Your network contains an Active Directory domain named contoso.com. All user accounts are in an
organizational unit (OU) named Employees.
You create a Group Policy object (GPO) named GP1. You link GP1 to the Employees OU.
You need to ensure that GP1 does not apply to the members of a group named Managers.
What should you configure?

A.
The Security settings of Employees

B.
The WMI filter for GP1

C.
The Block Inheritance option for Employees

D.
The Security settings of GP1

Explanation:
A)
Wrong Group
B)
Windows Management Instrumentation (WMI) filters allow you to dynamically determine the
scope of Group Policy objects (GPOs) based on attributes of the target computer.
C)
Blocking inheritance prevents Group Policy objects (GPOs) that are linked to higher sites, domains,
or organizational units from being automatically inherited by the child-level. D. Set Managers to –
Members of this security group are exempt from this Group Policy object.
Security settings.
You use the Security Settings extension to set security options for computers and users within the
scope of a Group Policy object. You can define local computer, domain, and network security
settings.
Figure below shows an example of the security settings that allow everyone to be affected by this
GPO except the members of the Management group, who were explicitly denied permission to the
GPO by setting the Apply Group Policy ACE to Deny. Note that if a member of the Management
group were also a member of a group that had an explicit Allow setting for the Apply Group Policy
ACE, the Deny would take precedence and the GPO would not affect the user.