Managing Group Policy Application and Infrastructure in Windows Server 2012 R2

Answers

This section contains the answers to the lesson review questions in this chapter.

Lesson 1

1. Correct answer: B

   1. Incorrect. You use the Backup-GPO cmdlet to back up an existing GPO.
   2. Correct. You use the Import-GPO cmdlet to import settings from a backed-up GPO to an existing target GPO.
   3. Incorrect. You use the Restore-GPO cmdlet to restore a backed-up GPO to a previous state.
   4. Incorrect. You use the Copy-GPO cmdlet to create a copy of an existing GPO.

2. Correct answer: B

   1. Incorrect. You use the Copy-GPO cmdlet to create a copy of an existing GPO.
   2. Correct. You use the Restore-GPO cmdlet to restore a backed-up GPO to a previous state.
   3. Incorrect. You use the Import-GPO cmdlet to import settings from a backed-up GPO to an existing target GPO. Although it would import the settings from the backed-up GPO, it is possible that other settings not included in the original backed-up GPO were configured by your assistant.
   4. Incorrect. You use the Backup-GPO cmdlet to back up an existing GPO.

3. Correct answer: C

   1. Incorrect. You use the Active Directory Sites and Services console to manage Active Directory sites. You can’t use this console to configure GPO migration settings.
   2. Incorrect. You use this console to manage Active Directory security principals and containers. You can’t use this console to configure GPO migration settings.
   3. Correct. You use this tool to configure the migration table, which is necessary when migrating objects from one domain or forest to another.
   4. Incorrect. You use this to edit GPOs. You can’t use this console to configure GPO migration settings.

4. Correct answers: A, B, and C

   1. Correct. Members of the Group Policy Creator Owners group can create GPOs by default.
   2. Correct. Members of the Enterprise Admins group can create GPOs by default.
   3. Correct. Members of the Domain Admins group can create GPOs by default.
   4. Incorrect. The Domain Controllers group is a group for the accounts of domain controllers. It does not grant any permissions on GPOs.

5. Correct answer: D

   1. Incorrect. You use the Copy-GPO cmdlet to create a copy of an existing GPO. It does not allow you to revert the default domain GPO to its original state.
   2. Incorrect. You use the Restore-GPO cmdlet to restore a backed-up GPO to a previous state. You need to create the backup first.
   3. Incorrect. You use the Import-GPO cmdlet to import settings from a backed-up GPO to an existing target GPO.
   4. Correct. You use the Backup-GPO cmdlet to back up an existing GPO.

Lesson 2

1. Correct answer: B

   1. Incorrect. You use Security Filtering to filter GPO application based on security group membership.
   2. Correct. You can use a WMI query to filter GPO application based on the properties of a target computer, such as how much disk space it has available.
   3. Incorrect. You use loopback processing to enforce settings that apply to the computer account rather than the user account.
   4. Incorrect. You use slow-link processing to configure Group Policy not to apply across low-bandwidth connections.

2. Correct answer: D

   1. Incorrect. In this scenario, GPO Delta has precedence over the other GPOs.
   2. Incorrect. In this scenario, GPO Delta has precedence over the other GPOs.
   3. Incorrect. In this scenario, GPO Delta has precedence over the other GPOs.
   4. Correct. In this scenario, GPO Delta has precedence over the other GPOs.

3. Correct answer: C

   1. Incorrect. In this scenario, the No Override setting on GPO Gamma means that it has precedence.
   2. Incorrect. In this scenario, the No Override setting on GPO Gamma means that it has precedence.
   3. Correct. In this scenario, the No Override setting on GPO Gamma means that it has precedence.
   4. Incorrect. In this scenario, the No Override setting on GPO Gamma means that it has precedence.

4. Correct answer: B

   1. Incorrect. No Override settings override Block Inheritance, so the setting in GPO Beta applies to the computer.
   2. Correct. No Override settings override Block Inheritance, so the setting in GPO Beta applies to the computer.
   3. Incorrect. No Override settings override Block Inheritance, so the setting in GPO Beta applies to the computer.
   4. Incorrect. No Override settings override Block Inheritance, so the setting in GPO Beta applies to the computer.

5. Correct answer: A

   1. Correct. You use Security Filtering to filter GPO application based on security group membership. In this case, you configure the Apply Group Policy (Deny) advanced permission.
   2. Incorrect. You can use a WMI query to filter GPO application based on the properties of a target computer, such as how much disk space it has available.
   3. Incorrect. You use loopback processing to enforce settings that apply to the computer account rather than the user account.
   4. Incorrect. You use slow-link processing to configure Group Policy not to apply across low-bandwidth connections.