In Active Directory, what is the difference between a Global Group and a Local Group, and when would you assign permissions using each?

In Active Directory, what is the difference between a Global Group and a Local Group, and when would you assign permissions using each?

• A. Local Groups apply to a specific computer for local resource permissions
• B. Global Groups are used to group domain users and assign permissions within the domain
• C. Global Groups are used to assign permissions to resources across any domain
• D. Local Groups are used to group domain users and assign permissions within the domain

Answer: (B)

Global Groups are designed to contain domain users (and other groups from the same domain) and are used to grant access to resources within that domain. This scope keeps permissions manageable by grouping users who share the same domain, and you apply their permissions on resources located in that domain. Local Groups (in practice, the domain-local scope) serve a different purpose: they are used to grant access to resources in a particular domain or computer, and they can include members from any domain. However, the key idea in this question is that Global Groups are for domain-bound membership and domain-wide resource permissions, while Local Groups are tied to a specific resource scope rather than across the entire domain. So the best choice is that Global Groups group domain users and assign permissions within the domain.

Global Groups are designed to contain domain users (and other groups from the same domain) and are used to grant access to resources within that domain. This scope keeps permissions manageable by grouping users who share the same domain, and you apply their permissions on resources located in that domain.

Local Groups (in practice, the domain-local scope) serve a different purpose: they are used to grant access to resources in a particular domain or computer, and they can include members from any domain. However, the key idea in this question is that Global Groups are for domain-bound membership and domain-wide resource permissions, while Local Groups are tied to a specific resource scope rather than across the entire domain.

So the best choice is that Global Groups group domain users and assign permissions within the domain.