Hi,

Option C should work also, right?


You are the systems administrator for the staff administrative department of a hospital. You are in the domain called admin.hospital.msft, which is running in native mode. There are multiple shared folders throughout your Microsoft® Windows Server™ 2003 domain, and you must ensure that everyone has permissions to the shared folders. Doctors, nurses, and clerks require permissions. The accounts for the clerks are in your domain, but the doctors and nurses are in the staff.nwtraders.msft domain.
You have arranged to work with the administrator from the staff.hospital.msft domain to ensure that the group strategy is correct. Which strategy should you choose?

a. Create a global group in the staff domain called Staff. Create a global group in the admin domain called Clerks. Create a universal group and add the Staff and Clerks as members. Grant permissions to the universal group.

b. Create a global group in the staff domain called Staff. Create a global group in the admin domain called Clerks. Create a domain local group in the staff domain and add the Staff and Clerks as members. Grant permissions to the domain local group.

c. Create a domain local group in the admin domain called admin. Add the clerk accounts to the domain local group. Add the doctors and nurses accounts to the domain local group. Grant permissions to the domain local group.

d. Create a universal group called admin. Add the clerk accounts to the universal group. Add the doctors and nurses accounts to the universal group. Grant permissions to the universal group.
Answer

Answer b is correct.
Creating a global group in each domain allows for more flexibility. By creating a domain local group and granting permissions, you can easily add another global group to it at any time.