Exam 70-742 topic 1 question 193 discussion

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732979(v=ws.11)?redirectedfrom=MSDN

Aye, answer is correct. Domain and Enterprise admins have the right permission to link GPOs. As they're both admins of the root domain, they pretty much have full control. Admin2, is only a domain admin of the child domain, meaning he will not have the access to link GPOs

Answer is: D. Admin1 and Admin3 only

D. I think the given answer is correct. Enterprise administrators and domain administrators of the forest root domain have this privilege for sites. Admin 2 is domain admin on a sub domain so that user would not have the privilege to link GPO's on that site.

the answer should be C :: admin3 only. By default, only Enterprise Admins group have full control permission on an Active Directory Site, this is inherited from the "CN=Sites" portion of the Configuration directory partition. Default permission for Domain Admins, they don't have Full Control permission, While Enterprise Admins has full control permission. Moreover, the "Enterprise Admins" group contains only Admin3 as stated by this question, therefore, only Admin3 can link GPO to a newly created site "Site2". This is a very tricky question that "Admin1" is a separate account, he/she is not the built-in "Administrator"! When Admin1 belongs to the "Domain Admins" group only, he/she don't have full control permission over forest-level objects and configurations like "CN=Sites, CN=Configuration ......" partition. This question was designed to emphasize the super-dominating power of the "Enterprise Admins" universal group at the forest-level of your entire directory.