trust with contoso.com , you cannot grant Group2 (Universal in contoso.com ) permissions on fabrikam.com resources → No .