Your network contains a single Active Directory domain. Client computers run either
Windows XP Service Pack 3 (SP3) or Windows 7. All of the computer accounts for the client
computers are located in an organizational unit (OU) named OU1.
You link a new Group Policy object (GPO) named GPO10 to OU1.
You need to ensure that GPO10 is applied only to client computers that run Windows 7.
What should you do?

A.
Create a new OU in OU1. Move the Windows XP computer accounts to the new OU.

B.
Enable block inheritance on OU1.

C.
Create a WMI filter and assign the filter to GPO10.

D.
Modify the permissions of OU1.

Explanation:
http://technet.microsoft.com/en-us/library/cc947846.aspx
To make sure that each GPO associated with a group can only be applied to computers
running the correct version of Windows, use the Group Policy Management MMC snap-in to
create and assign WMI filters to the GPO. Although you can create a separate membership
group for each GPO, you would then have to manage the memberships of the different
groups. Instead, use only a single membership group, and let WMI filters automatically
ensure the correct GPO is applied to each computer.