Organizational Units and Group Policy Fundamentals Quiz

1.What is the defining property that separates an Organizational Unit from a group?

• An OU grants its members access permissions directly, while a group does not
• An object belongs to exactly one OU at a time, while it can belong to many groups simultaneously
• An OU can only contain user objects, while a group can contain any object type
• OUs and groups are actually the same underlying object with different display names

2.A Group Policy Object can only be linked to which three container types?

• A site, a domain, or a group
• A site, a domain, or an OU
• A forest, a domain, or an OU
• An OU, a group, or a user account

3.An object is moved into an OU that has no GPOs linked to it. What access does that object now have as a result of that move?

• None. OU placement grants no access by itself; it only determines administrative delegation and which policies reach the object
• Whatever access is held by the other objects already in that OU
• Full administrative rights over every object below it in the tree
• Read access to every GPO linked anywhere in the domain

4.An administrator has full delegated rights over a parent OU. A new child OU is created beneath it, and a computer account is moved into that child OU. Does the administrator automatically have delegated rights over that computer account?

• Yes, delegation always cascades to every child OU created beneath the parent
• No, not automatically. Delegated administration does not cascade to child OUs unless it was explicitly configured to propagate
• No, because moving a computer account into a new OU always clears any existing delegation on the whole tree
• Yes, but only if the administrator is also a member of the Domain Admins group

5.In the office-building mental model used in this lesson, what does an employee's single desk location represent, and what do their club memberships represent?

• The desk represents group membership; the clubs represent OU placement
• The desk represents OU placement; the clubs represent group membership
• Both the desk and the clubs represent group membership, just at different scopes
• Both the desk and the clubs represent OU placement, just at different scopes

6.Why is the OU hierarchy one of the first things worth pulling during enumeration of an unfamiliar domain?

• Because OU names directly reveal Domain Admin passwords
• Because it functions as a map showing how administrative responsibility is divided and where policy is likely concentrated, before any specific GPO or ACL has been examined
• Because it is the only way to discover which computers exist in the domain
• Because OU structure automatically mirrors group membership, so reading one tells you the other

7.Why is a tiered OU design, separating domain controllers, servers, and workstations into their own top-level OUs, considered stronger practice than a flat, department-only structure?

• It removes the need for group-based access control entirely
• It lets delegation and Group Policy exposure be controlled independently for each tier
• It prevents replication lag between domain controllers
• It makes department-based delegation impossible, which simplifies auditing