Question
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains the groups shown in the following table.
You need to implement a group nesting strategy.
Which groups can be added as members of Group12, and which groups can be added as members of Group21? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
| Name | Type | In domain |
| --- | --- | --- |
| Group11 | Domain local | contoso.com |
| Group12 | Global | contoso.com |
| Group13 | Global | contoso.com |
| Group14 | Universal | contoso.com |
| Group21 | Universal | east.contoso.com |
Explanation
Group12: Group13 only — Group12 is a global group, and in AD DS a global group can only contain user accounts, computer accounts, and other global groups from its own domain. Group13 is the only other same-domain global group available, so it is the only valid nested member; Group14 (universal scope) and Group11 (domain local scope) cannot be nested inside a global group, and Group21 is in a different domain, which global scope never permits.
Group21: Group12, Group13, and Group14 only — Group21's scope accepts members from any domain in the forest, so the global groups Group12 and Group13 and the universal group Group14 can all be nested into it. The option that also includes Group11 is wrong because Group11 is a domain local group, and a domain local group can only be nested into another domain local group in its own domain — it can never become a member of a group in a different domain.
