DRAG DROP
Your network contains an Active Directory domain named contoso.com. All domain controllers run Windows
Server 2012 R2.
The domain contains an organizational unit (OU) named OU1. OU1 contains an OU named OU2. OU2 contains
a user named User1.
User1 is the member of a group named Group1. Group1 is in the Users container.
You create five Group Policy objects (GPO). The GPOs are configured as shown in the following table.
The Authenticated Users group is assigned the default permissions to all of the GPOs.
There are no site-level GPOs.
You need to identify which three GPOs will be applied to User1 and in which order the GPOs will be applied to
User1.
Which three GPOs should you identify in sequence?
To answer, move the appropriate three GPOs from the list of GPOs to the answer area and arrange them in the
correct order.
Select and Place:
Answer: 
Explanation:
GPO1 is applied first as it is linked to the domain.
GPO3 is applied next as it is in the parent OU.
GPO5 is applied last as it is in the child OU.
GPO2 and GPO4 are nor applied as they are disabled.
Note:
Group Policy objects are processed according to the following order:
0.The local Group Policy object (LPGO) is applied.
1.GPOs linked to sites.
2.GPOs linked to domains
3.GPOs linked to organizational units. In the case of nested organizational units, GPOs associated with parent
organizational units are processed prior to GPOs associated with child organizational units.
Exceptions to the default order of processing settings
The default order for processing settings is subject to the following exceptions:
*A GPO link may be enforced, or disabled, or both.
Etc.
Disabling a GPO link
By default, processing is enabled for all GPO links. You can completely block the application of a GPO for a
given site, domain, or organizational unit by disabling the GPO link for that domain, site, or organizational unit.
Note that this does not disable the GPO itself, and if the GPO is linked to other sites, domains or organizational
units, they will continue to process the GPO, if their links are enabled.
2,4 then 5
1 has deny apply for group1, 3 has deny read for group 1 so neither will run for user1 as he is in group1
5
0
Agree with you.
1
0
GPO5, GPO2, GPO4
Since GPO5 is enforced, it jump to the top.
“When a policy is enforced, its settings will be applied last. This means that it will override even GPOs that are created and linked closer to where the user or computer object is located. If it contains a setting and a GPO closer to the client object contains a conflicting setting, the enforced setting will win.”
https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/15/group-policy-basics-part-2-understanding-which-gpos-to-apply/
1
4