Which Groups Can Be Added to Group3 and Group5 in Contoso?

Create and manage AD DS security principals

HOTSPOT Overview Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal. Existing Environment AD DS Environment The network contains an on-premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains named contoso.com and canada.contoso.com. The forest contains the domain controllers shown in the following table. exhibit All the domain controllers are global catalog servers. Server Infrastructure The network contains the servers shown in the following table. exhibit A server named Server4 runs Windows Server and is in a workgroup. Windows Defender Firewall on Server4 uses the private profile. Server2 hosts three virtual machines named VM1, VM2, and VM3. VM3 is a file server that stores data in the volumes shown in the following table. exhibit Group Policies The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table. exhibit Existing Identities The forest contains the users shown in the following table. exhibit The forest contains the groups shown in the following table. exhibit Current Problems When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without signing out, another administrator can connect to the console session as the currently signed-in user. Requirements Technical Requirements Contoso identifies the following technical requirements: Change the replication schedule for all site links to 30 minutes. Promote Server1 to a domain controller in canada.contoso.com. Install and authorize Server3 as a DHCP server. Ensure that User1 can manage the membership of all the groups in Contoso\OU3. Ensure that you can manage Server4 from Server1 by using PowerShell remoting. Ensure that you can run virtual machines on VM1. Force users to provide credentials when they connect to VM2. On VM3, enable Data Deduplication on all volumes that support the feature. Which groups can you add to Group3 and Group5? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point exhibit

Answer Add Group1 and Group2 only to Group3 (domain local security group in contoso.com). Add Group4 only to Group5 (global distribution group in canada.contoso.com).

Community Insight

The question tests whether you know which group scopes can legally nest into domain local and global groups, and the common trap is adding distribution groups to Group3 or adding cross-domain/out-of-scope groups to Group5.

This AZ-802 hotspot tests Active Directory group nesting rules across the contoso.com and canada.contoso.com domains, specifically which groups may be added to a domain local security group (Group3) and a global distribution group (Group5). The correct selection is Group1 and Group2 for Group3, and Group4 for Group5, following Microsoft's domain local, universal, and global scoping rules.

The most common wrong approach is adding a distribution group to the domain local security group Group3, or assuming Group4's domain membership blocks it from Group5. Distribution groups should not be added to security groups from a management standpoint, and a global group (Group5) can only contain global groups from the same domain (canada.contoso.com).

Community Discussion (1 comments)

Gina Lexx 👍 1

Contoso.com Domain local security Group3: Group1 and Group2 only Both Universal and Global can be added to Domain local security. From an Admin perspective, distribution groups should not be added to a security group. Canada.contoso.com Global distribution group Group5: Group4 only Global can contain global, only within the domain. Domain local cannot be added. OK - Security groups->Security groups (valid) NOT OK - Distribution groups ->Security groups (no security token) OK - Security groups -> Distribution groups (works but meaningless) OK - Distribution groups -> Distribution groups - expected Distribution groups are email groups with no security weight. Global can contain global. Universal can contain Global, Universal (Only used in multi domain forest) Domain Local can contain all 3. Also, Universal and Domain Local can accept groups from any domain. Global cannot.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

A domain local security group such as Group3 in contoso.com can contain global and universal groups, so Group1 and Group2 are valid members. Microsoft's scoping model restricts a global distribution group like Group5 in canada.contoso.com to containing only global groups, and only from within the same domain, which makes Group4 the sole valid addition. This follows the standard AGDLP/AGUDLP design pattern of nesting global and universal groups into domain local groups for resource access. The comment from Gina Lexx captures this exactly: domain local can receive both universal and global groups, while "Global can contain global, only within the domain."

Why Other Candidate Answers Are Wrong

Any selection that includes a distribution group in Group3 is incorrect because "From an Admin perspective, distribution groups should not be added to a security group," even where technically permitted. Any selection that adds a domain local group or a group from another domain to Group5 violates the global scope restriction, since global groups cannot hold domain local groups or members from contoso.com. Excluding Group1 or Group2 from Group3 would also be wrong because both are compatible universal/global scopes within the forest.

Community Comment Notes

The single community comment aligns with the official scoping rules: "Both Universal and Global can be added to Domain local security" for Group3, and "Global can contain global, only within the domain. Domain local cannot be added" for Group5. Gina Lexx's reasoning concludes "Group1 and Group2 only" for Group3 and "Group4 only" for Group5, which matches the verdict stated here. As with any anonymous vote or comment record, the answer was independently verified against Microsoft's group scope documentation rather than accepted on authority of the comment alone.

Official Reference

https://learn.microsoft.com/windows-server/identity/ad-ds/manage/understand-security-groups

Exam Strategy

When a hotspot asks which groups can be added, first identify each target group's scope (domain local, global, universal) and whether it is security or distribution, then apply the nesting rules table. Remember: domain local accepts global and universal; global accepts only global from the same domain; universal accepts universal and global.

Frequently Asked Questions

Why can't a distribution group be added to the domain local security group Group3 in contoso.com?

Microsoft scoping rules can technically allow it in some cases, but distribution groups should not be added to security groups from an administration perspective, so only the global and universal security groups Group1 and Group2 qualify.

Why is Group4 the only group that can be added to the global group Group5 in canada.contoso.com?

A global group can contain only global groups, and only groups from the same domain. Since Group4 is a global group in canada.contoso.com, it is the only valid member for Group5.

More AZ-802 FAQ →

Related Analysis

Practice All AZ-802 Questions

Access 125 questions with complete answers and detailed explanations.

View Full AZ-802 Practice Test →

← Back to AZ-802 Study Guide