Your network contains a single Active Directory domain. Client computers run either Windows XP ServicePack
3 (SP3) or Windows 7. All of the computer accounts for the client computers are located in an organizational
unit (OU) named OU1.
You link a new Group Policy object (GPO) named GPO10 to OU1.
You need to ensure that GPO10 is applied only to client computers that run Windows 7.
What should you do?

A.
Create a new OU in OU1. Move the Windows XP computer accounts to the new OU.

B.
Enable block inheritance on OU1.

C.
Create a WMI filter and assign the filter to GPO10.

D.
Modify the permissions of OU1.

Explanation:
Reference:
http://technet.microsoft.com/en-us/library/cc947846.aspx
To make sure that each GPO associated with a group can only be applied to computers running the correct
version of Windows, use the Group Policy ManagementMMC snap-in to create and assign WMI filters to the
GPO. Although you can create a separate membership group for each GPO, you would then have to manage
the memberships of the different groups. Instead, use only a single membership group, and let WMI filters
automatically ensure the correct GPO is applied to each computer.