What is the difference between a domain and a forest in Active Directory Domain Services (AD DS)?

• A. A domain is the topmost boundary that groups multiple domains and shares a schema.
• B. A forest is a security boundary within a domain.
• C. A domain is a security boundary within a forest; a forest is the topmost boundary that groups one or more domains and shares a Schema and global catalog.
• D. A domain and forest are the same.

Answer: (C)

In AD DS, the forest is the top-level boundary that groups one or more domains and defines the shared Schema and Global Catalog for the whole forest. A domain is a security boundary contained within that forest, with its own users, computers, and policy settings. Domains within a forest trust each other by default, allowing users to access resources across domains while still applying domain-specific policies. The Schema describes object types and attributes and is shared across the entire forest, ensuring consistency, and the Global Catalog is a partial, replicated index of all objects in the forest that enables fast directory searches and cross-domain logon support. This distinction shows why the forest is the top-level boundary, while a domain is a boundary inside that forest.