How does a NAS server handle a Kerberos ticket for a cross domain authentication

Question I would have are:
1) What IPs interactive with the DCs for AuthZ AuthN functions?
a) We assume this is a mgnt IP, and if so what is that IP?
2) What protocols are used for these interactions (we assume C/LDAP/S, Kerberos but are there more?)
a) In particular, for cross forest group membership lookups (given what we saw for the Alice share)

Business Impact: Active Directory Authentication across domains