Active Directory Groups and Scoping Quiz

1.What are the two independent properties every Active Directory group has?

• Name and description
• Type and scope
• Owner and creation date
• Domain and forest

2.A distribution group is nested inside a security group that has write access to a file share. Can the distribution group's members reach that share through this nesting?

• Yes, because nesting always inherits the permissions of the parent group
• No, because a distribution group carries no security identifier that resolves into access, regardless of nesting
• It depends on whether the distribution group is domain local, global, or universal
• Yes, but only if the distribution group is universal scope

3.Which scope can contain members from any domain in the forest but can only be granted permissions within its own domain?

• Global
• Domain local
• Universal
• Distribution

4.Why can a global group not contain a member from a different domain?

• Because global groups are limited by a hard cap on total member count
• Because global scope is designed as the organizational layer, gathering users who share a role only within one domain
• Because only domain local groups are allowed to hold user objects
• Because cross-domain membership always requires universal group replication first

5.Why does only universal group membership replicate to the global catalog, while domain local and global group membership does not?

• Because universal groups are newer and use a more efficient replication protocol
• Because universal groups can grant access anywhere in the forest, so every domain controller with a global catalog copy needs to know who is in one
• Because domain local and global groups are deprecated in favor of universal groups
• Because only universal groups are allowed to contain computer objects

6.You query the global catalog for a resource's full group membership and get a result. What is the risk in trusting that result as complete?

• There is no risk; the global catalog always returns every group a user belongs to
• The global catalog shows universal group members instantly but misses domain local and global group members, which must be queried domain by domain
• The global catalog is only accurate for groups created in the last 30 days
• The global catalog only returns distribution group membership, not security groups

7.A user in Domain A appears to have access to a resource in Domain B, and the access does not come from a global group directly. What must be true about how that access is structured?

• The user was somehow added directly to a global group in Domain B
• The path runs through a universal group, or through a domain local group accepting a foreign security principal
• The domain controllers in Domain A and Domain B must share the same schema definition
• The access must have been granted directly to the user's security identifier, bypassing groups entirely