You are planning a two-way forest trust between the Contoso and Fabrikam organizations. You want to ensure that only authorized users from each trusted forest have access to resources in the trusting forest. Many resources are available to authenticated users in each forest. These resources should not be available to users in the trusted forest unless explicitly allowed. Which of the following plans should you make?

A. Implement selective authentication.

B. Implement SID filtering.

C. Implement user principal name (UPN) suffix routing.

D. Implement forest-wide authentication.