Question
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the users shown in the following table.
| Name | Located in |
| --- | --- |
| User1 | Contoso\Users |
| User2 | Contoso\OU1 |
| User3 | Contoso\OU1\OU2 |
The domain has the Group Policy Objects (GPOs) shown in the following table.
| Name | Linked to | Enforcement |
| --- | --- | --- |
| GPO1 | Contoso.com | Enforce is enabled for the GPO link. |
| GPO2 | OU1 | None |
| GPO3 | OU2 | Block inheritance is enabled for OU2. |
The GPOs are configured to map a drive named H as shown in the following table.
| Name | Configuration |
| --- | --- |
| GPO1 | Drive H maps to \\server1\share. |
| GPO2 | Drive H maps to \\server2\share. |
| GPO3 | Drive H maps to \\server3\share. |
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Explanation
Statement 1 (No): User1 is in the default Users container (Contoso\Users), which is a container, not an OU, so GPOs cannot be linked to it. Only the domain-linked GPO1 applies, so drive H maps to \\server1\share, not \\server2\share.
Statement 2 (Yes): User2 is in OU1 and receives GPO1 (domain) and GPO2 (OU1). Normally the GPO linked closest to the user wins, but the GPO1 link is Enforced. Enforced links are processed last and win over conflicting settings in GPOs linked to lower-level containers, so drive H maps to \\server1\share.
Statement 3 (No): User3 is in OU2, which has Block inheritance enabled. Block inheritance stops GPO2 (linked to OU1) from applying, but it cannot block an Enforced link, so GPO1 still applies along with GPO3. Because GPO1 is enforced, its setting wins over GPO3's conflicting setting, so drive H maps to \\server1\share, not \\server3\share.
