AZ-800 practice question 240

Group3: Group1, Group2, Group4, and Group5 only — Group3 is a universal group, and Active Directory allows a universal group to contain user accounts, computer accounts, global groups, and other universal groups from any domain in the forest, so every global and universal group in the environment (Group1, Group2, Group4, and Group5) is a valid member. The one nesting a universal group can never accept is a domain local group, so the option that also includes Group6 (the domain local group) is wrong, and the narrower choices such as "Group1 and Group2 only" needlessly exclude the global groups that are perfectly legal members. Group5: Group4 only — Group5 is a global group, and a global group's membership is restricted to accounts and other global groups from its own domain; Group4 is the only other global group in that same domain, so it is the sole group that can be nested inside Group5. "Group2 and Group4 only" and "Group1 only" fail because universal groups cannot be nested into a global group, and "Group4 and Group6 only" fails because a domain local group can never be a member of a global group.